Trojan.Generic.11359093_ade1ea6e71 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1004

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:1004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Shortcut_Module\Res\facebook.ico (1633 bytes)
C:\Shortcut_Module\svchost.exe (5065 bytes)
C:\Shortcut_Module\smss.exe (601 bytes)
C:\Shortcut_Module\Res\Sh_M.ico (1345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (2705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1568 bytes)
C:\Shortcut_Module\Res\sos.ico (1729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\alpjtfv (2513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (157 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\alpjtfv (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 8D 28 A1 63 B9 D1 F1 43 87 06 8E EB 5C 4E 63"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Shortcut_Module\SteelWerX Command Line Registry Editor]
"Path" = "C:\Shortcut_Module\svchost.exe"

[HKLM\SOFTWARE\Shortcut_Module\%original file name%.exe]
"EulaAccepted" = "1"

[HKLM\SOFTWARE\Shortcut_Module\Freeware implementation of XCACLS]
"EulaAccepted" = "1"

[HKLM\SOFTWARE\Shortcut_Module\%original file name%.exe]
"Path" = "C:\%original file name%.exe"

[HKLM\SOFTWARE\Shortcut_Module\SteelWerX Command Line Registry Editor]
"EulaAccepted" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"PromptOnSecureDesktop" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Shortcut_Module\Freeware implementation of XCACLS]
"Elevation" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Shortcut_Module\%original file name%.exe]
"Elevation" = "1"

[HKLM\SOFTWARE\Shortcut_Module\Freeware implementation of XCACLS]
"Path" = "C:\Shortcut_Module\smss.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"ConsentPromptBehaviorAdmin" = "0"
"ValidateAdminCodeSignatures" = "0"

[HKLM\SOFTWARE\Shortcut_Module\SteelWerX Command Line Registry Editor]
"Elevation" = "1"

Dropped PE files

MD5	File path
9cef63fde7a3a91a747ceb26d00fced3	c:\Shortcut_Module\smss.exe
a46842c9b0c567a5a9584e83a163560c	c:\Shortcut_Module\svchost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1004
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Shortcut_Module\Res\facebook.ico (1633 bytes)
C:\Shortcut_Module\svchost.exe (5065 bytes)
C:\Shortcut_Module\smss.exe (601 bytes)
C:\Shortcut_Module\Res\Sh_M.ico (1345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (2705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1568 bytes)
C:\Shortcut_Module\Res\sos.ico (1729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\alpjtfv (2513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (157 bytes)

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 3.3.10.2
Legal Copyright: g3n-h@ckm@n
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 16.2.2014.1
File Description: Shortcut_Module
Comments: Shortcut & startpages disinfector
Language: English (United States)

Company Name: Product Name: Product Version: 3.3.10.2Legal Copyright: g3n-h@ckm@nLegal Trademarks: Original Filename: Internal Name: File Version: 16.2.2014.1File Description: Shortcut_ModuleComments: Shortcut & startpages disinfectorLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	573044	573440	4.63126	74af66fa540568c59b3868e78900e476
.rdata	577536	182122	182272	4.0072	576c856afaad699ad9fe099fc6a9ce33
.data	761856	40756	25088	1.38934	e6d2e204147f7cdc3055011093632f54
.rsrc	802816	884044	884224	5.53161	f35293d47b83dc3c82a4ebd304fe870f
.reloc	1687552	42082	42496	3.63105	c2f6ddaeef894b7510c3be928eeae5dd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1004:

.text

`.rdata

@.data

.rsrc

@.reloc

PSSSSSSh

Gt.Ht$

t.jGZf;

PSSShD

PVSShD

f;Crt

?#%X.y

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

kernel32.dll

oleaut32.dll

RegDeleteKeyExW

advapi32.dll

Error text not found (please report)

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

USERENV.dll

UxTheme.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

zcÃ

&44.!0*%

&.-.")6 )

!#"'& %&

!!!'#"!$)%"

!!!###"#')($!&)%'(

!!!###*#**(

'&/(%.$$

"""!!!$$$,!)

'%# *5&*#1-(/($

###"""%%%'% )'&$ (- 1/).//)0-)

! $$$,,,555;:=?>=?=>=?===>=?>=?=

$$$,,,555;:=?>=?=?>@>=?>=?>=?>=?>=?>=?=

$$$,,,555;:=??>@>=??>@?>@>=?>=??>@?>@>=?>=?

444"""%%%

444!!!((("""

###''' 999

%%%&&&***

!!!///%%%---

&&&%%

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps