Trojan.DownLoader25.23116

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\CLSID\{AF904382-7E87-4348-89AA-99C0CC8A698C}\Shell\Open\Command] '' = '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcMgr.exe /Settings'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\LumiDvcSvc] 'ImagePath' = '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\LumiDvcSvc] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\InstallLumidigmDriver.exe' 0 "C:\\Program Files\\Lumidigm\\LumiDeviceServiceDeployment v4.10.33\\"
'%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\dpinst.exe' "/q"
'C:\Utilities\Lumidigm 4.10.33\Demo\LumiDemoSetup_4.10.33.exe' /S /v/qn
'C:\Utilities\Lumidigm 4.10.33\Drivers\LumiDvcSvcDeployment_4.10.33.exe' /S /v/qn
'%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe' -i
'%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe'

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding 34564715AD0980E9A48147C127CA1C17 M Global\MSI0000
'<SYSTEM32>\cmd.exe' /c ""C:\\Program Files\\Lumidigm\\LumiDeviceServiceDeployment v4.10.33\\Driver\Drivers_XP_x86\dpinst.exe" "/q""
'<SYSTEM32>\msiexec.exe' -Embedding B4044D45DF20A7E5DF78A3222E6E50D9 C
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 5127CFF815DCDC894E43960F1BC7B738 C
'<SYSTEM32>\msiexec.exe' -Embedding 85297680D557A4324D81C452BB293133

Modifies file system:

Creates the following files:

%TEMP%\~DFD8C6.tmp
%WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\Lumidigm_Device_Se_65779FE85AD84242AAFF45F3246D1BA4.exe
%WINDIR%\DPINST.LOG
%WINDIR%\Installer\MSI1B.tmp
%WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\NewShortcut2_18ABBA177FB14A1BA40143F8612BE572.exe
%WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\ARPPRODUCTICON.exe
%WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\Lumidigm_Device_Se_1FC36F81AA7A425993AF1385D6125063.exe
%WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\NewShortcut3_06FDE5D3910A4D2F828B64452A4DD917.exe
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\D41693DAFE5DEF0C36959FF1FCEF5C96
<SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\lumidriver.inf
%APPDATA%\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D
<SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\LumiDriver.sys
<SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\LUMIDRIVER.cat
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\207B9FD92391B9B2A60A89B4C965D5DF
%APPDATA%\Microsoft\CryptnetUrlCache\Content\D41693DAFE5DEF0C36959FF1FCEF5C96
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
%APPDATA%\Microsoft\CryptnetUrlCache\Content\207B9FD92391B9B2A60A89B4C965D5DF
%WINDIR%\Installer\2c898.msi
<SYSTEM32>\plugin\VenusDvc.dll
<SYSTEM32>\SPM\SPM_1.bin
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\M31X.hex
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\V31X.hex
<SYSTEM32>\plugin\MercuryDvc.dll
<SYSTEM32>\LumiInOpAPI.dll
<SYSTEM32>\plugin\SDvc.dll
<SYSTEM32>\plugin\PreProcV21_INT16.dll
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\InstallLumidigmDriver.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Service Deployment Overview.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Streaming Device Config.lnk
%WINDIR%\Installer\MSI19.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Service Migration Overview.lnk
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\doc\Lumidigm Device Service Deployment v4.10.pdf
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\doc\Lumidigm Device Service Migration v4.10.pdf
%ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Manager.lnk
%WINDIR%\Installer\$PatchCache$\Managed\412FD642A356CE646A105C5D3160B5FA\4.10.33\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
<LS_APPDATA>\Downloaded Installations\{CF885630-5CB1-4547-BFB3-3643DAB42D70}\0x0409.ini
<LS_APPDATA>\Downloaded Installations\{CF885630-5CB1-4547-BFB3-3643DAB42D70}\Lumidigm Demo v4.10.33.msi
%TEMP%\~29.tmp
%TEMP%\_is2A.tmp
%TEMP%\_is27.tmp
%TEMP%\~24.tmp
%TEMP%\_is28.tmp
%TEMP%\~26.tmp
%TEMP%\_is2B.tmp
%TEMP%\MSI31.tmp
%TEMP%\_is30.tmp
%TEMP%\f9c.rra
%TEMP%\MSI32.tmp
%TEMP%\_is2D.tmp
%TEMP%\_is2C.tmp
%TEMP%\_is2F.tmp
%TEMP%\_is2E.tmp
%TEMP%\_is25.tmp
%TEMP%\_is1E.tmp
%ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setu50a2.rra
%TEMP%\_is1F.tmp
%ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\ISSetup.dll
%WINDIR%\inf\oem3.PNF
%WINDIR%\inf\oem3.inf
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\Log.txt
%ProgramFiles%\DIFX\37C35FE1F6CAE763\dpinst.exe
%ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setup.ini
C:\Utilities\Lumidigm 4.10.33\Demo\setup.iss
%TEMP%\aut21.tmp
%TEMP%\_is23.tmp
%TEMP%\_is22.tmp
C:\Utilities\Lumidigm 4.10.33\Drivers\setup.log
%ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x045ad3.rra
C:\Utilities\Lumidigm 4.10.33\Demo\LumiDemoSetup_4.10.33.exe
%TEMP%\aut20.tmp
<SYSTEM32>\LumiCore.dll
%TEMP%\a30c.rra
%TEMP%\MSI13.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\_is10.tmp
%TEMP%\_isF.tmp
%TEMP%\MSI12.tmp
%TEMP%\_is11.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
%TEMP%\_isE.tmp
%TEMP%\_is4.tmp
%TEMP%\_is3.tmp
%TEMP%\~5.tmp
%TEMP%\_is6.tmp
C:\Utilities\Lumidigm 4.10.33\Drivers\LumiDvcSvcDeployment_4.10.33.exe
%TEMP%\aut1.tmp
C:\Utilities\Lumidigm 4.10.33\Drivers\setup.iss
%TEMP%\aut2.tmp
%TEMP%\_is8.tmp
%TEMP%\~A.tmp
%TEMP%\_isB.tmp
%TEMP%\_isD.tmp
%TEMP%\_isC.tmp
%TEMP%\_is9.tmp
%TEMP%\~7.tmp
<LS_APPDATA>\Downloaded Installations\{2D99CEEA-EEDD-4A87-9584-0145EF9F11C7}\0x0409.ini
<LS_APPDATA>\Downloaded Installations\{2D99CEEA-EEDD-4A87-9584-0145EF9F11C7}\LumiDeviceServiceDeployment v4.10.33.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEDevConfig.xml
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEngineCore.exe
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\lumidriver.cat
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\dpinst.exe
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\dat\DefaultSEDevConfig.xml
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEDeviceConfig.exe
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcMgr.exe
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\LumiDriver.inf
<SYSTEM32>\plugin\AlgoDvc.dll
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SPM\SPM_1.bin
<SYSTEM32>\LumiAPI.dll
<SYSTEM32>\plugin\IEngine_Plus.dll
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkusb.inf
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\LUMIDRIVER.sys
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkusbx86.cat
%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkldi.sys
C:\Config.Msi\2c897.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
%TEMP%\~DF8743.tmp
%WINDIR%\Installer\2c896.ipi
%WINDIR%\Installer\MSI17.tmp
%WINDIR%\Installer\MSI16.tmp
%WINDIR%\Installer\2c895.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\MSI15.tmp
%WINDIR%\Installer\MSI14.tmp

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Deletes the following files:

%TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\_ISMSIDEL.INI
%TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\Setup.INI
%TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\LumiDeviceServiceDeployment v4.10.33.msi
%TEMP%\aut20.tmp
%TEMP%\_is23.tmp
%TEMP%\_is22.tmp
%TEMP%\aut21.tmp
%TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\ISSetup.dll
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\_isres_0x0409.dll
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\String1033.txt
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\ISRT.dll
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\setup.exe
%TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\0x0409.ini
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\EULA.rtf
%TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\setup.inx
%TEMP%\_is2E.tmp
%TEMP%\_is2D.tmp
%TEMP%\_is2C.tmp
%TEMP%\_is2F.tmp
%TEMP%\MSI32.tmp
%TEMP%\MSI31.tmp
%TEMP%\_is30.tmp
%TEMP%\_is2B.tmp
%TEMP%\_is27.tmp
%TEMP%\~24.tmp
%TEMP%\_is25.tmp
%TEMP%\~26.tmp
%TEMP%\~29.tmp
%TEMP%\_is2A.tmp
%TEMP%\_is28.tmp
%TEMP%\~A.tmp
%TEMP%\_isB.tmp
%TEMP%\_is9.tmp
%TEMP%\_isC.tmp
%TEMP%\_isF.tmp
%TEMP%\_isE.tmp
%TEMP%\_isD.tmp
%TEMP%\~7.tmp
%TEMP%\_is3.tmp
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
%TEMP%\_is4.tmp
%TEMP%\_is8.tmp
%TEMP%\~5.tmp
%TEMP%\_is6.tmp
%WINDIR%\Installer\MSI1B.tmp
C:\Config.Msi\2c897.rbs
%WINDIR%\Installer\MSI17.tmp
%WINDIR%\Installer\2c895.msi
%TEMP%\_is1F.tmp
%TEMP%\_is1E.tmp
%WINDIR%\Installer\2c896.ipi
%WINDIR%\Installer\MSI19.tmp
%TEMP%\MSI12.tmp
%TEMP%\_is11.tmp
%TEMP%\_is10.tmp
%TEMP%\MSI13.tmp
%WINDIR%\Installer\MSI16.tmp
%WINDIR%\Installer\MSI15.tmp
%WINDIR%\Installer\MSI14.tmp

Moves the following files:

from %TEMP%\a30c.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\Setup.ilg
from %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x045ad3.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x0409.ini
from %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setu50a2.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setup.exe

Network activity:

Connects to:

'20#.#6.232.182':80
'wp#d':80

TCP:

HTTP GET requests:

http://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2010-11-01.crl via 20#.#6.232.182
http://crl.microsoft.com/pki/crl/products/tspca.crl via 20#.#6.232.182
http://11#.#11.111.1/wpad.dat via wp#d
http://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl via 20#.#6.232.182

UDP:

DNS ASK crl.microsoft.com
DNS ASK wp#d

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней