Trojan.DownLoader24.57409

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\mipony\shell\open\command] '' = '"%ProgramFiles(x86)%\MiPony\MiPony.exe" "/url:%1"'
[<HKLM>\Software\Classes\dlc\shell\open\command] '' = '"%ProgramFiles(x86)%\MiPony\MiPony.exe" "/url:%1"'
[<HKLM>\Software\Classes\jd\shell\open\command] '' = '"%ProgramFiles(x86)%\MiPony\MiPony.exe" "/url:%1"'
[<HKLM>\Software\Classes\jdlist\shell\open\command] '' = '"%ProgramFiles(x86)%\MiPony\MiPony.exe" "/url:%1"'
[<HKLM>\Software\Classes\mpybrowser\shell\open\command] '' = '"%ProgramFiles(x86)%\MiPony\MiPony.exe" "/url:%1"'

Modifies file system

Creates the following files

%LOCALAPPDATA%\spoon\sandbox\1.0.0.0\xsandbox.bin.__tmp__
%APPDATA%\mipony\sig.bin
%APPDATA%\mipony\mipony.xml
%LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe.manifest.__tmp__
%LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\x86_nullsoft.nsis.exehead@1.0.0.0.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\nullsoft.nsis.exehead.manifest.__tmp__
%LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\temp\@windir@\win.ini
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar64.dll_0x88af3b6e9a464bc0b99ec6566918bd66.2.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\uninst.exe_0x03302b9b82c77df6d0796aa23daec492.1.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\tesseract.exe_0x8d29ea026a8c72c8cd84b1cfdfe98815.1.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\mipony.exe_0x1b1d4fd2d41fd5bf9af47cb67c1220ae.1.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\leptonlib.dll_0x0e1e1944819fa8830098579c4dfac965.2.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest.__tmp__
%TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar.dll_0x8cdc0717d3537b71b5447ef9ca930eb1.2.manifest.__tmp__
%LOCALAPPDATA%\spoon\sandbox\1.0.0.0\roaming\meta\@windir@\win.ini.__meta__.__tmp__

Moves the following files

from %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\xsandbox.bin.__tmp__ to %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\xsandbox.bin
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\leptonlib.dll_0x0e1e1944819fa8830098579c4dfac965.2.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\leptonlib.dll_0x0e1e1944819fa8830098579c4dfac965.2.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\mipony.exe_0x1b1d4fd2d41fd5bf9af47cb67c1220ae.1.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\mipony.exe_0x1b1d4fd2d41fd5bf9af47cb67c1220ae.1.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\tesseract.exe_0x8d29ea026a8c72c8cd84b1cfdfe98815.1.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\tesseract.exe_0x8d29ea026a8c72c8cd84b1cfdfe98815.1.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\uninst.exe_0x03302b9b82c77df6d0796aa23daec492.1.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\uninst.exe_0x03302b9b82c77df6d0796aa23daec492.1.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar.dll_0x8cdc0717d3537b71b5447ef9ca930eb1.2.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar.dll_0x8cdc0717d3537b71b5447ef9ca930eb1.2.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar64.dll_0x88af3b6e9a464bc0b99ec6566918bd66.2.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\manifests\unrar64.dll_0x88af3b6e9a464bc0b99ec6566918bd66.2.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\nullsoft.nsis.exehead.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\nullsoft.nsis.exehead.manifest
from %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\x86_nullsoft.nsis.exehead@1.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0xce9011fb48b359e8\sxs\x86_nullsoft.nsis.exehead@1.0.0.0\x86_nullsoft.nsis.exehead@1.0.0.0.manifest
from %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe.__tmp__ to %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe
from %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe.manifest.__tmp__ to %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\stubexe\0x14d091afb9c2d72a\mipony.exe.manifest
from %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\local\temp\@windir@\win.ini to %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\roaming\modified\@windir@\win.ini
from %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\roaming\meta\@windir@\win.ini.__meta__.__tmp__ to %LOCALAPPDATA%\spoon\sandbox\1.0.0.0\roaming\meta\@windir@\win.ini.__meta__