Trojan.Generic.20462596_fe346dcb4b – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2956

The Trojan injects its code into the following process(es):

data.dat:2528

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\data.dat (50 bytes)

The process data.dat:2528 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\link[1].htm (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\ad[1].jpg (6073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (7971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (1425 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (0 bytes)

Registry activity

The process data.dat:2528 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5	File path
00bfc92c0f4d0a79fd8cd18efdbdcd1c	c:\data.dat

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2956
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\data.dat (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\link[1].htm (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\ad[1].jpg (6073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (7971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (1425 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	87682	88064	4.37233	45ad6b2ae963e8e00ded61beefcd7569
.rdata	94208	5710	6144	3.35466	9938222213b7b6621e291e04bc69722f
.data	102400	105000	41984	1.2267	1aa98e0d995774b3212ad360bb68aaa3
.rsrc	208896	1104188	1104384	5.54395	58f52154134c3535ce96bedccd280639

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://fuckcs.com/link.htm	209.73.153.38
hxxp://fuckcs.com/ad.jpg	209.73.153.38

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /link.htm HTTP/1.1

Accept: */*

Referer: hXXp://fuckcs.com/link.htm

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: fuckcs.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 41

Content-Type: text/html

Last-Modified: Fri, 25 Nov 2016 13:26:06 GMT

Accept-Ranges: bytes

ETag: "a010f0791f47d21:135d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 16 Feb 2017 00:03:57 GMT

hXXp://169re.com|hXXp://fuckcs.com/ad.jpg....

GET /ad.jpg HTTP/1.1

Accept: */*

Referer: hXXp://fuckcs.com/ad.jpg

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: fuckcs.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 23376

Content-Type: image/jpeg

Last-Modified: Sun, 20 Nov 2016 16:07:09 GMT

Accept-Ranges: bytes

ETag: "7cb3d2254843d21:135d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 16 Feb 2017 00:03:57 GMT

......Exif..MM.*............... .......................................................................................(...........1...........2...........i............. .......-....'..-....'.Adobe Photoshop CS6 (Windows).2016:11:22 00:06:11.............0221...................................<...............................n...........v.(.....................~...................H.......H.........XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC hXXp://VVV.iec.ch............IEC hXXp://VVV.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................view.........._...............\.....XYZ .....L.V.P...W..meas................................sig ....CRT curv......................

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2956:

.text

`.rdata

@.data

.rsrc

GetProcessHeap

KERNEL32.dll

EnumChildWindows

USER32.dll

SHLWAPI.dll

ShellExecuteA

SHELL32.dll

GDI32.dll

MSVCRT.dll

WINMM.dll

MTMwKCFeX14hKUVkaXQoIV5fXiEp0ruhokY5zbjK07 qudijrEYxMNe80MS/qrnYXHJcblxyXG62/qGitPK/qtPOz7fU2bXju/fXosjr087Pt6Oow7vTzs 31PXDtNeiyOujv6OpXHJcblxyXG7I/aGixL/HsM7S1rvFqsHL0rvQqdb3wfe1xLXYzbzNuMrTo6yxyMjnybPErs 1wdCjrLvws7XVvqOsusu7 bXYyrLDtLXEoaPDv7j2tdjNvL6vsuzNwbfLtcTXsLG4tPrC67a8srvSu9H5o6zNprfRyrG85LXEo6y689D41NnU9rzTsMlcclxuXHJcbsvEoaLPwtTYoaLS4rz7t7TAobXY1rdodHRwOi8vZnVja2NzLmMoIV5fXiEp1qez1jVF0 nA1rOho6jM7MzdxqXF5LK71qez1qOpINans9a52calyM66zsSjyr3KudPDt723qCDPyNTL0NDTzs 3IMi7uvPU2rTyv6q4qNb6ILXju/fXosjrIMzhyr7Xosjrs8m5piC9 NPOz7ewtEY5v6rG9M24ytMgRjEwuKjW te80McoIV5fXiEpV1RXaW5kb3d8Q1NHT824ytMr17zQxDEuMA0K

MTQwKCFeX14hKV9FTF9QaWNCb3goIV5fXiEpTkVXSU1BR0VfMSghXl9eISlXVFdpbmRvd3wwfENTR0/NuMrTK9e80MQxLjAoIV5fXiEpV1RXaW5kb3d8Q1NHT824ytMr17zQxDEuMA0K

zsLcsMzhyr58XyZffDQ4fF8mX3zKudPDx u52LHVybG2vtC70Lt8XyZffHxfJl98

winver.exe

hXXp://

hXXps://

user32.dll

ntdll.dll

shlwapi.dll

shell32.dll

kernel32.dll

program internal error number is %d.

:"%s"

:"%s".

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

.xy&E=c

U$C%c

mP%S3

,O..ho

.ETB^N

O?u.hG

%Scq2@W

.fsax(

N.ul4

.Jjr}'H"

/C%cM

P.UB5

!.yyF

XC^ L%uM

]G%xV

%SDK4

SQlW

G-6%S

eU.gU

.vSNq

5OudP

R(%X=

.FX"_

*%d\&

;Z.mfuj

M:\wW

].RxZ

g%U8Y

M*.rK

59\G%SY

K..Yk{

aL&

.%D'@G

(&%2U

L.qg6

ce_%D

%C@0H

@s .sk5

`.sge#V]

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Ã•6m*

ccu.md!dd

.Lpr4

m%sBt

5.ch*

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

.nGA$;P

.ZRY][

.bOLK

, #&')*)

-0-(0%()(

^E%cO(

%UMU3"

version="1.0.0.0"

name="Company.Product.Name"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

{7BF80980-BF32-101A-8BBB-00AA00300CAB}

0.1.0.0

Bundle.exe

data.dat_2528:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

Bv.SCv

wininet.dll

kernel32.dll

ntdll.dll

user32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

UnhookWindowsHookEx

MsgWaitForMultipleObjects

SetWindowsHookExA

EnumWindows

ShellExecuteA

hXXp://fuckcs.com/link.htm

Wp.Iw

A.zkt@

5p|%U

Ã¹'p

oO.wm]b

L.qg6

ce_%D

%C@0H

@s .sk5

.njvX

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Ã•6m*

ccu.md!dd

f%.Vy

5r.KV}b

5.ch*

y.MMO}

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

.LLbX

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

gdi32.dll

\game.dll

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://fuckcs.com

%d&&'

123456789

00003333

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

%x.tmp

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

.PAVCException@@

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÃ

c:\data.dat

#include "l.chs\afxres.rc" // Standard components

1, 0, 6, 6

- Skin.dll

(*.*)

1.0.0.0

(hXXp://VVV.eyuyan.com)

data.dat_2528_rwx_10000000_0003F000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps