Trojan.DownLoader6.64213

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Windows_rejoice2008_201] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SVKP] 'Start' = '00000002'

Malicious functions:

Executes the following:

<SYSTEM32>\dumprep.exe 3416 -dm 7 7 %TEMP%\WER2406.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3376 -dm 7 7 %TEMP%\WER247e.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3496 -dm 7 7 %TEMP%\WER5b7f.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3444 -dm 7 7 %TEMP%\WER23a8.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3236 -dm 7 7 %TEMP%\WER7397.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3276 -dm 7 7 %TEMP%\WER8637.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3276 -dm 7 7 %TEMP%\WER8637.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3200 -dm 7 7 %TEMP%\WER741c.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3540 -dm 7 7 %TEMP%\WER7ba0.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3540 -dm 7 7 %TEMP%\WER7ba0.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3496 -dm 7 7 %TEMP%\WER5b7f.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3676 -dm 7 7 %TEMP%\WERaefd.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3560 -dm 7 7 %TEMP%\WER8e7c.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3444 -dm 7 7 %TEMP%\WER23a8.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3560 -dm 7 7 %TEMP%\WER8e7c.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3416 -dm 7 7 %TEMP%\WER2406.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3376 -dm 7 7 %TEMP%\WER247e.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3156 -dm 7 7 %TEMP%\WER23c8.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 2944 -dm 7 7 %TEMP%\WER59dc.dir00\calc.exe.hdmp 16325836412027096
<SYSTEM32>\dumprep.exe 2944 -dm 7 7 %TEMP%\WER59dc.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3004 -dm 7 7 %TEMP%\WERda60.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 2980 -dm 7 7 %TEMP%\WERb280.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 2896 -dm 7 7 %TEMP%\WER3d18.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\calc.exe
<SYSTEM32>\rundll32.exe <SYSTEM32>\sysdm.cpl,NoExecuteProcessException <SYSTEM32>\calc.exe
<SYSTEM32>\dumprep.exe 2896 -dm 7 7 %TEMP%\WER3d18.dir00\calc.exe.hdmp 16325836412027096
<SYSTEM32>\dumprep.exe 3036 -dm 7 7 %TEMP%\WERddbd.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3128 -dm 7 7 %TEMP%\WERfe6d.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3156 -dm 7 7 %TEMP%\WER23c8.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3236 -dm 7 7 %TEMP%\WER7397.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3200 -dm 7 7 %TEMP%\WER741c.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3036 -dm 7 7 %TEMP%\WERddbd.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 2980 -dm 7 7 %TEMP%\WERb280.dir00\calc.exe.hdmp 16325836412027088
<SYSTEM32>\dumprep.exe 3128 -dm 7 7 %TEMP%\WERfe6d.dir00\calc.exe.mdmp 16325836412027076
<SYSTEM32>\dumprep.exe 3004 -dm 7 7 %TEMP%\WERda60.dir00\calc.exe.hdmp 16325836412027088

Injects code into

the following system processes:

<SYSTEM32>\calc.exe

Modifies file system :

Creates the following files:

%TEMP%\WER7397.dir00\appcompat.txt
%TEMP%\WER8637.dir00\appcompat.txt
%TEMP%\WER23c8.dir00\appcompat.txt
%TEMP%\WER8637.dir00\manifest.txt
%TEMP%\WER7397.dir00\manifest.txt
%TEMP%\WER741c.dir00\appcompat.txt
%TEMP%\WER23c8.dir00\manifest.txt
%TEMP%\WERfe6d.dir00\manifest.txt
%TEMP%\WERfe6d.dir00\appcompat.txt
%TEMP%\WER8637.dir00\calc.exe.mdmp
%TEMP%\WER23c8.dir00\calc.exe.hdmp
%TEMP%\WER7397.dir00\calc.exe.hdmp
%TEMP%\WER8637.dir00\calc.exe.hdmp
%TEMP%\WER741c.dir00\calc.exe.hdmp
%TEMP%\WER2406.dir00\calc.exe.hdmp
%TEMP%\WER247e.dir00\calc.exe.hdmp
%TEMP%\WER23a8.dir00\calc.exe.hdmp
%TEMP%\WER5b7f.dir00\calc.exe.hdmp
%TEMP%\WERaefd.dir00\calc.exe.mdmp
%TEMP%\WER7ba0.dir00\calc.exe.hdmp
%TEMP%\WER8e7c.dir00\calc.exe.hdmp
%TEMP%\WER2406.dir00\calc.exe.mdmp
%TEMP%\WER23a8.dir00\calc.exe.mdmp
%TEMP%\WER741c.dir00\manifest.txt
%TEMP%\WER247e.dir00\calc.exe.mdmp
%TEMP%\WER8e7c.dir00\calc.exe.mdmp
%TEMP%\WER7ba0.dir00\calc.exe.mdmp
%TEMP%\WER5b7f.dir00\calc.exe.mdmp
%TEMP%\WER7397.dir00\calc.exe.mdmp
%TEMP%\WER59dc.dir00\calc.exe.hdmp
%TEMP%\WER59dc.dir00\calc.exe.mdmp
%TEMP%\WER3d18.dir00\manifest.txt
%TEMP%\WERb280.dir00\calc.exe.mdmp
%TEMP%\WER59dc.dir00\appcompat.txt
%TEMP%\WERda60.dir00\calc.exe.mdmp
%TEMP%\WERddbd.dir00\calc.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\rejoice082.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\FieleWay.txt
<SYSTEM32>\SVKP.sys
<SYSTEM32>\_rejoice082.exe
%TEMP%\WER3d18.dir00\appcompat.txt
%TEMP%\WER3d18.dir00\calc.exe.hdmp
%TEMP%\WER3d18.dir00\calc.exe.mdmp
%TEMP%\WERddbd.dir00\appcompat.txt
%TEMP%\WERda60.dir00\manifest.txt
%TEMP%\WERda60.dir00\appcompat.txt
%TEMP%\WERddbd.dir00\manifest.txt
%TEMP%\WER741c.dir00\calc.exe.mdmp
%TEMP%\WERfe6d.dir00\calc.exe.hdmp
%TEMP%\WER23c8.dir00\calc.exe.mdmp
%TEMP%\WERddbd.dir00\calc.exe.hdmp
%TEMP%\WERb280.dir00\calc.exe.hdmp
%TEMP%\WER59dc.dir00\manifest.txt
%TEMP%\WERda60.dir00\calc.exe.hdmp
%TEMP%\WERfe6d.dir00\calc.exe.mdmp
%TEMP%\WERb280.dir00\manifest.txt
%TEMP%\WERb280.dir00\appcompat.txt

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\_rejoice082.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\rejoice082.exe

Deletes the following files:

%CommonProgramFiles%\Microsoft Shared\MSInfo\FieleWay.txt

Deletes itself.

Network activity:

Connects to:

'<Private IP address>':8181

Miscellaneous:

Searches for the following windows:

ClassName: 'TSxre2008' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'TAppBuilder' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial