Trojan.DownLoader8.34247

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe' = '%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe:*:Enabled:DualDesk-Server'

Creates and executes the following:

%TEMP%\nsa6.tmp\nsC.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe" "DualDesk-Server" ENABLE ALL
%TEMP%\nsa6.tmp\nsB.tmp "%PROGRAM_FILES%\DD20.4.4201210112237\Uninst.exe"
%TEMP%\nsa6.tmp\nsD.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe" "DualDesk-Server" ENABLE
%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe
%PROGRAM_FILES%\DD20.4.4201210112237\DDHelper.exe
%TEMP%\nsa6.tmp\ns7.tmp "sc.exe" delete DD_Service
%TEMP%\nsi3.tmp\DD_owa.esllc.com_5500.exe /13712953201-1206823965_Essential Solutions LLC/0
%TEMP%\nsa6.tmp\ns8.tmp "sc.exe" delete DD_CAD
%TEMP%\nsa6.tmp\nsA.tmp ""
%TEMP%\nsa6.tmp\ns9.tmp "net.exe" stop DD_Service

Executes the following:

<SYSTEM32>\net1.exe stop DD_Service
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe" "DualDesk-Server" ENABLE ALL
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe" "DualDesk-Server" ENABLE
<SYSTEM32>\sc.exe delete DD_Service
<SYSTEM32>\sc.exe delete DD_CAD
<SYSTEM32>\net.exe stop DD_Service

Modifies file system :

Creates the following files:

%TEMP%\nsa6.tmp\cad.exe
%TEMP%\nsa6.tmp\DualDesk.exe
%TEMP%\nsi3.tmp\Configs\DD20.4.4.txt
%PROGRAM_FILES%\DD20.4.4201210112237\DD.txt
%TEMP%\nsi3.tmp\ToolBox\DD20.4.4.txt
%TEMP%\nsa6.tmp\ns9.tmp
%TEMP%\nsa6.tmp\ns8.tmp
%TEMP%\nsa6.tmp\nsA.tmp
%PROGRAM_FILES%\DD20.4.4201210112237\UnDD.txt
%TEMP%\nsa6.tmp\nsB.tmp
%PROGRAM_FILES%\DD20.4.4201210112237\ToolBox\DDHelper.lnk
%HOMEPATH%\Desktop\ToolBox 20.4.4.0.lnk
%PROGRAM_FILES%\DD20.4.4201210112237\ToolBox\DualDesk.lnk
%TEMP%\1-1206823965.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1-1206823965[1].txt
%TEMP%\nsa6.tmp\nsD.tmp
%TEMP%\nsa6.tmp\nsC.tmp
%PROGRAM_FILES%\DD20.4.4201210112237\StopDD.reg
%HOMEPATH%\Desktop\Stop Remote Support.lnk
%PROGRAM_FILES%\DD20.4.4201210112237\Uninst.exe
%TEMP%\nsi3.tmp\Icon1.ico
%TEMP%\nsi3.tmp\Logo.bmp
%TEMP%\nsi3.tmp\Icon2.ico
%TEMP%\nsi3.tmp\Ring.wav
%TEMP%\nsi3.tmp\Blank.bmp
%TEMP%\nsi3.tmp\DD_owa.esllc.com_5500.exe
%TEMP%\nsn2.tmp
%TEMP%\nsi3.tmp\ddHelper.exe
%TEMP%\nsi3.tmp\Splash.bmp
%TEMP%\nsi3.tmp\DD.txt
%HOMEPATH%\Start Menu\Programs\Administrative Tools\desktop.ini
%PROGRAM_FILES%\DD20.4.4201210112237\Advantig.txt
%HOMEPATH%\My Documents\My Videos\Desktop.ini
%TEMP%\nsa6.tmp\ns7.tmp
%TEMP%\nsa6.tmp\nsExec.dll
%TEMP%\nsa6.tmp\Splash.dll
%TEMP%\nsk5.tmp
%TEMP%\nsa6.tmp\NSISdl.dll
%TEMP%\nsisdt.dll
%TEMP%\nsi3.tmp\DD1-1206823965.txt

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Moves the following files:

from %TEMP%\nsi3.tmp\DD.txt to %PROGRAM_FILES%\DD20.4.4201210112237\DD.txt
from %TEMP%\nsi3.tmp\Ring.wav to %PROGRAM_FILES%\DD20.4.4201210112237\Ring.wav
from %TEMP%\nsa6.tmp\DualDesk.exe to %PROGRAM_FILES%\DD20.4.4201210112237\DualDesk.exe
from %TEMP%\nsi3.tmp\ddHelper.exe to %PROGRAM_FILES%\DD20.4.4201210112237\DDHelper.exe
from %TEMP%\nsi3.tmp\Icon1.ico to %PROGRAM_FILES%\DD20.4.4201210112237\icon1.ico
from %TEMP%\nsi3.tmp\Logo.bmp to %PROGRAM_FILES%\DD20.4.4201210112237\Logo.bmp
from %TEMP%\nsi3.tmp\Blank.bmp to %PROGRAM_FILES%\DD20.4.4201210112237\Blank.bmp
from %TEMP%\nsi3.tmp\Icon2.ico to %PROGRAM_FILES%\DD20.4.4201210112237\icon2.ico

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: