Trojan.DownLoader25.21674

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\Adobe Flash Player Updater.job

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\AdobeFlashPlayerUpdateSvc] 'ImagePath' = '<SYSTEM32>\Macromed\Flash\FlashPlayerUpdateService.exe'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\Macromed\Flash\FlashUtil32_14_0_0_125_ActiveX.exe' -refreshIEElevationPolicies
'<SYSTEM32>\Macromed\Flash\FlashPlayerUpdateService.exe' -install
'%WINDIR%\AGMSUPPORT\TEMP\Progress.exe' kill
'%TEMP%\InstallAX_14_0_0_125.exe' -install -msi
'%TEMP%\mia1.tmp\AGM_AFlash14.exe' /m="<Full path to file>" /k=""
'%WINDIR%\AGMSUPPORT\TEMP\LoadNet.exe'
'%WINDIR%\AGMSUPPORT\TEMP\Progress.exe' "Running: Adobe Flash Player 14.0.0.125"

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding A5D700DB90FC0E174E56512266705127
'<SYSTEM32>\cmd.exe' /c del "%TEMP%\InstallAX_14_0_0_125.exe" >> NUL
'<SYSTEM32>\msiexec.exe' /i "%WINDIR%\AGMSUPPORT\TEMP\install_flash_player_14_active_x.msi" /quiet /norestart
'<SYSTEM32>\msiexec.exe' /V

Modifies file system:

Creates the following files:

%TEMP%\{9B9F8B3F-5CDD-4549-8FA9-7B529EE94CA0}\fpb.tmp
C:\Config.Msi\2e4ac.rbs
<SYSTEM32>\Macromed\Flash\Flash32_14_0_0_125.ocx
%TEMP%\{06C8C4E6-3AD9-4D47-8C84-052B3277F2AC}\fpb.tmp
%WINDIR%\Installer\MSI10.tmp
%WINDIR%\Installer\2e4a9.msi
%WINDIR%\Installer\MSI11.tmp
%WINDIR%\Installer\2e4ab.ipi
<SYSTEM32>\Macromed\Flash\FlashUtil32_14_0_0_125_ActiveX.exe
<SYSTEM32>\Macromed\Flash\FlashPlayerUpdateService.exe
<SYSTEM32>\Macromed\Flash\FlashInstall.log
%WINDIR%\Installer\{1F5E5F2E-5E61-431D-B796-58CCC6B68E28}\ARPPRODUCTICON.exe
%WINDIR%\Installer\2e4ad.msi
<SYSTEM32>\Macromed\Flash\activex.vch
<SYSTEM32>\Macromed\Flash\FlashUtil32_14_0_0_125_ActiveX.dll
<SYSTEM32>\FlashPlayerApp.exe
<SYSTEM32>\FlashPlayerCPLApp.cpl
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%TEMP%\mia1.tmp\data\OFFLINE\123E46E\83E8E7DB\Progress.exe
%TEMP%\mia1.tmp\data\OFFLINE\3E6D3021\83E8E7DB\LoadNet.exe
%TEMP%\mia1.tmp\AGM_AFlash14.res
%TEMP%\mia1.tmp\mia.lib
%TEMP%\mia1.tmp\data\AGM_AFlash14.msi
%TEMP%\mia1.tmp\AGM_AFlash14.msi
%TEMP%\mia1.tmp\AGM_AFlash14.exe
%TEMP%\mia1.tmp\data\OFFLINE\B1A4E16E\98580EC9\install_flash_player_14_active_x.msi
%TEMP%\mia1\installaware.png
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%WINDIR%\AGMSUPPORT\TEMP\Progress.exe
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\mia1\AGM_AFlash14.msi
%TEMP%\mia1\icon.ico
%WINDIR%\AGMSUPPORT\TEMP\LoadNet.exe
%WINDIR%\AGMSUPPORT\TEMP\install_flash_player_14_active_x.msi

Deletes the following files:

%TEMP%\{9B9F8B3F-5CDD-4549-8FA9-7B529EE94CA0}\fpb.tmp
<SYSTEM32>\Macromed\Flash\flash.ocx
%TEMP%\Cab19.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab17.tmp
%TEMP%\{06C8C4E6-3AD9-4D47-8C84-052B3277F2AC}\fpb.tmp
%WINDIR%\Installer\2e4a9.msi
%WINDIR%\Installer\2e4ab.ipi
C:\Config.Msi\2e4ac.rbs
%TEMP%\InstallAX_14_0_0_125.exe
%WINDIR%\Installer\MSI11.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab2.tmp
%TEMP%\Cab4.tmp
%WINDIR%\AGMSUPPORT\TEMP\LoadNet.exe
%TEMP%\lang.loc
%TEMP%\mia.tmp
%TEMP%\Cab6.tmp
%TEMP%\CabE.tmp
%WINDIR%\Installer\MSI10.tmp
%TEMP%\CabC.tmp
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp

Network activity:

Connects to:

'www.download.windowsupdate.com':80
'wp#d':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d

UDP: