Gen.Variant.Graftor.153738_911bb18446

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1792

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error[1].htm (801 bytes)
C:\SkinH_EL.dll (178 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\logo[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017031720170318\index.dat (16 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101020161017 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016102820161029 (0 bytes)

Registry activity

The process %original file name%.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017031720170318]
"CachePrefix" = ":2017031720170318:"
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017031720170318"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017031720170318]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017031720170318]
"CacheRepair" = "0"
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Factor" = "20"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

[HKLM\SOFTWARE\Microsoft\Tracing\911bb184460388ebad4c018604b0e486_RASAPI32]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101020161017]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016102820161029]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5	File path
147127382e001f495d1842ee7a9e7912	c:\SkinH_EL.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error[1].htm (801 bytes)
   C:\SkinH_EL.dll (178 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\logo[1].gif (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017031720170318\index.dat (16 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????(????) v1.1
Product Version: 1.1.10.6
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.10.6
File Description: ???????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ????(????) v1.1Product Version: 1.1.10.6Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.1.10.6File Description: ???????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	531499	532480	4.53705	f60170d00c60fb69792a366f576f91e7
.rdata	536576	950624	954368	5.39818	e19103ae201afbd3748829c49313511e
.data	1490944	247498	65536	3.54406	f1966f08d09d59e61d6375a7e6db6976
.rsrc	1740800	22804	24576	3.73558	a249c7f547ae594640bbce1523b84375

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://im2.n.shifen.com/ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4
hxxp://im2.n.shifen.com/search/error.html
hxxp://im2.n.shifen.com/search/img/logo.gif
hxxp://im.baidu.com/search/img/logo.gif	123.125.114.169
hxxp://hi.baidu.com/ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4	123.125.114.169
hxxp://im.baidu.com/search/error.html	123.125.114.169

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: hi.baidu.com

Cache-Control: no-cache

HTTP/1.1 302 Found

Date: Thu, 16 Mar 2017 23:30:25 GMT

Server: Apache

Location: hXXp://im.baidu.com/search/error.html

Content-Length: 221

Connection: Keep-Alive

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://im.baidu.com/search/error.html">here</a>.</p>.</body></html>.HTTP/1.1 302 Found..Date: Thu, 16 Mar 2017 23:30:25 GMT..Server: Apache..Location: hXXp://im.baidu.com/search/error.html..Content-Length: 221..Connection: Keep-Alive..Content-Type: text/html; charset=iso-8859-1..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://im.baidu.com/search/error.html">here</a>.</p>.</body></html>...

GET /ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: hi.baidu.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 16 Mar 2017 23:30:22 GMT

Server: Apache

Location: hXXp://im.baidu.com/search/error.html

Content-Length: 221

Connection: Keep-Alive

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://im.baidu.com/search/error.html">here</a>.</p>.</body></html>.HTTP/1.1 302 Found..Date: Thu, 16 Mar 2017 23:30:22 GMT..Server: Apache..Location: hXXp://im.baidu.com/search/error.html..Content-Length: 221..Connection: Keep-Alive..Content-Type: text/html; charset=iso-8859-1..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://im.baidu.com/search/error.html">here</a>.</p>.</body></html>...

GET /search/error.html HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: im.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Mar 2017 23:30:26 GMT

Server: Apache

Last-Modified: Mon, 07 Dec 2015 10:58:52 GMT

ETag: "a92"

Accept-Ranges: bytes

Content-Length: 2706

Connection: Keep-Alive

Content-Type: text/html

<html>.<head>..<title>....--..............</title>..<META http-equiv=content-type content="text/html; charset=gb2312">.<META content="MSHTML 6.00.2462.0" name=GENERATOR></HEAD>.</head>.<style type="text/css">..p1 {..FONT-SIZE: 14px; LINE-HEIGHT: 24px; FONT-FAMILY: "....".}...f12 {..FONT-SIZE: 12px; LINE-HEIGHT: 20px.}..p2 {..FONT-SIZE: 14px; LINE-HEIGHT: 24px; color: #333333.}.</style>.<body text=#000000 vLink=#0033cc aLink=#800080 link=#0033cc bgColor=#ffffff .topMargin=0>.<center>.<table width=650 border=0 align="center">. <tr height=60>. <td width=139 valign="top" height="66"><a href="hXXps://VVV.baidu.com"><img src="img/logo.gif" border="0"></a></td>. <td valign="bottom" width="100%">. <table width="100%" border="0" cellpadding="0" cellspacing="0">. <tr bgcolor="#e5ecf9">. <td height="24"> <b class="p1">..............</b></td>. <td height="24" class="p2">. <div align="right"><a href="hXXps://VVV.baidu.com">........</a>  </div></td>. </tr>. <tr>. <td height="20" class="p2" colspan="2"></td>. </tr>. </table></td>. </tr>.</table>.<br>.<table width=650 border=0 align="center" cellpadding=8 cellspacing=0>. <tr> . <td align=center><div align="left"

<<< skipped >>>

GET /search/error.html HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: im.baidu.com

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Mar 2017 23:30:25 GMT

Server: Apache

Last-Modified: Mon, 07 Dec 2015 10:58:51 GMT

ETag: "a92"

Accept-Ranges: bytes

Content-Length: 2706

Connection: Keep-Alive

Content-Type: text/html

<html>.<head>..<title>....--..............</title>..<META http-equiv=content-type content="text/html; charset=gb2312">.<META content="MSHTML 6.00.2462.0" name=GENERATOR></HEAD>.</head>.<style type="text/css">..p1 {..FONT-SIZE: 14px; LINE-HEIGHT: 24px; FONT-FAMILY: "....".}...f12 {..FONT-SIZE: 12px; LINE-HEIGHT: 20px.}..p2 {..FONT-SIZE: 14px; LINE-HEIGHT: 24px; color: #333333.}.</style>.<body text=#000000 vLink=#0033cc aLink=#800080 link=#0033cc bgColor=#ffffff .topMargin=0>.<center>.<table width=650 border=0 align="center">. <tr height=60>. <td width=139 valign="top" height="66"><a href="hXXps://VVV.baidu.com"><img src="img/logo.gif" border="0"></a></td>. <td valign="bottom" width="100%">. <table width="100%" border="0" cellpadding="0" cellspacing="0">. <tr bgcolor="#e5ecf9">. <td height="24"> <b class="p1">..............</b></td>. <td height="24" class="p2">. <div align="right"><a href="hXXps://VVV.baidu.com">........</a>  </div></td>. </tr>. <tr>. <td height="20" class="p2" colspan="2"></td>. </tr>. </table></td>. </tr>.</table>.<br>.<table width=650 border=0 align="center" cellpadding=8 cellspacing=0>. <tr> . <td align=center><div align="left"

<<< skipped >>>

GET /search/img/logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://im.baidu.com/search/error.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: im.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Mar 2017 23:30:26 GMT

Server: Apache

Last-Modified: Mon, 08 Sep 2008 08:16:39 GMT

ETag: "671"

Accept-Ranges: bytes

Content-Length: 1649

Connection: Keep-Alive

Content-Type: image/gif

GIF89a........$.....ol....QN........*..................rl.SK...........!.?6..A>...b[..`].....~.}....#........!.......,............'.di.h..l..p,...Q....D...Pe.t.....@@.....1..O..p....0.q-.E...,n.[U5r4.w(..~_2p..y.v..|.{..........m.v.i..>..Q~.........3.tVj.......-.....".r.".....'.]...y.....$..W_..$dj.....e........%.....O.....Y....e.,.....x!Ag...L.^(.x%\.I...........6.....B...L.!c.3.~...........h..7.$.q&b@......y.M..H1DPq ...P.N ..A..H `.JR.0..x~ .....h..]kU....<....m........C..KSa.;.....DH`hg.....J.|.l.......Y......5......2~#.GDWp..t.\.....7...[n..4D{(.q..z$,>B.Cy........6...*...t.w..5p.[A.....H..y......%"..}R.N.C.`..........e...Z...m.......W...V0.xr...........(..((`.J'..S.duP...<........8....8.(.ur.....a`...z`d{.y....$i...Bh...hp...BH.U(D..P.9 ..!q.P.X.8..V...\.$.[..:...A...l...Ahz%@Z:.].K.G$.B\....eAV0.z.L...M..i...e..{I.'..~ .q%@....%1.L.H.C..&D..~........\...`.......Z..|Mr.g......z.a.....v...=0..'.@..!.j@H.=....V.VZ..U.e..F@..".....9._,(.@..L....].....d...R .....o..b ...N ..{].[..L....w;...e....l...$Q\Fk.f....68...U...(.KB....t.N...... ..f...P.l...G...\.<.t.P..@...i..p.m2.d.i.......nN...#|#.G.....`.........ra..VvW~$..K.d.'v...{M*...T.,...|.h.G.<&...k.\.9^..z. .........>....T....~..l.....B.d.~}.7Uy>y.......=F.A...?....p.L..4.}..n...*.~............(@....., `.;A..T.......Z.X.......T..x..n$.....nT.4>...| ......4.<...y....D0C#...."<.....@..lB..-.."d..f...X..Az .z3....<.....6..8,....'. ... ..fd...G........... ......P............Dp.....%.^.......M..M.:c..0....L.......%.<.P

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1792:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

Bv.SCv=kAv

Bv.SCv=kAv

SkinH_EL.dll

SkinH_EL.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

UnregisterHotKey

UnregisterHotKey

RegisterHotKey

RegisterHotKey

EnumWindows

EnumWindows

SetWindowsHookExA

SetWindowsHookExA

WebBrowser

WebBrowser

hXXp://VVV.huoyan.tv/api.php#!u=

hXXp://VVV.huoyan.tv/api.php#!u=

hXXp://yunbofang.400gb.com/

hXXp://yunbofang.400gb.com/

hXXp://hi.baidu.com/ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4

hXXp://hi.baidu.com/ehzbwvfkfbbcfid/item/48866a1867ae7b29d0d66dc4

fJ.WM_

fJ.WM_

CX%xm

CX%xm

Õ6m*

Õ6m*

n.BjCw

n.BjCw

%s;7*

%s;7*

0%x@w

0%x@w

%C^L:

%C^L:

%s T5

%s T5

]E4%F(

]E4%F(

.Funr

.Funr

k%UPp

k%UPp

fg.VG

fg.VG

%C',@

%C',@

>Ùd

>Ùd

0'.Ll

0'.Ll

[I(3/#N0.bd

[I(3/#N0.bd

j"%u=w

j"%u=w

q%Xn`

q%Xn`

@|H.NI

@|H.NI

.wdd!

.wdd!

S|%u4

S|%u4

*.Ea]S

*.Ea]S

Q.CGo

Q.CGo

fTpe

fTpe

.LLbX

.LLbX

-.Mdl

-.Mdl

\-A}=3K

\-A}=3K

Y:.akpS

Y:.akpS

$.Zcqn

$.Zcqn

.WE= T!N

.WE= T!N

#?%s(C(

#?%s(C(

u.Jck~

u.Jck~

zx/%FN[

zx/%FN[

%s=\RI

%s=\RI

}j%c%Y)

}j%c%Y)

Rx.GR

Rx.GR

4o#.dM

4o#.dM

IeS`%C

IeS`%C

[n 4\.UY

[n 4\.UY

,4.qO,

,4.qO,

gQ'.Io

gQ'.Io

%cLur?

%cLur?

s%DHB

s%DHB

]I%%X

]I%%X

5r.US

5r.US

:mD].tB

:mD].tB

f%fUZ

f%fUZ

.fOuV12

.fOuV12

*_.dC

*_.dC

&-N}

&-N}

({?.cQm

({?.cQm

.Cqx~c

.Cqx~c

.`.Qw

.`.Qw

**.dU

**.dU

!n]%x

!n]%x

%X,Cr

%X,Cr

&.PFy{xh

&.PFy{xh

.um ZZE7L

.um ZZE7L

/^p%u$

/^p%u$

I.NoQY

I.NoQY

zu.ew

zu.ew

D/.nT

D/.nT

b\SkinH_EL.dll

b\SkinH_EL.dll

C$%cmb

C$%cmb

.ppM|

.ppM|

aZ.mO

aZ.mO