Gen.Variant.Razy.134860_03da32d551 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ntvdm.exe:2044

The Trojan injects its code into the following process(es):

03da32d55158d23cfd6576d9404c80f2.usr:684
%original file name%.exe:1804

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process ntvdm.exe:2044 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (269 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (0 bytes)

The process %original file name%.exe:1804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
C:\03da32d55158d23cfd6576d9404c80f2.usr (86442 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
C:\Windows\USR_Shohdi_Photo_USR.exe (6889123 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.usr (0 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.usr (0 bytes)

Registry activity

Dropped PE files

MD5	File path
9d54b22e360285515425b6dc6cc06e5c	c:\03da32d55158d23cfd6576d9404c80f2.usr

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 864 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	jL.chura.pl
127.0.0.1	validation.sls.microsoft.com

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
ZwCreateUserProcess
ZwCreateProcessEx
NtCreateProcess
ZwCreateFile

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
ntvdm.exe:2044
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AE9.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scs7AEA.tmp (269 bytes)
C:\Windows\System32\USR_Shohdi_Photo_USR.rsu (21682 bytes)
C:\03da32d55158d23cfd6576d9404c80f2.usr (86442 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Setup.exe (408872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe (444160 bytes)
C:\Windows\USR_Shohdi_Photo_USR.exe (6889123 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
	4096	16384	6656	5.29846	4cee79ac2671e36829d0bb610df5b052
.rsrc	20480	102400	102400	2.95609	e63aa06fa0bd4f07f170c40a27eb7fc4
petite	122880	379	512	2.83683	d9152af36e3787ad41768ba5d11906da

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
teredo.ipv6.microsoft.com	157.56.106.189
sys.zief.pl	148.81.111.121
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1804:

`.rsrc

D$(PSSh

ccRegVfy.exe

ccApp.exe

IEXPLORE.EXE

windows

\*.exe

.text

.data

.rsrc

msvcrt.dll

KERNEL32.dll

nddeapir.pdb

_acmdln

m.Zw%

ADVAPI32.DLL

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Qoysys.zief.pl

core.ircgalaxy.pl

NICK avabcadz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x %s

JOIN

127.0.0.1 jL.chura.pl

#

KERNEL32.DLL

windowsupdate

drweb

user32.dll

kernel32.dll

MSVCIRT.dll

MSVCRT.dll

5.1.2600.0 (xpclient.010817-1148)

NDDEAPIR.EXE

Windows

Operating System

5.1.2600.0

%original file name%.exe_1804_rwx_00401000_00002000:

D$(PSSh

%original file name%.exe_1804_rwx_00419000_00005000:

ADVAPI32.DLL

\USERINIT.EXE

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Qoysys.zief.pl

core.ircgalaxy.pl

NICK avabcadz

SFC.DLL

SFC_OS.DLL

USER32.DLL

SHLWAPI.DLL

WSOCK32.DLL

WININET.DLL

%.6x . . :%c%.8x%x %s

JOIN

127.0.0.1 jL.chura.pl

#

KERNEL32.DLL

windowsupdate

drweb

03da32d55158d23cfd6576d9404c80f2.usr_684:

.text

.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

.tTPV

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

RCv=kAv.SCv

fpmmcsat.dll

SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\4.0

{0A7443C7-6E9A-11D2-AAA2-00A0C90F57B0}

msi.dll

kernel32.dll

user32.dll

portuguese-brazilian

RegCloseKey

RegOpenKeyExA

GetCPInfo

c:\03da32d55158d23cfd6576d9404c80f2.usr

.at:L0

4.0.2.7523

FPMMC.DLL

, Windows

are registered trademarks of Microsoft Corporation, and WebBot is a trademark of Microsoft Corporation, in the United States and/or other countries.

03da32d55158d23cfd6576d9404c80f2.usr_684_rwx_00411000_00005000: