Gen.Variant.Mikey.50384_f9bea7e8b2 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:2712

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2712 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ButtonEvent.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ns29DF.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\System.dll (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E29.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E17.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\modern-wizard.bmp (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A (893 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E18.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E2A.tmp (2712 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ns29DF.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E17.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E29.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E18.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh2857.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E2A.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2712 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASMANCS]
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\f9bea7e8b290533879c4535915fa803d_RASAPI32]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5	File path
55788069d3fa4e1daf80f3339fa86fe2	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ButtonEvent.dll
1209356a1e393cacf08ff4cede226b13	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\System.dll
d7a3fa6a6c738b4a3c40d5602af20b08	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\inetc.dll
0975b6008916c7bea5bb2b5d0e020b8c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsDialogs.dll
47452b427911d43b8fef70b6ab1d48e7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsExec.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ButtonEvent.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\ns29DF.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A (312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\System.dll (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E29.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7E17.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\modern-wizard.bmp (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A (893 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E18.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7E2A.tmp (2712 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23437	23552	4.48787	bbe0030c61a91dde983517f14a25ba56
.rdata	28672	5302	5632	3.57624	f47a33c87962605f684d2892c2934040
.data	36864	109820	512	1.2639	83c440f13a7f197316ad93416fceac9e
.ndata	147456	184320	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	331776	103544	103936	3.82609	dd2304ee26eaa234df27331fb60aaa68

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://apps.digsigtrust.com/roots/dstrootcax3.p7c
hxxp://apps.identrust.com/roots/dstrootcax3.p7c	192.35.177.64
www.demtxr.com	64.111.117.81
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /roots/dstrootcax3.p7c HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: apps.identrust.com

HTTP/1.1 200 OK

Date: Mon, 19 Dec 2016 17:16:42 GMT

Server: Apache

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Last-Modified: Fri, 19 Oct 2012 20:08:11 GMT

Accept-Ranges: bytes

Content-Length: 893

Cache-control: max-age=86400

Keep-Alive: timeout=5, max=100

Content-Type: application/x-pkcs7-mime

0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D.....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0............P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e..Qc....a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T.....Z...=d......Ap..r.&.8U9C....\@..........%.......:..n.>..\..<..i....*.)W..=....]......B0@0...U.......0....0...U...........0...U..........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D.....}..j.....N...:.pI............:^H...X._..Z.......Y..n.......f3.Y[....sG. ...7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv...(9..e...w.j..w........).....55.1.HTTP/1.1 200 OK..Date: Mon, 19 Dec 2016 17:16:42 GMT..Server: Apache..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Last-Modified: Fri, 19 Oct 2012 20:08:11 GMT..Accept-Ranges: bytes..Content-Length: 893..Cache-control: max-age=86400..Keep-Alive: timeout=5, max=100..Content-Type: application/x-pkcs7-mime..0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D.....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0............P..W..be....

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2712:

.text

`.rdata

@.data

.ndata

.rsrc

Vj%SSS

uDSSh

hu2.iu

verifying installer: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

%u.%u%s%s

.DEFAULT\Control Panel\International

RegDeleteKeyExA

Software\Microsoft\Windows\CurrentVersion

*?|/":

%s%s.dll

%s=%s

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegDeleteKeyA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsDialogs.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp\nsDialogs.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp

@.reloc

SIZE %s

REST %d

Proxy-authorization: basic %s

Authorization: basic %s

Content-Type: application/x-www-form-urlencoded

Content-Length: %d

wininet.dll

FtpCommandA

%s:%s

%u bytes

%u kB

%u MB

%s - %s

%d:d:d

/password

Filename: %s

NSIS_Inetc (Mozilla)

(Err=%d)

Uploading %s

InternetCrackUrlA

FtpOpenFileA

FtpCreateDirectoryA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpSendRequestExA

HttpEndRequestA

HttpQueryInfoA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

;$;*;_;};

_rb]cMDBw

nsw2867.tmp

s\"%CurrentUserName%"\AppData\Local\Temp\nsw2867.tmp

C:\Windows\system32\cmd.exe

c:\%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsh2857.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

369755511

#&_~9*^~[(^

)^}[$]}/!^|

(^}x([|D%Uv!

%Xu" @`

ok} "${Nullsoft Install System v04-Aug-2015.cvs

1.0.4.4

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps