Gen.Variant.Zusy.214221_3d0bd911b7

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3188

The Trojan injects its code into the following process(es):

iexplore.exe:3828
Explorer.EXE:284

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3188 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Mozilla Firefox\xul.dll (520 bytes)
%Program Files%\Google\Chrome\Application\54.0.2840.59\chrome.dll (1127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\d.bat (250 bytes)

Registry activity

The process %original file name%.exe:3188 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 896 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	validation.sls.microsoft.com
127.0.0.1	clients2.google.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:3188
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Program Files%\Mozilla Firefox\xul.dll (520 bytes)
   %Program Files%\Google\Chrome\Application\54.0.2840.59\chrome.dll (1127 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\d.bat (250 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 6.1.7600.16385
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WINHLP32.EXE
Internal Name: WINHSTB
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
File Description: Windows Winhlp32 Stub
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 6.1.7600.16385Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WINHLP32.EXEInternal Name: WINHSTBFile Version: 6.1.7600.16385 (win7_rtm.090713-1255)File Description: Windows Winhlp32 StubComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	86788	87040	5.47299	74af5acce34d9496905a2ee7c628fb42
.data	94208	53288	53760	0.406377	d7060f4d3d07b3babef8258b7402dff8
adc91	151552	1008	1024	2.37353	b01813c0dd9d624e306442bf561a10ed
.reloc	155648	2446	2560	3.11963	ee7b5fedbfbcac347c7f768cf109e57c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_3828:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

>.uzf

>.uzf

.us;}

.us;}

IEFRAME.dll

IEFRAME.dll

MLANG.dll

MLANG.dll

iertutil.dll

iertutil.dll

urlmon.dll

urlmon.dll

ole32.dll

ole32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

msvcrt.dll

msvcrt.dll

USER32.dll

USER32.dll

KERNEL32.dll

KERNEL32.dll

ADVAPI32.dll

ADVAPI32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

GetWindowsDirectoryW

GetWindowsDirectoryW

_amsg_exit

_amsg_exit

_wcmdln

_wcmdln

UrlApplySchemeW

UrlApplySchemeW

PathIsURLW

PathIsURLW

UrlCanonicalizeW

UrlCanonicalizeW

UrlCreateFromPathW

UrlCreateFromPathW

iexplore.pdb

iexplore.pdb

KEYW

KEYW

KEYWh

KEYWh

KEYWD

KEYWD

.ENNNG.

.ENNNG.

a.ry.v

a.ry.v

l.igM4

l.igM4

?1%SGf

?1%SGf

xh.JW^

xh.JW^

.97777"7" " " !

.97777"7" " " !

3.... ))

3.... ))

8888888888888

8888888888888

8888888888

8888888888

.lPV)

.lPV)

úW1

úW1

.ApX/

.ApX/

H.ZAf

H.ZAf

ð[U

ð[U

%s!FK

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

888777777

Y.hilkRROMLK=C,

Y.hilkRROMLK=C,

..(((($$

..(((($$

3...((((%

3...((((%

3....(.''$

3....(.''$

3.2...((((%

3.2...((((%

33.2....(,'

33.2....(,'

55323222...

55323222...

(%&'00443445?

(%&'00443445?

00.,,,4(

00.,,,4(

000.,,9(

000.,,9(

0020..9(

0020..9(

003200;(

003200;(

(#'( (''''!'!

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Microsoft.InternetExplorer.Default

user32.dll

user32.dll

Kernel32.DLL

Kernel32.DLL

xfire.exe

xfire.exe

wlmail.exe

wlmail.exe

winamp.exe

winamp.exe

waol.exe

waol.exe

sidebar.exe

sidebar.exe

psocdesigner.exe

psocdesigner.exe

np.exe

np.exe

netscape.exe

netscape.exe

netcaptor.exe

netcaptor.exe

neoplanet.exe

neoplanet.exe

msn.exe

msn.exe

mshtmpad.exe

mshtmpad.exe

mshta.exe

mshta.exe

loader42.exe

loader42.exe

infopath.exe

infopath.exe

iexplore.exe

iexplore.exe

iepreview.exe

iepreview.exe

groove.exe

groove.exe

explorer.exe

explorer.exe

dreamweaver.exe

dreamweaver.exe

contribute.exe

contribute.exe

aol.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

"%s" %s

Kernel32.dll

Kernel32.dll

\AppPatch\sysmain.sdb

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

kernel32.dll

{00000000-0000-0000-0000-000000000000}

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\Volume

shell:%s

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Frame_URLEntered

Imaging_CreateWebPagePreview

Imaging_CreateWebPagePreview

WS_ExecuteQuery

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

IEXPLORE.EXE

Windows

Windows

9.00.8112.16421

9.00.8112.16421

iexplore.exe_3828_rwx_00050000_00002000:

user32.dll

user32.dll

advapi32.dll

advapi32.dll

kernel32.dll

kernel32.dll

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TMP1363199.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TMP1363199.exe

c:\%original file name%.exe

c:\%original file name%.exe

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\RunOnce

%Program Files%\Internet Explorer\iexplore.exe VVV.google.com

%Program Files%\Internet Explorer\iexplore.exe VVV.google.com

iexplore.exe_3828_rwx_00060000_00020000:

.text

.text

.rdata

.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SSSShl

SSSShl

SSShX

SSShX

SHLWAPI.dll

SHLWAPI.dll

WS2_32.dll

WS2_32.dll

MFC42.DLL

MFC42.DLL

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

ShellExecuteExA

ShellExecuteExA

SHELL32.dll

SHELL32.dll

' ).;

' ).;

advapi32.dll

advapi32.dll

content.js

content.js

secref.txt

secref.txt

\chrome.dll

\chrome.dll

\Google\Chrome\Application\

\Google\Chrome\Application\

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\RunOnce

ux

ux

\Mozilla Firefox\xul.dll

\Mozilla Firefox\xul.dll

myextension.json

myextension.json

Extension%d

Extension%d

\extensions.ini

\extensions.ini

\prefs.js

\prefs.js

\extensions.json

\extensions.json

\\.\PhysicalDrive0

\\.\PhysicalDrive0

iphlpapi.dll

iphlpapi.dll

\content\icon-64.png

\content\icon-64.png

\content\icon-48.png

\content\icon-48.png

\content\content.js

\content\content.js

\install.rdf

\install.rdf

\META-INF\mozilla.sf

\META-INF\mozilla.sf

\META-INF\mozilla.rsa

\META-INF\mozilla.rsa

\META-INF\manifest.mf

\META-INF\manifest.mf

\content\browser.xul

\content\browser.xul

\chrome.manifest

\chrome.manifest

\icons\icon128.png

\icons\icon128.png

\icons\icon64.png

\icons\icon64.png

\icons\icon48.png

\icons\icon48.png

\icons\icon18.png

\icons\icon18.png

\background.js

\background.js

\content.js

\content.js

\manifest.json

\manifest.json