Trojan.GenericKD.3134916_f6a9067b84

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2016

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:2016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXI3G1IV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7PT78354\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SQQDUG6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\UZOJ2VC7\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:2016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 45 19 47 D3 4F 8E 68 01 D2 04 FF 28 9F 48 AD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:2016

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXI3G1IV\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7PT78354\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SQQDUG6\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\UZOJ2VC7\desktop.ini (67 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /lyb.php?pid=51825 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.hywp.pw

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Date: Fri, 08 Apr 2016 22:50:15 GMT

Server: WWW Server/1.1

X-Powered-By: PHP/5.2.17

Set-Cookie: user=deleted; expires=Thu, 09-Apr-2015 22:50:14 GMT

Content-type: text/html; charset=GBK

X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<title>................ - ......</title>......</head>..<body>..<style type="text/css">..body{margin:0px;..OVERFLOW-X: hidden; }..</style>.. ...... ..<SCRIPT LANGUAGE="JavaScript"> ..Image1= new Image(100,50) ..Image1.src = "img/180945356341.png" ....</SCRIPT> ....<script src="hXXp://libs.baidu.com/jquery/2.0.0/jquery.min.js" type="text/javascript"></script> ..<link rel="stylesheet" href="css/tipso.min.css">......<script>..$(function(){ .. $(window).scroll(function() {.. if($(window).scrollTop()>=100){.. $(".nav").addClass("fixedNav");.. }else{.. $(".nav").removeClass("fixedNav");.. } .. });..});..</script>....<style type="text/css">.......fixedNav{.. position:fixed;.. top:0px;.. left:0px;.. width:100%;.. z-index:100000;.. _position:absolute;.. _top:expression(eval(document.documentElement.scrollTop));..}..a{...text-decoration: none;..}...xx a{...color: #FFFFFF;...text-decoration: none;..}...xx {..height: 63px;..width: 100%;.. padding-top: 1px;.. background: url(img/18711.png);..border-bottom: 1px solid #224879;..}...jz{..margin:0 auto; ..width:1024px;..height:63px;..}...logo{..width:190px;..margin-right:40px;..height:75px; ..margin-left: 68px;..mar

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2016:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

H%dKb

H%dKb

~%UVW

~%UVW

u$SShe

u$SShe

hXXp://VVV.hywp.pw/lyb.php?pid=51825

hXXp://VVV.hywp.pw/lyb.php?pid=51825

3.21.exe

3.21.exe

1 !!-.!;

1 !!-.!;

@.rmnet

@.rmnet

kernel32.dll

kernel32.dll

c:\kss.ini

c:\kss.ini

password

password

.idata

.idata

.edata

.edata

P.vmp0

P.vmp0

`.vmp1

`.vmp1

.reloc

.reloc

P.rsrc

P.rsrc

version.dll

version.dll

user32.dll

user32.dll

shell32.dll

shell32.dll

1e.ro4A

1e.ro4A

oleaut32.dll

oleaut32.dll

H0.gW

H0.gW

comctl32.dll

comctl32.dll

advapi32.dll

advapi32.dll

gdi32.dll

gdi32.dll

d.jF/"

d.jF/"

r#'%C

r#'%C

6.Xdp

6.Xdp

g|$^.Cn

g|$^.Cn

>.bM8

>.bM8

>Z.Ye

>Z.Ye

w4R`$p%s*

w4R`$p%s*

f.zo~L^

f.zo~L^

wsock32.dll

wsock32.dll

ntdll.dll

ntdll.dll

Ë.L@

Ë.L@

l.sQ{

l.sQ{

c-t{.FF

c-t{.FF

b#I".wM

b#I".wM

e.ENZ

e.ENZ

xip.tu

xip.tu

@>.vO

@>.vO

%FX2Fsi

%FX2Fsi

qKT.jLka

qKT.jLka

3.LD7

3.LD7