Trojan.DownLoader24.63505

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IM Messenger' = '%WINDIR%\im.exe'

Malicious functions:

Executes the following:

'%WINDIR%\slash.com' --crash-reporter-parent-id=2960
'%TEMP%\Opera Installer\slash.com' --version
'%WINDIR%\slash.com' --crash-reporter-parent-id=2916
'<SYSTEM32>\cmd.exe' /c rename %WINDIR%\rnmx.exe im.exe
'%WINDIR%\slash.com'

Modifies file system:

Creates the following files:

<SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\oemig50.exe.new
%ProgramFiles%\Windows NT\Accessories\wordpad.exe.new
%ProgramFiles%\Windows NT\Pinball\pinball.exe.new
<SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\migrate.exe.new
%ProgramFiles%\Windows NT\dialer.exe.new
%ProgramFiles%\Outlook Express\wab.exe.new
<SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new
%ProgramFiles%\Outlook Express\setup50.exe.new
%ProgramFiles%\Outlook Express\wabmig.exe.new
<SYSTEM32>\dllcache\msimn.exe.new
%ProgramFiles%\Windows Media Player\wmplayer.exe.new
%ProgramFiles%\Windows Media Player\migrate.exe.new
%ProgramFiles%\Windows Media Player\setup_wm.exe.new
<SYSTEM32>\dllcache\taskman.exe.new
<SYSTEM32>\dllcache\twunk_16.exe.new
%WINDIR%\winhelp.exe.new
%WINDIR%\winhlp32.exe.new
<SYSTEM32>\dllcache\twunk_32.exe.new
%WINDIR%\Help\Tours\mmTour\tour.exe.new
%WINDIR%\inf\unregmp2.exe.new
<SYSTEM32>\dllcache\winhelp.exe.new
<SYSTEM32>\dllcache\winhlp32.exe.new
<SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\pinball.exe.new
%WINDIR%\notepad.exe.new
<SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\wordpad.exe.new
%WINDIR%\regedit.exe.new
<SYSTEM32>\dllcache\notepad.exe.new
%WINDIR%\twunk_32.exe.new
%WINDIR%\taskman.exe.new
%WINDIR%\twunk_16.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.new
%ProgramFiles%\Movie Maker\moviemk.exe.new
<SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
%ProgramFiles%\Internet Explorer\iexplore.exe.new
%TEMP%\Opera Installer\opera_installer_20170602134506.log
%TEMP%\Opera Installer\opera_installer_20170602134507.log
%WINDIR%\rnmx.exe
%WINDIR%\slash.com
%TEMP%\Opera Installer\slash.com
<SYSTEM32>\dllcache\msinfo32.exe.new
%ProgramFiles%\Internet Explorer\iedw.exe.new
%TEMP%\Opera Installer\installer.lck
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%ProgramFiles%\NetMeeting\conf.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\zclientm.exe.new
<SYSTEM32>\dllcache\bckgzm.exe.new
%ProgramFiles%\Outlook Express\msimn.exe.new
<SYSTEM32>\dllcache\shvlzm.exe.new
%ProgramFiles%\Outlook Express\oemig50.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvsezm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new

Deletes the following files:

%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\winhlp32.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\inf\unregmp2.exe
%WINDIR%\Help\Tours\mmTour\tour.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
%WINDIR%\winhelp.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\explorer.exe
%TEMP%\Opera Installer\slash.com
%WINDIR%\regedit.exe
%WINDIR%\twunk_32.exe
%WINDIR%\twunk_16.exe
%WINDIR%\TASKMAN.EXE