Gen.Variant.Barys.13489_931ad27dd8 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1908
00.exe:2504
.exe:2996

The Trojan injects its code into the following process(es):

LEAGUE~1.EXE:2988
iexplore.exe:2544

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\LEAGUE~1.EXE (37047 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\00.exe (2939 bytes)

The process 00.exe:2504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aUUUUU.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (808 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aUUUUU.xml (0 bytes)

The process .exe:2996 makes changes in the file system.

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\x.html (0 bytes)

Registry activity

The process %original file name%.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"

The process 00.exe:2504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process .exe:2996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\XtremeRAT]
"Mutex" = "C6fjs5R2Pz"

Dropped PE files

MD5	File path
54a47f6b5e09a77e61649109c6a08866	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe
8f50bbb29eb9f40c7aca521f672fabc7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\00.exe
e4f487ecb11713c6b3ae4458f8c1e206	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\LEAGUE~1.EXE
8f50bbb29eb9f40c7aca521f672fabc7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe
54a47f6b5e09a77e61649109c6a08866	c:\Windows\System32\InstallDir\svchost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1908
00.exe:2504
.exe:2996
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\LEAGUE~1.EXE (37047 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\00.exe (2939 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aUUUUU.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (808 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16428
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Language Neutral

Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.16428Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)File Description: Win32 Cabinet Self-Extractor Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26060	26112	4.42567	e9bf1a1e456a9a811b1b86e6602e3636
.data	32768	6796	1024	2.20139	317f8a934ee443eee01c2a315bde9ca1
.idata	40960	4216	4608	3.49941	d8675ba112ef922c6057a02546757a1a
.rsrc	49152	1474387	1474560	5.19461	948fb6c0b3802ab5977b449dc219356c
.reloc	1523712	5038	5120	2.58043	83de2f9b2c95be6fea06bced7e8a058e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
14db8bd11691cd59b75c0a783487c7ba

Network Activity

URLs

URL	IP
ah-antihacker.ddns.net	177.86.90.37
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1908:

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

SSSh

PSSShp

PSShp

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

SHELL32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\

@Ew.AEw

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

00.exe

LEAGUE~1.EXE

-AO}O

5.jqW

m^-p}

%fxPA

Y1%9ssL

.vn{q

U.Du?H

C%x4[

H%dzm}

z[ .gr

m%u3?%_

.Oe[H

u.HfN-

.ag5.F

o.uWKm

Iw.RRI

/.IZm

' G%Xo^(

h]%uZK

SQLM

(.eQB"=

A.iuP

ZK.ZSY

JxB%d

X7.mo

%cS '

ztl.BU)

u.FQQ6

(S.tz*

U%xfW

.df2jK

.ZtW!X

hU.EM

Hd%D!

(*@i~.jK5m

9-Q}x

.ag^Qi

Ml%sy

Rl*.VV

Y8g%u

26T.fn

N'%s4

X/%uIa

.mu"EE^

jl.sC,

I.zx9]

.ELeZ

.qthb

K].IP

,h.qC

.My-2

0`%ds

aH T%S2r0

AK.Vq

]PJP.sqB

%.FJ kK

0WL%dOg;

4%x ]

@l%dm

r1.vHssE4

%Cwa1

c2.pTst

P%.WS

S%p%9Uo

vI.Ztg

0%u:`

*.fZ?

w)d%X

Hl,.AUN:&

%i?%U(

}&r%D}

(a

.RF8)b

.LCYGb

8%x>/

Lm)C]Q.JBn

.LRba

%.u[q

W=.wjq

"5z%.NvbOw

.aWV5

".Nzoe=_)

Ù!/

mJ9\%x8

.BP5H

!%4uDA#(

.fZYm

.gBdE

-.RyjE6

jB.Tl

Q%Xbb

zu.nw

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Kernel32.dll

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.Ên not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.OFalha ao obter informa

o em disco de: %s.

Mensagem do sistema: %s..Um recurso necess

o pode ser encontrado.#Tem certeza de que deseja cancelar?

o do sistema operacional.'Falha do pedido de aloca

O arquivo de gabinete (.cab) n

vel encontrar uma unidade com %s KB de espa

o.NPasta inv

lida. Certifique-se de que a pasta existe e de que permite grava

o.ZEspecifique uma pasta com um nome de caminho totalmente qualificado ou clique em Cancelar.

!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

o da pasta.QN

logo do navegador.RN

vel carregar Shell32.dll, necess

)Erro ao criar o processo . Causa: %s7N

suporte para o tamanho do cluster deste sistema..Um recurso necess

rio parece estar corrompido.IA instala

o requer o Windows 95 ou o Windows NT 4.0 beta 2 ou posterior.

Erro ao carregar %smFalha de GetProcAddress() na fun

o '%s'. Poss

o incorreta de advpack.dll est

sendo usada.>O Windows 95 ou o Windows NT

vel criar a pasta '%s'

precisa de %s KB de espa

o livre na unidade %s.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

$Erro ao recuperar a pasta do Windows

*Desligamento do NT: erro OpenProcessToken./Desligamento do NT: erro AdjustTokenPrivileges.'Desligamento do NT: erro ExitWindowsEx.

o em disco insuficiente para arquivo de permuta) ou arquivo de gabinete (.cab) corrompido._As informa

es de volume da unidade (%s) n

Mensagem do sistema: %s.

o e tente novamente.pO programa de instala

/C: -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

pia do pacote '%s' j

sendo executada no sistema. Deseja executar outra c

vel encontrar o arquivo: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

xito quando executadas por um administrador.

(A pasta '%s' n

sendo executada no sistema. Apenas uma c

pia pode ser executada de cada vez.PO pacote '%s' n

o do Windows que est

sendo executada.FO pacote '%s' n

o do arquivo: %s do sistema.

11.00.9600.16428 (winblue_gdr.131013-1700)

WEXTRACT.EXE .MUI

11.00.9600.16428

iexplore.exe_2544:

.text

`.data

.rsrc

@.reloc

Bv9.jk

Bv.TBv

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

iexplore.exe_2544_rwx_10000000_0004D000:

`.rsrc

ServerKeyloggerU

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps