Gen.Trojan.Heur.Hype.tWaKUouIdi_44dfb6466c – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:652

The Trojan injects its code into the following process(es):

ComboFix.exe:1320
fGAwoYMM.exe:532
reIEcoQI.exe:1992
NesIMIQs.exe:436

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process ComboFix.exe:1320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse4.tmp (3118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\XP.mac (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\UserInfo.dll (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz3.tmp (0 bytes)

The process fGAwoYMM.exe:532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7761 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ComboFix.exe (39950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qWUsYYUA.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7761 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qWUsYYUA.bat (0 bytes)

Registry activity

The process ComboFix.exe:1320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 7C 8A C8 BB 48 30 DA 1C 97 22 6B 34 B7 DD 05"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process fGAwoYMM.exe:532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 4E 17 99 7D 27 FA 23 61 2F 37 B8 BB C3 27 07"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:1992 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 B5 6C 31 DD 09 A1 7B E6 27 8D B8 9E 60 B4 31"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process %original file name%.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 10 F9 1B 39 CB CF 4D 2D BD 46 D1 B5 0E CC E3"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process NesIMIQs.exe:436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 34 59 EC 4E 1F 9A BC 86 91 18 11 83 1F 3D FA"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
d01e5e15a0452f2a23f69b4537ebfa34	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
353aa9264cb92b994e53ddcf3e939f84	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
156e604c8c439c63504133315d73c808	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
03b7149d841e1b5c59ba28eb641a4a54	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
f63fcd21257388ce87dafb5896f2f6d3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
7138f7202e33ffba0e017e786d05d6a5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
6fa62c2ebb6c19438e3a2dfeaa4323ab	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
4f4d15b8bb1480fdf8f4ffd67e128cfc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
00ddb954128c3b9165a4b42ed39de41f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
2c958a1612c1f96111d79a3aac102e3e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
31fcd78d93dde587bcc38acc0e07b271	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
90b61ad2ac26ccee34300c01b66fc9a3	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
34779e6c0e61e7b5b9366148a4a5586e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
86b54eaf9594c6692087c360f2cf668f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
cce2294a9a991510c6231a500f8b4e0e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
af423616162c5f47779703a605ffa90e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
b9b91f441d24ef4602a035eb7b04943f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
0f9dae078761db96aa310f661cdefba9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
b7de8de39022cf7990f94c94cafeabbc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
0bd101c95dfe84d03ca7d7425c2f0c9b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
404daaca0df0b83afed34a0bf3b9ad99	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
8743d861000adf1edf1ff20b47727a44	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
8e3075c0895c93517af963e4fec62b77	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
7f05ed91117f12777cb0461bac3fb984	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
3a218e441f8cb2d73f23e55c596163dc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
a5e2e2b3916bcbda32aaae6b1a6707f4	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
397efb4d5ea7c5deca0d844f106eb4eb	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
495c1359a4c7293835e690a5fae4e7fd	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
1366dc92e9335149e368e88c93c1bb49	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
a7fb5130cc83f978610d92a08b151b06	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
65aefab49711365dd3adfb3a32e6ec03	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
c63ae8c3d71ce8a98f3bcde306abbdbe	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
96dccd83e24f8d5716647b2a3d521dbe	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
2cc83433223e22fbe2d42e7b4961d709	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ComboFix.exe
c17103ae9072a06da581dec998343fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsj5.tmp\System.dll
7579ade7ae1747a31960a228ce02e666	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsj5.tmp\UserInfo.dll
9056748b15316271a8517b00d1da6e6a	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
1bd8b6e9c86957cc05b66f635ab26c20	c:\Perl\eg\IEExamples\ie_animated.gif.exe
ced8126845c5353e4249377630727e73	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
47dfdddec9252cc6f43aca180b998d47	c:\Perl\eg\aspSamples\ASbanner.gif.exe
1692bed2ef24a2fb677d7bc602298019	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
a5886c0c88699aaf4985b1ab3fede227	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
e6d1b092f7ab60b23bb9fd38b5a14b8e	c:\Perl\html\images\AS_logo.gif.exe
ca7ada85c491599bcac65004f707e2f5	c:\Perl\html\images\PerlCritic_run.png.exe
9d2d8bfd5dfafd1e4a8fe52610423580	c:\Perl\html\images\aslogo.gif.exe
d46d66e0d284b28d63901486525d254c	c:\Perl\html\images\ppm_gui.png.exe
854c6d78cb5ec38699cae8189e5103e3	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
633a2f0c74dcea7c19344af6a397e509	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
f82f6dbc16104dd92cb3337cf511a5de	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
82cabcf1365ea77a27d97e595dc47452	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
08b71f956c80a3c460cc4fd8aeada930	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
efac07b365cff812bd87c5ff617d4300	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
8e0e8f9f846d6c1e9569be6116ddff9a	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
14e47c3c18622910c50555b385cd0588	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
0ff6a2421335eda9661538b649012e38	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
4e61b9560358e3bf63a9c8eff564791b	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
e77b0918101c40f6830d2d5f449ccd89	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
6af5943357c48a24f47938d08ce2d8cd	c:\totalcmd\TCMADMIN.EXE.exe
9ede8b7124493fbf686c7188e64b4b92	c:\totalcmd\TCMDX32.EXE.exe
fbdba29b1cac8f3d5b93aea313128890	c:\totalcmd\TCUNINST.EXE.exe
32ef08d4f39223e909ac7d1f91ca73a8	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:652
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nse4.tmp (3118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\XP.mac (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj5.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7761 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ComboFix.exe (39950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qWUsYYUA.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7761 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	6565888	6563840	5.54107	db2504d89f9f9ab74b14ee81a1af414d
.rdata	6569984	4096	512	2.34478	bed21cc03d892f753c88f1ef596fb4c7
.data	6574080	5	512	0.070639	c37b76034a5018d92c7a9fbde6be4ba4
.rsrc	6578176	1372	1536	2.08277	f30f222703a88f5943563f5e0ef4b0d9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	216.58.209.174

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YrEQVYavHKet8weM8IBo

Content-Length: 260

Date: Tue, 24 Mar 2015 00:35:46 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YrEQVYavHKet8weM8IBo">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YrEQVYavHKet8weM8IBo..Content-Length: 260..Date: Tue, 24 Mar 2015 00:35:46 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=YrEQVYavHKet8weM8IBo">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Y7EQVffQNa2t8we0hoGQAg

Content-Length: 262

Date: Tue, 24 Mar 2015 00:35:47 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Y7EQVffQNa2t8we0hoGQAg">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Y7EQVffQNa2t8we0hoGQAg..Content-Length: 262..Date: Tue, 24 Mar 2015 00:35:47 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=Y7EQVffQNa2t8we0hoGQAg">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_532:

.text

.rdata

@.data

F1%xAG1

7.qU6

TNcMdI

vND.LOrg

.eH^\

w|.LV

QfC%d

dW0WaZ@%di

O%%Sg

[%dZr

l}9fT{

E!.Lg:

\D.vY

m.TpM

.WYky?

?%sn6

.wbK3

Am%foEW

%d[k#

k[w[.dx

Ho%sd^

.pgVM

.XU\:

.TU:67Y[

mre%s

Rx.AF{-F

.dA}R

9zE46}GF{-A}d8

Rx.AMb

Rx.AJ

Vy-A}y1

]~]{:&]{>

Mr.0M8.wM

F@%uF

5@.FJ

r|M-

9Q2.QD

s]{>EkAC.AZ?

]mYS_;-h}_/

%s>Ab

GcMd

7FZZZZ%

&aTF{-A}d8

Rx.AZu`\Vb)

Rx.AN~2

Rx.AF z

x.ASs)

Rx.AF{-6s z

]sc.Pu

).KQ>6V

yT%FZ

d?%x1

u2S.cp

~%m"%U

R.BFX7

.Cd"w

/1:,*-.1

#k%U,

:EW.yY

%cMV=

hC%x}7

.Gl^z

>fAd:%U

.cW a

]{.iA8

8=d0,.eJ

KV.eb

.CYf?a8

=Btcp

[\w,.PH

>l.qm

Microsoft Windows

}.ve{

ntdll.dll

oleaut32.dll

user32.dll

kernel32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global 3 is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

fGAwoYMM.exe_532_rwx_00401000_000EA000: