Trojan.DownLoader33.40347

Technical Information

Malicious functions

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8877;https=127.0.0.1:8877;'
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0e99c03541d9e8dc46db799ba900676c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%TEMP%\tmp264f.tmp
%APPDATA%\microsoft\systemcertificates\my\keys\c107b610e18ff0ecca5bef43eccc030f30a3f64d
%APPDATA%\microsoft\systemcertificates\my\certificates\0a01297572a611fbfb39506627421e0a430dceb3
%APPDATA%\microsoft\systemcertificates\request\certificates\32ed79e1f19a8b3f2b366a66f7032fee3eef700e
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\29de805a1c65a3258b06c7f740479c1e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\16eb76b33f205b48be9cde81f7d30ef4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%TEMP%\tmp1b3a.tmp
%TEMP%\tmp1b29.tmp
%APPDATA%\microsoft\systemcertificates\my\keys\47bdfc2745af388634d72485d0289b509f752cac
%APPDATA%\microsoft\systemcertificates\my\certificates\04baa24879b36381aa7a9787451153ca3d402188
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%TEMP%\tmp2650.tmp
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6oaagigv\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p2dm6ase\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4x8qxzno\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\8hew48sh\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%APPDATA%\microsoft\systemcertificates\request\certificates\6b16ff51f9498bbbedacc3a7ffe53d89062a0c98
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2a9bfa7568912619ad2165e8f0e46f40_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\8hew48sh\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4x8qxzno\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p2dm6ase\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6oaagigv\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

%APPDATA%\microsoft\systemcertificates\request\certificates\6b16ff51f9498bbbedacc3a7ffe53d89062a0c98
%TEMP%\tmp1b29.tmp
%TEMP%\tmp1b3a.tmp
%APPDATA%\microsoft\systemcertificates\request\certificates\32ed79e1f19a8b3f2b366a66f7032fee3eef700e
%TEMP%\tmp264f.tmp
%TEMP%\tmp2650.tmp

Network activity

TCP

HTTP GET requests

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

HTTP POST requests

http://81############d790a1730d08245b4b.monitor-eqatec.com/monitor.ashx?pv#############################################################################################

'localhost':49172

UDP

DNS ASK 81############d790a1730d08245b4b.monitor-eqatec.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"