Trojan.DownLoader25.50756

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = ''
[<HKLM>\SOFTWARE\Classes\Midtronics Update Wizard File\shell\open\command] '' = '"%ProgramFiles%\Midtronics\MUW\muw.exe" "%1"'

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\Midtronics\MUW\MUW.exe' 192-210176M.mup
'%ProgramFiles%\Midtronics\MUW\DPInst.exe' /s
'%ProgramFiles%\Midtronics\MUW\DPInst.exe' /f /s

Modifies file system:

Creates the following files:

%ProgramFiles%\Midtronics\MUW\GRX_Francais.lwl
%ProgramFiles%\Midtronics\MUW\MUW_English.lwl
%ProgramFiles%\Midtronics\MUW\GRX_English.lwl
%ProgramFiles%\Midtronics\MUW\GRX_Espanol.lwl
%ProgramFiles%\Midtronics\MUW\english.lwl
%ProgramFiles%\Midtronics\MUW\french.lwl
%ProgramFiles%\Midtronics\MUW\MUW_Espanol.lwl
%ProgramFiles%\Midtronics\MUW\MUW_Francais.lwl
%ProgramFiles%\Midtronics\MUW\EXP_English.lwl
%ProgramFiles%\Midtronics\MUW\EXP_Espanol.lwl
%ProgramFiles%\Midtronics\MUW\GRXpnl.uir
%ProgramFiles%\Midtronics\MUW\MUWpnl.uir
%ProgramFiles%\Midtronics\MUW\GR8_Espanol.lwl
%ProgramFiles%\Midtronics\MUW\GR8_Francais.lwl
%ProgramFiles%\Midtronics\MUW\EXP_Francais.lwl
%ProgramFiles%\Midtronics\MUW\GR8_English.lwl
%ProgramFiles%\Midtronics\MUW\cvirte\bin\msgrte.txt
%ProgramFiles%\Midtronics\MUW\cvirte\fonts\ni7seg.ttf
%ProgramFiles%\Midtronics\MUW\cvirte\bin\cvirte.rsc
%ProgramFiles%\Midtronics\MUW\cvirte\bin\msgrt4.txt
%ProgramFiles%\Midtronics\MUW\uninstall.exe
%ProgramFiles%\Midtronics\MUW\Status.log
%ProgramFiles%\Midtronics\MUW\cvirte\fonts\nisystem.ttf
%ALLUSERSPROFILE%\Start Menu\Programs\Midtronics\MUW\Midtronics Update Wizard.lnk
%ProgramFiles%\Midtronics\MUW\mesa.dll
%ProgramFiles%\Midtronics\MUW\cviauto.dll
%ProgramFiles%\Midtronics\MUW\spanish.lwl
%ProgramFiles%\Midtronics\MUW\192-210176M.mup
%ProgramFiles%\Midtronics\MUW\dataskt.dll
%ProgramFiles%\Midtronics\MUW\cvirte\bin\cvirt4.rsc
%ProgramFiles%\Midtronics\MUW\cvirt.dll
%ProgramFiles%\Midtronics\MUW\cvirte.dll
%ProgramFiles%\Midtronics\MUW\GR8pnl.uir
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem3.PNF
<SYSTEM32>\DRVSTORE\pl_2303_D1495DE035C599A08BA37CED3DE56953488A64CC\ser2pl.sys
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%ProgramFiles%\Midtronics\MUW\mdiserial.cat
<SYSTEM32>\DRVSTORE\mdiserial_6B0B85D2AF91185E73F3FECD405532215ED7A3FC\mdiserial.inf
%ProgramFiles%\DIFX\270581355A767BF1\DPInst.exe
%ProgramFiles%\Midtronics\MUW\mdiserial.inf
%ProgramFiles%\Midtronics\MUW\pl2303.cat
%ProgramFiles%\Midtronics\MUW\ser2pl.sys
%TEMP%\nsi2.tmp\System.dll
%ProgramFiles%\Midtronics\MUW\PL_2303.inf
<SYSTEM32>\DRVSTORE\pl_2303_D1495DE035C599A08BA37CED3DE56953488A64CC\pl_2303.inf
<SYSTEM32>\DRVSTORE\pl_2303_D1495DE035C599A08BA37CED3DE56953488A64CC\pl2303.cat
%ProgramFiles%\Midtronics\MUW\DPInst.exe
%WINDIR%\DPINST.LOG
%ProgramFiles%\Midtronics\MUW\EXP_ExpMem.ini
%ProgramFiles%\Midtronics\MUW\GR8_ExpMem.ini
%ProgramFiles%\Midtronics\MUW\EXP.ini
%ProgramFiles%\Midtronics\MUW\GR8.ini
%ProgramFiles%\Midtronics\MUW\MUW.ICO
%ProgramFiles%\Midtronics\MUW\EXPpnl.uir
%ProgramFiles%\Midtronics\MUW\Bridge.ini
%ProgramFiles%\Midtronics\MUW\MUW.exe
%WINDIR%\inf\oem4.inf
%WINDIR%\inf\oem4.PNF
<SYSTEM32>\DRVSTORE\mdiserial_6B0B85D2AF91185E73F3FECD405532215ED7A3FC\mdiserial.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
%ProgramFiles%\Midtronics\MUW\GRXdeviceStatus.bat
%ProgramFiles%\Midtronics\MUW\Engine.ini
%ProgramFiles%\Midtronics\MUW\devcon.exe
%ProgramFiles%\Midtronics\MUW\deviceStatus.bat