Trojan.DownLoader33.41297

Technical Information

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\wisptis.exe

Modifies file system

Creates the following files

<Current directory>\jpegminipro\registry.rw.tvr.lck.idyofwb.ffffffff.5d8
<Current directory>\jpegminipro\registry.rw.tvr
<Current directory>\jpegminipro\registry.rw.tvr.transact
<Current directory>\jpegminipro\registry.tlog.cache
<Current directory>\jpegminipro\registry.tlog
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
<Current directory>\jpegminipro\%appdata%\jpegmini_logs\jpegminipro.log
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\da3b6e45325d5fff28cf6bad6065c907_c0faf50ed7f9bb0f035bc90923249454
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\da3b6e45325d5fff28cf6bad6065c907_c0faf50ed7f9bb0f035bc90923249454
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7
%TEMP%\{122082a6-3efb-442b-978a-a8fae6d663d3}\icvt.jpegmini.core.dll
<Current directory>\jpegminipro\%appdata%\jpegminipro\state.dat

Sets the 'hidden' attribute to the following files

<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\da3b6e45325d5fff28cf6bad6065c907_c0faf50ed7f9bb0f035bc90923249454
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\da3b6e45325d5fff28cf6bad6065c907_c0faf50ed7f9bb0f035bc90923249454
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\metadata\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7
<Current directory>\jpegminipro\%local appdata%low\microsoft\cryptneturlcache\content\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7

Moves the following files

from <Current directory>\jpegminipro\registry.rw.tvr.lck.idyofwb.ffffffff.5d8 to <Current directory>\jpegminipro\registry.rw.tvr.lck

Network activity

TCP

HTTP GET requests

http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f%2Btw%2FGciJ7fvbA4gIz7D4CEH6T6%2Ft8xk5Z6kuad9QG%2FDs%3D
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D

'ss#.####le-analytics.com':443

UDP