Zum.Rastarby.3_439e8970a4

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Zum's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Zum creates the following process(es):

%original file name%.exe:2928
sever.exe:2980
porn.exe:1796

The Zum injects its code into the following process(es):

trojaner.exe:2528

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2928 makes changes in the file system.

The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_424572 (0 bytes)

The process sever.exe:2980 makes changes in the file system.

The Zum creates and/or writes to the following file(s):

C:\Windows\trojaner\trojaner.exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DF992C79608D27EEF3.TMP (0 bytes)

The process porn.exe:1796 makes changes in the file system.

The Zum creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

The Zum deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\__tmp_rar_sfx_access_check_424915 (0 bytes)

Registry activity

The process %original file name%.exe:2928 makes changes in the system registry.

The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\WinRAR SFX]
"C%%Program Files%%temp&" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process trojaner.exe:2528 makes changes in the system registry.

The Zum creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Zum adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"trojaner" = "C:\Windows\trojaner\trojaner.exe"

The process porn.exe:1796 makes changes in the system registry.

The Zum creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Zum deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5	File path
5bebf9911e659ff0e5fb49086615de79	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe
5bebf9911e659ff0e5fb49086615de79	c:\Windows\trojaner\trojaner.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Zum's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:2928
   sever.exe:2980
   porn.exe:1796

2. Delete the original Zum file.
   
3. Delete or disinfect the following files created/modified by the Zum:

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.exe (3409 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\porn.bat (27 bytes)
   C:\Windows\trojaner\trojaner.exe (96 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX1\sever.Exe (96 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "trojaner" = "C:\Windows\trojaner\trojaner.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	188392	188416	4.65119	2ae181684b1677561119f5765623448e
.rdata	192512	39376	39424	3.57169	0e0f6a60d8fa917a060c8ef7becc0888
.data	233472	129208	3072	2.28424	4e4aa728d9cced1622c2be27733e3fc5
.gfids	364544	240	512	1.47202	c923099e27bf0e45a5c402d935d0620b
.rsrc	368640	19363	19456	3.22423	8a59705cbff75c61fb5c54602ab7afee
.reloc	389120	8076	8192	4.59547	d13d3f8a8adfe6861c49a01d81cf73ed

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 7
7998a7f7e227c2e50ff5a7803cc68900
a31cf8a5c0878eb20b080e211edfa03b
fc5ec84bb3e7e2cb9fa8067ee38cfc2d
cd6886a90b9f806a9b54e9447d96c8cc
2bfa346a8352e82dcea968b994e2e4f9
6cf40788e674f459c9e414b8794ee3be
5c37d8d2322321dc9f2621b4e3f31b98

Network Activity

URLs

URL	IP
xfunx.ddns.net	77.20.141.107
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Zum connects to the servers at the folowing location(s):

Strings from Dumps