Trojan.Win32.FlyStudio_2addff50f3 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

sevices_860_43057.exe:1472
%original file name%.exe:2748

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process sevices_860_43057.exe:1472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\SQ PlatForm\7024364360891602023 (15 bytes)
C:\ProgramData\SQ PlatForm\9213725520475708051 (15 bytes)
C:\ProgramData\SQ PlatForm\5 (5 bytes)
C:\ProgramData\SQ PlatForm\8317858619336429028 (15 bytes)
C:\ProgramData\SQ PlatForm\5612115401681251799 (15 bytes)
C:\ProgramData\SQ PlatForm\7798123154635197943 (15 bytes)
C:\ProgramData\tmpst\shst (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\110kk011 (3 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\110kk011 (0 bytes)

The process %original file name%.exe:2748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\stat[1].js (1081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NIDQ1OIQ.txt (118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bbs[1].bmp (4202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\tj[1].htm (904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016110220161103\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\03[1].jpg (1543 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\core[1].js (763 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\jquery.min[2].js (10384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\52912.tmp (701 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\demo[1].htm (1404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\530ff.html (908 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\u.zip (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sevices_860_43057.exe (8801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\stat[1].gif (43 bytes)

Registry activity

The process %original file name%.exe:2748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016110220161103]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\xkgg1]










&r&lg&ntime&cnzz_eid&showp&t&h&rnd
&t











&t


&r&lg&ntime&cnzz_eid&showp&t&h&rnd

&<&&

<<<>>>

<><><><><><><><><><><><><><><&tid&extra><><><><><><>

&t

站长统计&&&k&&<><><><><>站长统计

<<<>>>

<><><><><><><><>

<<<>>>

<<<>>>><

<<<>>>


<
><
><><
><>
<><><



><><><>&l
>


<

<><><><&g
<><><>

<><
>
<
><>

<><><>&
><><>&lt
><><><
><><><
><><><>
<><>
&tid<><><
>>

&r&lg&ntime&cnzz_eid&showp&t&h&rnd






&


&

&k
<

>
&Pv..y5pQ.....a....v.
>
&d......
<
&
<<
<&
&E..a......z....d..y_..s5.JI>
<



<>
&&t..P
><



&<&
<

&
&


>>
&MC.7iPt..
<
&

>&
>









<>



<><&gt
<>





&&

<&&

&type

&skey

&angel_key

&pskey

&type

&index&unkown&skey&platfrom

&unkown&skey&platfrom

&vip

&cmd&id&goodsid&goodsnum

&type&goodsid&goodsnum

&unkown&skey&platfrom

&map_index

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&index&succ&unkown&skey

&unkown&skey

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&index&type&unkown&skey&platfrom

&unkown&skey&platfrom

&succ&unkown&skey&platfrom

&unkown&skey

&succ&unkown&skey

&unkown&skey&platfrom

&type

&npc_id

&srcid

&index&succ&unkown&skey&platfrom

&srcid&srcnum&destid&time

&unkown&skey

&succ&unkown&skey

&unkown&skey&platfrom

&succ&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&num&unkown&skey&platfrom

&unkown&skey&platfrom

&pet&unkown&skey&platfrom

&score

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&result&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&add_num&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&unkown&skey

&score&unkown&skey

&unkown&skey

&stone&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&score&unkown&skey&platfrom

&item_num&unkown&skey

&unkown&skey

&score&unkown&skey

&unkown&skey

&score&unkown&skey

&unkown&skey

&delta&unkown&skey

&unkown&skey

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey

&unkown&skey

&id&unkown&skey&platfrom

&delta&unkown&skey&platfrom

&unkown&skey&platfrom

&life&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&step

&level

&chapter

&blue

&src

&gamestr

&type&str

&gamestr

&type

&unkown&skey&platfrom

&power&unkown&skey&platfrom

&unkown&skey&platfrom

&id

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&delta&unkown&skey&platfrom

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&skey&platfrom

&skey

<.>

&

&index&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&index

&id

&index&succ&score&unkown&skey&platfrom

&unkown&skey&platfrom

&pass&unkown&skey&platfrom

&unkown&skey

&num&unkown&skey

&unkown&skey&platfrom

&succ&unkown&skey&platfrom

&index

&unkown&skey&platfrom

&unkown&skey

&npc_id&unkown&skey

&unkown&skey&platfrom

&type&npc_id&unkown&skey&platfrom

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&succ&npcid&unkown&skey

&unkown&skey&platfrom

&type&unkown&skey&platfrom

&unkown&skey&platfrom

&direct

&unkown&skey&platfrom

&game

&win&unkown&skey

&unkown&skey

&unkown&skey&platfrom

&index

&new_name

&unkown&skey

&type&unkown&skey

&num&ran&angel_uin

&skillId&gameId

&id&angel_uin

&npc

&unkown&skey&platfrom

&index&unkown&skey&platfrom

&type&goodsid&goodsnum

&index

&id

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&type&goodsid&goodsnum

&type

&score

&ship

&type

&unkown&skey&platfrom

&score1&score2&unkown&skey&platfrom

&unkown&skey&platfrom

&num&ran&angel_uin

&id&id0&count0&id1&count1&id2&count2

&unkown&skey&platfrom

&id

&id&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&index

&page

&unkown&skey&platfrom

&id

&unkown&skey&platfrom

&id

&unkown&skey&platfrom

&index&unkown&skey&platfrom

&map_index

&unkown&skey&platfrom

&num

&unkown&skey&platfrom

&page

&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&score&type

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&unkown&skey

&tid&page

&srcid&srcnum&destid&time

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

&score&unkown&skey&platfrom

&unkown&skey&platfrom

<.342>

&b

&

&tid&extra

&


&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&&&P&VpM&&&RVK&Sw0&&:IJYTECu2m&UEB8KJE&&LCGbV&W&DKIEW4&GVWV&&Y&&<::oka3ndjfi1r>&&<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb><:v a-a.a0a h-i>&&&b&&c&&d.I&HyEZ6&eP7.e2ek7-e6eJ9mM&KU8&g&i&A&k&l&F1l-K2l3l4l5lZF&q
&&&&b&c&d&g&i&l&v&e&j&q&r&s&t&&x&u&z&w&y&&B&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&Z&&&&&_<_>&&a&b&c&d&e&f&g&h&i&j&k&l&m
&
&
&
&
&&&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&<_>&UM:L&&&&CCcRVgbhbGSlbl&Iv&D&_<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&&U
&X
&e
&
&t&ukuju
&h
&&
&
&u
&_
&&a&e&g&c&
&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&t
&
&
&
&
&
&
&
&
&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&
&
&
&:&&&
&
&
&
&
&
&
&
&
&
&
&
&&
&clickurl&fromurl&ver&unionid&iver&uver
&ver&uver&iver&iswork
&
&y1
&
&
&&
&clickurl&fromurl&ver&unionid&iver&uver
&ver&uver&iver&iswork
&

Summary

Dynamic Analysis