Trojan.DnsChange.8222

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{33e730b4-a400-4924-a8e7-4752954403e7}' = '"<LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\SelfExtract.exe" /burn.runo...

Malicious functions:

To complicate detection of its presence in the operating system,

modifies the following system settings:

DNS server to '13.59.106.194'

Creates and executes the following:

'%TEMP%\{F2F83B9A-0E21-48DD-8C8C-47D70731A037}\.cr\wb_ni_23_139_c.exe' -burn.clean.room="%APPDATA%\wb_ni_23_139_c.exe" -burn.filehandle.attached=348 -burn.filehandle.self=344 -norestart -repair -s
'<LS_APPDATA>\flashpluginv_2.1.exe'
'%APPDATA%\wb_ni_23_139_c.exe' -norestart -repair -s

Executes the following:

'<SYSTEM32>\netsh.exe' interface ipv4 add dnsserver "Ethernet" address=13.59.106.194
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding A3C1C4515124F312DEB2E118DFBBDD86
'<SYSTEM32>\cmd.exe' /C netsh interface ip set dns name="Local Area Connection" static 13.59.106.194
'<SYSTEM32>\cmd.exe' /C netsh interface ipv4 add dnsserver "Ethernet" address=13.59.106.194
'<SYSTEM32>\netsh.exe' interface ip set dns name="Local Area Connection" static 13.59.106.194

Modifies file system:

Creates the following files:

<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_pole_null_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_pole_null_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_pole_null_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_pole_null_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_blue_active_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_blue_active_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_blue_active_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_blue_active_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\close_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\gray_button_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\transparent.gif
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\info_icon_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_short_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_short_125.png
%TEMP%\Adobe_ADMLogs\Adobe_GDE.log
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\1f363.msi
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_mini_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_mini_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_mini_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_short_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_short_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\yellow_button_mini_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_darkgray_base_100.png
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\BootstrapperApplicationData.xml
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\license.rtf
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\logo.png
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.be\SelfExtract.exe
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\WeatherBuddy
<LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\state.rsm
<LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\SelfExtract.exe
%TEMP%\{F2F83B9A-0E21-48DD-8C8C-47D70731A037}\.cr\wb_ni_23_139_c.exe
<LS_APPDATA>\flashpluginv_2.1.exe
%APPDATA%\wb_ni_23_139_c.exe
%TEMP%\Adobe_ADMLogs\Adobe_ADM.log
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\thm.wxl
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\thm.xml
%TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\.ba\wixstdba.dll
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_check_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_x_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_x_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_check_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\progressbar_darkgray_base_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_check_150.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_check_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_caution_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_caution_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\warning_icon_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_caution_125.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_x_100.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_x_200.png
<LS_APPDATA>\Adobe\6E6CD095-E7F8-4F7A-A908-69537E0FA205\status_icon_caution_150.png

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp

Moves the following files:

from <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy to <LS_APPDATA>\Package Cache\{33BC2D7A-2CFE-40C7-9B99-117886D9E0E4}v1.0.23\WeatherBuddy_ni_v23.msi
from %TEMP%\{712B2AF5-3177-4FA6-8723-F39917C0942A}\WeatherBuddy to <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy

Miscellaneous:

Searches for the following windows: