Skip to main content

Dropped.Trojan.Generic.17338822_a8c97fb33d


Dropped:Trojan.Generic.17338822 (B) (Emsisoft), Dropped:Trojan.Generic.17338822 (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a8c97fb33db997aaf9411704474278a1

SHA1: 84efdcddc2639c675f9d56479e1626ed4bf1082f

SHA256: 51d1e52be4d7b3dc540e2db8fa447513dfd3980abe272ffc82a1f1e4395b35ec

SSDeep: 24576:NipYVVESdLXqEG6WEMZsDjalgdYPWO6ACa46:wpYVVY6zTp6PWOCa

Size: 790439 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

taskkill.exe:352
taskkill.exe:1496
31439.exe:424
40383224.exe:1264
foresee.exe:452
tasklist.exe:1316
tasklist.exe:224
tasklist.exe:1056
tasklist.exe:1232
tasklist.exe:1800
tasklist.exe:2028
tasklist.exe:1852
tasklist.exe:1732
tasklist.exe:1784
tasklist.exe:1524
tasklist.exe:244
tasklist.exe:1620
tasklist.exe:2020
tasklist.exe:1244
tasklist.exe:544
tasklist.exe:1352
tasklist.exe:1884
tasklist.exe:1036
tasklist.exe:1392
%original file name%.exe:1108
find.exe:1608
find.exe:768
find.exe:1640
find.exe:1812
find.exe:160
find.exe:196
find.exe:1096
find.exe:1392
find.exe:524
find.exe:1240
find.exe:1748
find.exe:1952
find.exe:436
find.exe:1572
find.exe:2008
find.exe:1400
find.exe:528
find.exe:476
find.exe:1672

The Dropped injects its code into the following process(es):

jaya.exe:700

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 31439.exe:424 makes changes in the file system.


The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp (0 bytes)

The process jaya.exe:700 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA4DI94V.xml (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA30Z1CY.xml (806 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA4WOA5Z.xml (758 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[1].xml (691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1074 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[1].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAM7AB6D.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\analytics[1].js (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[1].xml (802 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sxx (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAK1APOU.xml (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@myelomaplanted[1].txt (189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[1].xml (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA4F83EX.xml (712 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASY7E62.xml (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAC6FYT4.xml (758 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS5UF4T.xml (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgg[1].png (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\page-1[1].htm (4568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ova-jw[1].swf (23513 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[2].txt (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player1[1].swf (14917 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.everclips[1].txt (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page-1[1].htm (4283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player1[2].swf (13513 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAIV8P23.xml (773 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12240 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jwplayer1[1].js (75233 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@myelomaplanted[2].txt (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAIFKPG1.gif (49 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page-1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@myelomaplanted[1].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAM7AB6D.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)

The process 40383224.exe:1264 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\SimpleFC.dll (5289 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsz4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\SimpleFC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp (0 bytes)

The process foresee.exe:452 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst7.tmp\ExecCmd.dll (4 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst7.tmp (0 bytes)

The process %original file name%.exe:1108 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ShellLink.dll (4 bytes)
%Program Files%\thessalonians\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\yosef.lnk (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\31439.exe (1082 bytes)
%WinDir%\settings.dll (10215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\40383224.exe (3124 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%System%\drivers\etc\hosts (123 bytes)
%Program Files%\thessalonians\settings.dll (10215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
%Program Files%\thessalonians\jaya.exe (4895 bytes)
%WinDir%\jaya.exe (4895 bytes)
%Program Files%\initialize\foresee.exe (1044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\AccessControl.dll (13 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ShellLink.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\AccessControl.dll (0 bytes)

Registry activity

The process taskkill.exe:352 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 8D DD FD BB 77 E3 B5 59 09 A7 25 09 9E 9C 70"

The process taskkill.exe:1496 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 56 9E 0C 3B B2 C4 BE E5 73 F4 EB D5 84 C7 6D"

The process 31439.exe:424 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D F5 F9 15 97 EF F0 A1 A6 AB A5 FB 34 49 C4 80"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process jaya.exe:700 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016100620161007]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016100620161007]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016100620161007]
"CachePrefix" = ":2016100620161007:"

"CacheRepair" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016100620161007]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016100620161007\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 46 A9 05 16 1A 2E 19 EF 33 DA EF 63 C7 93 95"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 40383224.exe:1264 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 79 BF 52 78 76 03 8F 12 84 34 97 25 4D 7F 79"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process foresee.exe:452 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 07 C9 6B 88 B1 1C 54 B9 ED DA A2 B1 AD 96 35"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"expediter" = "%Program Files%\thessalonians\jaya.exe"

"foresee" = "%Program Files%\initialize\foresee.exe"

The process tasklist.exe:1316 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 5D ED E8 1F D7 1A 44 83 0E F4 1B F1 BE C9 27"

The process tasklist.exe:224 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 96 94 E0 64 5C 67 83 41 6C 43 A8 67 A7 7D 20"

The process tasklist.exe:1056 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 B6 6A C5 C3 3F 27 67 82 8D 30 24 32 41 D0 E8"

The process tasklist.exe:1232 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 4F E1 21 91 04 99 B7 AF 62 94 E0 BB E0 BA DF"

The process tasklist.exe:1800 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 CF 92 87 77 69 5C 7C F7 A0 D1 05 36 20 B5 09"

The process tasklist.exe:2028 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 33 71 1E F3 66 BE 10 18 18 BD 2F F3 68 12 72"

The process tasklist.exe:1852 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 73 56 6C F9 62 96 3F 70 7B 95 13 BB AE 2A D2"

The process tasklist.exe:1732 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 5F 24 51 F1 2A 3C 03 97 10 52 F6 F7 56 D2 81"

The process tasklist.exe:1784 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 F0 1F 48 74 D4 CF 45 B8 83 FF D2 DF 83 DF CE"

The process tasklist.exe:1524 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 C4 F6 F3 E4 44 C5 96 33 77 21 7C 1A 9F 6D 9E"

The process tasklist.exe:244 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 16 FE D5 65 28 7F 25 7B D7 97 57 AE 48 AF 39"

The process tasklist.exe:1620 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 80 3A BC FE A5 CB 00 FE 15 94 33 B1 9C 58 31"

The process tasklist.exe:2020 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 10 99 C0 65 FB C7 44 B0 00 B4 FD FF 6D 72 E8"

The process tasklist.exe:1244 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 77 FB 0A 6E 82 56 7F EF D2 E1 00 34 D1 22 3E"

The process tasklist.exe:544 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 47 56 3B FE 25 95 D0 1D B8 DA D5 13 A0 EC A6"

The process tasklist.exe:1352 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 5D 16 81 C9 B7 46 90 F9 43 F7 48 7C 69 99 B1"

The process tasklist.exe:1884 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC EF DD EA AC 6D 40 7B E8 AD 3F 53 1B 4B 68 2D"

The process tasklist.exe:1036 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 40 50 DE 97 4B 9A 9A 1D BB A5 C4 26 BE 71 AA"

The process tasklist.exe:1392 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B ED 71 AD 7B FD 28 8F D8 2F 38 BE 7E C6 46 D2"

The process %original file name%.exe:1108 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E C7 5F 84 50 BB 9A 08 9F AB F1 55 81 A4 CA 3E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lunes" = "%Program Files%\thessalonians\jaya.exe"

"hackworth" = "%Program Files%\thessalonians\jaya.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ambience" = "%Program Files%\thessalonians\jaya.exe"

"morio" = "%Program Files%\thessalonians\jaya.exe"

The process find.exe:1608 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB B6 A6 BF A5 DB B7 BF BB 80 A2 93 05 BD BF F7"

The process find.exe:768 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 4E F0 7E EA 09 07 F1 D2 DF 13 36 AF CF 85 ED"

The process find.exe:1640 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 08 27 03 D1 89 3E BC 4C 9F 28 68 67 1D 38 4E"

The process find.exe:1812 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 8C 04 96 FE 7E 60 22 B9 7D AC D5 B9 35 31 CD"

The process find.exe:160 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 F9 F0 F9 FE 0A 0A BB 62 6F 73 54 4F 59 64 80"

The process find.exe:196 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 36 34 0F B1 8E 64 47 F3 2A 36 5C AD F1 0C 93"

The process find.exe:1096 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 89 94 0F 00 1F 78 02 49 C6 6A 9F F7 B7 CA A9"

The process find.exe:1392 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F AA 1C 83 53 9B 7F 35 0E 09 A6 A2 16 96 9A 94"

The process find.exe:524 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 44 6A E0 6A CF 8B CB A5 02 46 D1 47 3C E3 54"

The process find.exe:1240 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 C1 CC BF 20 43 A1 19 CC D7 A6 70 09 EA A5 13"

