Generic.Starter.3.C64DBDC8_f675eddb95 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

lssas.exe:432
lssas.exe:396
%original file name%.exe:652

The Generic injects its code into the following process(es):

Explorer.EXE:532

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process lssas.exe:432 makes changes in the file system.

The Generic deletes the following file(s):

%Program Files%\Common Files\win0\000cbffa.txt (0 bytes)

The process lssas.exe:396 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1473 bytes)
%Documents and Settings%\%current user%\W71E93.TY4 (673 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\W71E93.TY4 (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\B76B\lssas.exe (11745 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\B76B\__tmp_rar_sfx_access_check_831828 (0 bytes)

Registry activity

The process lssas.exe:432 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 CE ED 24 7F D7 2C 16 73 01 52 21 A3 04 60 33"

[HKCU\Software\Classes\CLSID\{7EB1EE07-4731-E144-B670-83942C90D1CE}\184E042E\CG1]
"BID" = "20 00 08 00 15 00 05 00 DF 07 00 00 14 00 88 FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Win7zip]
"uuid" = "7E B1 EE 07 47 31 E1 44 B6 70 83 94 2C 90 D1 CE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\CLSID\{7EB1EE07-4731-E144-B670-83942C90D1CE}\184E042E\CG1]
"HAL" = "05 EE 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rqmynangs.exe]
"DisableExceptionChainValidation" = ""

The process lssas.exe:396 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 8C E1 3F CD 54 7A DC 87 6C 07 18 05 D8 F0 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:652 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 02 E1 CE 73 95 62 9A FA A1 CD CC 4F 5C 2E 63"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\B76B]
"lssas.exe" = "lssas"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Generic modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Generic modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Generic modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Generic installs the following user-mode hooks in DNSAPI.dll:

DnsQuery_W

The Generic installs the following user-mode hooks in WS2_32.dll:

gethostbyname
getaddrinfo
GetAddrInfoW

The Generic installs the following user-mode hooks in ntdll.dll:

KiFastSystemCall

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
lssas.exe:432
lssas.exe:396
%original file name%.exe:652
Delete the original Generic file.
Delete or disinfect the following files created/modified by the Generic:
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1473 bytes)
%Documents and Settings%\%current user%\W71E93.TY4 (673 bytes)
%Documents and Settings%\%current user%\B76B\lssas.exe (11745 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	74526	74752	4.54396	a8692f5ba740240ef0f9a827376f76f9
.rdata	81920	7445	7680	3.46159	d4f36accffde0bf520f52486679ccf0d
.data	90112	96036	512	2.46008	b6c7edb5b7fec47a37a622cc5d71f3f4
.CRT	188416	32	512	0.273198	439411041ee0b8261668525c5c132cd9
.rsrc	192512	29460	29696	3.43606	f21262c1f19dd1a6b0aae11fc5cba7e9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://javatube.net/videos/player.php	173.254.28.70
update.microsoft.com	134.170.58.221

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Generic connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_532_rwx_02250000_00122000:

.text

`.rdata

@.data

.rsrc

@.reloc

PSSSSSSh

SSSSh

u@SSShHC(

RPVSSh

PSSh(

PSSh#

9p.uS

Opera/9.00 (Windows NT 5.1; U; en)

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)

Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

Opera 9.4 (Windows NT 6.1; U; en)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)

Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)

SbieDll.dll

Software\Classes\CLSID\%s\X

Software\Classes\CLSID\%s\X\%s

0xX

SB:0xX

G:%s_0xX_%c:%s_v1$

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u

IEXPLORE.EXE

IE.HTTP

SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

IE.HTTPS

SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice

IE.AssocFile.HTM

HTTP\shell\open\command

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s

Psapi.dll

%s\%s

Software\Adobe\Acrobat Reader\%s\Privileged

mscoree.dll

HARDWARE\DESCRIPTION\System\CentralProcessor\%u

SOFTWARE\Microsoft\Windows NT\CurrentVersion

.vcproj

Software\%s

nspr4.dll

nss3.dll

Urlmon.dll

URLDownloadToFileW

Netapi32.dll

76487-640-1457236-23837

76487-337-8429955-22614

76487-644-3177037-23510

76497-640-6308873-23835

55274-640-2673064-23950

76487-640-8834005-23195

76487-640-0716662-23535

76487-644-8648466-23106

00426-293-8170032-85146

76487-341-5883812-22420

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup

{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}

snxhk.dll

comctl32.dll

ZwSetValueKey

ZwDeleteValueKey

SOFTWARE\%s

update.microsoft.com

microsoft.com

windowsupdate.microsoft.com

JOIN

PRIVMSG

.rdata

cmd_option.%s

msvcrt.dll

Port

--x-x-x-xx

Content-Type: multipart/form-data; boundary=x-x-x-xx

Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"

%s?action=up&g=%s

Software\FTPWare\CoreFTP\Sites

PortNumber

Password

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%s\FTP Commander

%s\FTP Commander Deluxe

Port=

Password=

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

ps0=%s&ps1=%s

&slc=%d

%d|%s|%s|%s

&sl_%d=

.info

httpget

GET /%s HTTP/1.1

Host: %s

Content-Length: %d

Accept: %s

Accept-Language: %s

Accept-Charset: %s

Accept-Encoding: %s

User-Agent: %s

Referer: %s

Connection: %s

hXXp://

iexplore.exe

firefox.exe

%s:%hu

windowsupdate

SSH2_MSG_KEXINIT

SSH2_MSG_DISCONNECT

SSH2_MSG_USERAUTH_SUCCESS

hXXp://%s%s/image.php?id=%s

TaskDialogIndirect

hXXp://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535

ÃxX

vBetaLib.exe

ntdll.dll

kernel32.dll

secur32.dll

crypt32.dll

user32.dll

advapi32.dll

wininet.dll

shell32.dll

shlwapi.dll

ole32.dll

version.dll

sfc.dll

dnsapi.dll

ws2_32.dll

3!4-4\4}4

2$2 22292

>*>1>=>}>

? ?4?\?~?

