Trojan.DownLoad4.13966

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\5da9fe87-02f5-4bdd-9b9c-2a4d098c8d12\E9AB.tmp.exe" --AutoStart'

Creates or modifies the following files

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\lpmthqeh] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\lpmthqeh] 'ImagePath' = '%WINDIR%\SysWOW64\lpmthqeh\wudenjyu.exe /d"%TEMP%\F5A2.tmp.exe"'

Creates the following services

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Deletes the following files

Moves the following files

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.ms###csi.com/ncsi.txt
http://37.##.127.236/2.php
http://at#####kyday0003.top/down/id9.exe
http://hu####.uufjffff.com//iuww/kkgee.exe
http://cj##.top/files/penelop/updatewin1.exe
http://cj##.top/sgfjsgdfgsgddagdpen4/get.php?pi#############################################
http://cj##.top/files/penelop/updatewin2.exe
http://go####ftware.best/dl_3_8481156.exe

HTTP POST requests

'ap#.2ip.ua':443

'te##te.in':443

'ul###########urner.s3.eu-west-2.amazonaws.com':443

UDP

Miscellaneous

Creates and executes the following

'%TEMP%\e9ab.tmp.exe'
'%TEMP%\b079.tmp.exe'
'%LOCALAPPDATA%\75c40dce-4a73-4075-8c90-ba49b9c529d9\updatewin2.exe'
'%LOCALAPPDATA%\75c40dce-4a73-4075-8c90-ba49b9c529d9\updatewin1.exe'
'%TEMP%\bc8f.tmp.exe'
'%LOCALAPPDATA%\75c40dce-4a73-4075-8c90-ba49b9c529d9\updatewin1.exe' --Admin
'%TEMP%\c933.tmp.exe'
'%WINDIR%\syswow64\lpmthqeh\wudenjyu.exe' /d"%TEMP%\F5A2.tmp.exe"
'%TEMP%\is-6jdlv.tmp\c933.tmp.tmp' /SL5="$D021E,146532,62464,%TEMP%\C933.tmp.exe"
'%TEMP%\207.tmp.exe'
'%TEMP%\f5a2.tmp.exe'
'%TEMP%\e9ab.tmp.exe' --Admin IsNotAutoStart IsNotTask
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lpmthqeh\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start lpmthqeh' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description lpmthqeh "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\5da9fe87-02f5-4bdd-9b9c-2a4d098c8d12" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create lpmthqeh binPath= "%WINDIR%\SysWOW64\lpmthqeh\wudenjyu.exe /d\"%TEMP%\F5A2.tmp.exe\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wudenjyu.exe" %WINDIR%\SysWOW64\lpmthqeh\' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lpmthqeh\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wudenjyu.exe" %WINDIR%\SysWOW64\lpmthqeh\
'%WINDIR%\syswow64\sc.exe' create lpmthqeh binPath= "%WINDIR%\SysWOW64\lpmthqeh\wudenjyu.exe /d\"%TEMP%\F5A2.tmp.exe\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\5da9fe87-02f5-4bdd-9b9c-2a4d098c8d12" /deny *S-1-1-0:(OI)(CI)(DE,DC)
'%WINDIR%\syswow64\sc.exe' description lpmthqeh "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start lpmthqeh