The process find.exe:1748 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 B5 FE 67 12 C0 5D 7D 5A 33 71 8A 1A 3F DE 7B"

The process find.exe:1952 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 10 3B 2E 8F 3B CD 46 AA C9 E4 19 51 3D 7A B2"

The process find.exe:436 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 E2 E5 EC CE 9C 81 FB 03 5F 45 0B 51 39 6D 5E"

The process find.exe:1572 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 31 19 9D 25 C7 B5 5D F8 46 88 8B EF BE E6 4F"

The process find.exe:2008 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F EC AB AD BD E1 23 D8 F6 83 0F 88 56 7D 7F 1B"

The process find.exe:1400 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 11 6F 5E 27 DD E0 64 CA CA 29 96 96 C6 C9 1A"

The process find.exe:528 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 58 CC B4 A2 66 5F A5 81 4D 66 CD 7C 55 71 92"

The process find.exe:476 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 3D 61 20 AA 4B C6 6B 0B 2C 5C 41 8D 72 FA 7E"

The process find.exe:1672 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 78 D1 F4 BB 86 91 51 87 1E 4B EB 06 21 89 BB"

Dropped PE files

MD5 File path
6351426f5922b23dd580621eee7b681cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\31439.exe
1a111c9fb42d9946b88814547196955fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\40383224.exe
b9380b0bea8854fd9f93cc1fda0dfeacc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst7.tmp\ExecCmd.dll
ce0913984043cfec32f4470f99219c6dc:\Program Files\initialize\foresee.exe
c8ff52bfddc6898c202c08c4a61a3d22c:\Program Files\thessalonians\Microsoft.Win32.TaskScheduler.dll
07bf95b253c4a7001b6ccc465f95d3e0c:\Program Files\thessalonians\jaya.exe
4cd16822b8ed866715404288089eeb36c:\Program Files\thessalonians\settings.dll
c8ff52bfddc6898c202c08c4a61a3d22c:\WINDOWS\Microsoft.Win32.TaskScheduler.dll
07bf95b253c4a7001b6ccc465f95d3e0c:\WINDOWS\hort.exe
4cd16822b8ed866715404288089eeb36c:\WINDOWS\settings.dll

HOSTS file anomalies

The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:

162.222.194.13cocomo.tremorhub.com
162.222.194.13www.virustotal.com
162.222.194.13virustotal.com


Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    taskkill.exe:352
    taskkill.exe:1496
    31439.exe:424
    40383224.exe:1264
    foresee.exe:452
    tasklist.exe:1316
    tasklist.exe:224
    tasklist.exe:1056
    tasklist.exe:1232
    tasklist.exe:1800
    tasklist.exe:2028
    tasklist.exe:1852
    tasklist.exe:1732
    tasklist.exe:1784
    tasklist.exe:1524
    tasklist.exe:244
    tasklist.exe:1620
    tasklist.exe:2020
    tasklist.exe:1244
    tasklist.exe:544
    tasklist.exe:1352
    tasklist.exe:1884
    tasklist.exe:1036
    tasklist.exe:1392
    %original file name%.exe:1108
    find.exe:1608
    find.exe:768
    find.exe:1640
    find.exe:1812
    find.exe:160
    find.exe:196
    find.exe:1096
    find.exe:1392
    find.exe:524
    find.exe:1240
    find.exe:1748
    find.exe:1952
    find.exe:436
    find.exe:1572
    find.exe:2008
    find.exe:1400
    find.exe:528
    find.exe:476
    find.exe:1672

  2. Delete the original Dropped file.
  3. Delete or disinfect the following files created/modified by the Dropped:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA4DI94V.xml (809 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA30Z1CY.xml (806 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA4WOA5Z.xml (758 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[1].xml (691 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1[1].gif (49 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1498 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\crossdomain[1].xml (144 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].png (723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1074 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[1].xml (693 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAM7AB6D.gif (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wau-widget[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (144 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\analytics[1].js (333 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index5[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[1].xml (802 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sxx (202 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAK1APOU.xml (810 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@myelomaplanted[1].txt (189 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[1].xml (615 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\itd[1].htm (1118 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\count[1].htm (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA4F83EX.xml (712 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (179 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASY7E62.xml (724 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\counter[2].js (1353 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAC6FYT4.xml (758 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS5UF4T.xml (764 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgg[1].png (198 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\page-1[1].htm (4568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ova-jw[1].swf (23513 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@everclips[2].txt (312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player1[1].swf (14917 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@www.everclips[1].txt (297 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page-1[1].htm (4283 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player1[2].swf (13513 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1082 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\counter[1].js (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAIV8P23.xml (773 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (12240 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (80 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jwplayer1[1].js (75233 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@myelomaplanted[2].txt (327 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\func[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAIFKPG1.gif (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp\SimpleFC.dll (5289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst7.tmp\ExecCmd.dll (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\ShellLink.dll (4 bytes)
    %Program Files%\thessalonians\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\yosef.lnk (491 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\31439.exe (1082 bytes)
    %WinDir%\settings.dll (10215 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\40383224.exe (3124 bytes)
    %WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
    %System%\drivers\etc\hosts (123 bytes)
    %Program Files%\thessalonians\settings.dll (10215 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\System.dll (11 bytes)
    %Program Files%\thessalonians\jaya.exe (4895 bytes)
    %WinDir%\jaya.exe (4895 bytes)
    %Program Files%\initialize\foresee.exe (1044 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\AccessControl.dll (13 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "expediter" = "%Program Files%\thessalonians\jaya.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "foresee" = "%Program Files%\initialize\foresee.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Lunes" = "%Program Files%\thessalonians\jaya.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hackworth" = "%Program Files%\thessalonians\jaya.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "ambience" = "%Program Files%\thessalonians\jaya.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "morio" = "%Program Files%\thessalonians\jaya.exe"

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623628240644.46394856b32eb77dfd6fb67f21d6543272da5
.rdata28672476451203.4982dc77f8a1e6985a4361c55642680ddb4f
.data3686415471210243.32787922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata1925128601600d41d8cd98f00b204e9800998ecf8427e
.rsrc278528253625603.13622b9f20defc9dd650d8dcc7fc5d4708ad4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 111
7bcde813c50a0b0e20e5f9f233bc3040
5bec3c6a9950cf902e71b84dc814c3f9
29de0a3a7170f7dd71267eee2449b462
ca004345bdd1cb292744ed711de04d19
2a9af6bcab5eb49d9a62a6ea72cdd286
e4e8ea421895b321bea9afa16d8a6fb5
851b5de8d1e586ba0301b1027800dea8
54c304cd37a8ae6ce5c21d5a5240d80c
f4ae937348a591e02f7ccb79f47cdc1f
c27730e88a7e5003ff846e8f0e578968
023529d5b4f5db6fc3e123bf47ac15d6
8e38be8c510a94c0a96ee39bc32ed333
14055969428fc76bc66b28491ff90d63
2b8b2136bdf153f722ecd721fabcf1aa
9dec231998f0f3d8301aa5c1a6e0119f
0affe53e87c71d2b7f9066427a5d71e5
3f92282b316430f68d847ff93565f264
1f4ab1b0f88d2b1805bcfbdaa2c461f1
3fadc54dc0f9a4e6af4b370749973ec3
2d43a582840285217ab6adaf45ff8c22
4ad98fe1fd6a020f491e31eb4aa16205
562254cc7ac0f92876c4964400fb6cd7
a261aa83665bed04243da16ecade0df0
bea91233ff3a67b260b02a18d7cb54c2
b1a5b5b97ab40559c62f27923a7322c1

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Dropped connects to the servers at the folowing location(s):

Strings from Dumps

foresee.exe_452:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp\ExecCmd.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp\ExecCmd.dll

"%Program Files%\thessalonians\jaya.exe"

"%Program Files%\thessalonians\jaya.exe"

cCmd.dll

cCmd.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

e%uy%u

e%uy%u

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp

nst7.tmp

nst7.tmp

rogram Files\thessalonians\jaya.exe"

rogram Files\thessalonians\jaya.exe"

q jaya.exe" | %SystemRoot%\System32\find /I "jaya.exe"

q jaya.exe" | %SystemRoot%\System32\find /I "jaya.exe"

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst7.tmp

"%Program Files%\initialize\foresee.exe"

"%Program Files%\initialize\foresee.exe"

%Program Files%\initialize

%Program Files%\initialize

foresee.exe

foresee.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg6.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

%Program Files%\initialize\foresee.exe

%Program Files%\initialize\foresee.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Nullsoft Install System v2.46

Nullsoft Install System v2.46

ialize\foresee.exe"

ialize\foresee.exe"

salonians\jaya.exe"

salonians\jaya.exe"