4 4)434

51696?6\6

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

RegDeleteKeyExW

Error text not found (please report)

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

USERENV.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

OLEAUT32.dll

GetCPInfo

zcÃ

#%.c#%.'#%.

0187028

23:-23:724:

239:139[139

%cKfI

.Sdt{

s.Ai

.nP_Kl

%uEqOZw

%uQ$@"

,W.cG@H

r%d*\uVZ.f

C.zc/

%sXc{

lv%FpT

^a'%sP.3nVc

-b.st

%-ix}h

URlM

b%DOtGtYr

a{%D%

B,.Sb

ml.Bf

z%CIC

G]9%C

.CN-e

y.tn;

$>f.OK

De%sQ

Software\Classes\CLSID\%S

G:%S_0xX

chrome.exe

opera.exe

safari.exe

maxthon.exe

:Mozilla\Firefox\Profiles

cookies.sqlite

%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*

%s\winsxs\%s\comctl32.dll

cmd.exe

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s

%s:*:Enabled

avcuf32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

prstrui.exe

Windows Defender

MpClient.dll

Windows Defender\MSASCui.exe

MpSvc.dll

msseces.exe

MsMpEng.exe

MSASCui.exe

MpAsDesc.dll

MsMpLics.dll

avgui.exe

avgidsagent.exe

avgwdsvc.exe

avgdiagex.exe

avgmfapx.exe

avgupd.exe

avgcfgex.exe

avgnt.exe

avguard.exe

avshadow.exe

avcenter.exe

update.dll

updaterc.dll

usrreq.exe

updater_pdk.esm

filecategorizer.dll

starter_avp.exe

ccsvchst.exe

symerr.exe

NIS.exe

navw32.exe

avastui.exe

avastsvc.exe

AvastEmUpdate.exe

WRSA.exe

zatray.exe

ForceField.exe

updating.dll

fshoster32.exe

fsaua.dll

PSUNMain.exe

PSUAService.exe

PSANHost.exe

PSUNScan.dll

epavjobs.exe

AVENGINE.exe

Upgrader.exe

adaware.exe

BullGuard.exe.manifest

BullGuardUpdate.exe

BullGuard.exe

BullGuardScanner.exe

BullGuardBhvScanner.exe

BullGuardUpdate2.exe

BgScan.exe

BgScanEngine.dll

.manifest

updater.exe

Backup\RSD\RSSetup\updater.exe

RsTray.exe

RavMonD.exe

RsMgrSvc.exe

rsmain.exe

RsScan.dll

RsTray.dll

mbamgui.exe

mbam.exe

pctsGui.exe

pctsAuxs.exe

pctsSvc.exe

Update.exe

UpdateHlpr.dll

Definitions\vcore.dll

sbamui.exe

SBAMTray.exe

updater_client_mod.dll

FProtTray.exe

FPWin.exe

scf.dat

ALUpdate.exe

update_tmp.exe

arcaclean.exe

rcfp.exe

CLPSLA.exe

op_mon.exe

niu.exe

K7TSUpdT.exe

sguardxup.exe

ccupdate.exe

caupdate.dll

a2guard.exe

a2start.exe

a2service.exe

AVKTray.exe

GDSC.exe

AVK.exe

GDFirewallTray.exe

Bka.exe

BLuPro.exe

BkavSystemServer.exe

BkavService.exe

LiveUpdate.dll

LiveConnect.dll

BaseFile\Bkav\LiveUpdate.dll

V3Lite.exe

ASDSvc.exe

autoup.exe

downloader.exe

seccenter.exe

updatesrv.exe

odscanui.exe

bdapupck.dll

updatemgr.dll

egui.exe

ekrn.exe

%s.config

x86\ekrn.exe

uWinMgr.exe

coreServiceShell.exe

uiSeAgnt.exe

uiWatchDog.exe

plugins\plugUpdater.dll

UiFrmwrk\uiUpdateTray.exe

coreFrameworkHost.exe

mcagent.exe

McSvHost.exe

McUICnt.exe

McPvTray.exe

mcui_exe

mcpltui_exe

mcshell.exe

mcupdmgr.exe

mcupdate.exe

mcshield.exe

.config

Image File Execution Options\%s

SYSTEM\CurrentControlSet\services\%s

%c:\ntusbdriver.sys

%c:\*p.exe

%c:\%s

p.exe

%WinDir%\explorer.exe

/C start /d. %s&"%s"

%COMSPEC%

%WinDir%\system32\shell32.dll

%c:\%s.lnk

AvastUI.exe

VisthAux.exe

explorer.exe

t.minecraft

Works! PID: %d, Name: %s

cmdvirth

%s%s\X

tcp://

svchost.exe

csrss.exe

lsass.exe

smss.exe

wscript.exe

cscript.exe

vbc.exe

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

winlogon.exe

services.exe

%s\x.lnk

_.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

desktop.ini

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

wintrust.dll

Software\Microsoft\Windows\CurrentVersion\RunOnce

chrome.dll

Applications\iexplore.exe\shell\open\command

%s_xx

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps