Trojan.DownLoader10.39224

To ensure autorun and distribution:

Creates or modifies the following files:

Creates the following services:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe' = '%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe:*:Enabled:DualDesk-Server'

Creates and executes the following:

'%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe' -install
'%TEMP%\nse5.tmp\nsD.tmp' "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe" "DualDesk-Server" ENABLE
'%TEMP%\nse5.tmp\nsC.tmp' "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe" "DualDesk-Server" ENABLE ALL
'%PROGRAM_FILES%\DD20.4.7201306271824\DDHelper.exe'
'%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe' -service_run
'%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe' -service
'%TEMP%\nse5.tmp\nsB.tmp' "sc.exe" delete DD_CAD
'%TEMP%\nse5.tmp\ns7.tmp' "sc.exe" stop DD_CAD
'%TEMP%\nse5.tmp\ns6.tmp' "sc.exe" stop DD_Service
'%TEMP%\nsw3.tmp\DD_atshq.dynip.com_6116.exe' /20011903202294235655_Andromeda Technology Solutions Inc./0
'%TEMP%\nse5.tmp\nsA.tmp' "sc.exe" delete DD_Service
'%TEMP%\nse5.tmp\ns9.tmp' "net.exe" stop DD_CAD
'%TEMP%\nse5.tmp\ns8.tmp' "net.exe" stop DD_Service

Executes the following:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe" "DualDesk-Server" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe" "DualDesk-Server" ENABLE ALL
'<SYSTEM32>\sc.exe' delete DD_CAD
'<SYSTEM32>\sc.exe' /flushdns
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\net1.exe' start "DD_Service"
'<SYSTEM32>\sc.exe' delete DD_Service
'<SYSTEM32>\net.exe' stop DD_Service
'<SYSTEM32>\sc.exe' stop DD_CAD
'<SYSTEM32>\sc.exe' stop DD_Service
'<SYSTEM32>\net1.exe' stop DD_CAD
'<SYSTEM32>\net.exe' stop DD_CAD
'<SYSTEM32>\net1.exe' stop DD_Service

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Moves the following files:

from %TEMP%\nsw3.tmp\DD.txt to %PROGRAM_FILES%\DD20.4.7201306271824\DD.txt
from %TEMP%\nsw3.tmp\Ring.wav to %PROGRAM_FILES%\DD20.4.7201306271824\Ring.wav
from %TEMP%\nse5.tmp\DualDesk.exe to %PROGRAM_FILES%\DD20.4.7201306271824\DualDesk.exe
from %TEMP%\nsw3.tmp\ddHelper.exe to %PROGRAM_FILES%\DD20.4.7201306271824\DDHelper.exe
from %TEMP%\nsw3.tmp\Icon1.ico to %PROGRAM_FILES%\DD20.4.7201306271824\icon1.ico
from %TEMP%\nsw3.tmp\Logo.bmp to %PROGRAM_FILES%\DD20.4.7201306271824\Logo.bmp
from %TEMP%\nsw3.tmp\Blank.bmp to %PROGRAM_FILES%\DD20.4.7201306271824\Blank.bmp
from %TEMP%\nsw3.tmp\Icon2.ico to %PROGRAM_FILES%\DD20.4.7201306271824\icon2.ico

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: