Gen.Variant.Kazy.1750_a93ac3c3f9 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1792
agrsmdel.exe:440

The Trojan injects its code into the following process(es):

rSwooYMM.exe:996
jWcYYUcg.exe:1148
FeEQMIQs.exe:1072

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LckgYsIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\agrsmdel.exe (68 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7809 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7809 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LckgYsIs.bat (0 bytes)

The process FeEQMIQs.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

Registry activity

The process %original file name%.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 02 F8 EF F8 69 79 3A 6A A7 D3 15 77 84 E8 2F"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process rSwooYMM.exe:996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B BB A0 99 0F 34 91 87 6C EB 6C 10 23 7E 17 93"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"

The process agrsmdel.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 46 7B 24 3D 61 9D 85 B8 C3 85 A2 44 1A 62 55"

The process jWcYYUcg.exe:1148 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 60 F3 54 52 D4 11 BF 37 A2 FA 0F 09 74 79 0E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

The process FeEQMIQs.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE BD FE 55 EA 2B 29 87 0F A5 02 17 94 AA 88 C9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

Dropped PE files

MD5	File path
bccfb738a4d238f4ddc6ee4c65b4a0e7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
e4635b34d3510e879837de84e2b7bfee	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
4382f92fd0458e3a87d7ba2295a86746	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
628c03f5200c758af13ff51652aaaac7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
5d0957082d15d9ebd3193b54731731ed	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
8b0685483a86b78d24fd278ef62938c9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
a14a77c2d50a55c6b0ca6ccd0f174a94	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
cd41c2bf0c3c230ff96b903c6d555470	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
4f3d00907c5412dca4268ec321ae0fad	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
12cade2aa3c78775e67a723834362068	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
e5855fc519349792860746dfafd9fcb0	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
deba831b2decfc1cb0663aadd3db92bc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
42a1e4c7c368cac93678382734cc1d97	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
0879b21a1669c7af859aff8f774c5049	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
42db16686e6f9c57d563729820678d2b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
d7b31c10d12b98ce239c09a800e0798b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
47503753ddc2103a20bc32d5dc88658c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
72a74381482ab58cef8dcfa44d038bb9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
0148a90cb0ac3eef0b54f7cf368a58fb	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
4f51c6dff3d20597e31dc9094eae5a82	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
3de47ecb1b9b8aa9ce2733a431b6e9b4	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
1d1f29341722c26a96c1558da2619715	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
5d935bb22d682d17429411876fefdeef	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
72eed8b1767bbcead44a01497609b22f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
b6656cd9bf7a49be5e86d9aa0dcc99dd	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
fc398d8e2fd33e79eaa8a514bc77d69c	c:\Documents and Settings\All Users\BOAMIgUE\jWcYYUcg.exe
50b74bef9e460742bb0dab0a87c68968	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
4d2d3cfe065df04624888b760fa05e44	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
bda99dc222e3248dcd305d260dc9e6ce	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
2f8e1e3baa678cd8b4bf510748fa4ae4	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
2646ea06228b9c9f84ae54038d69ad99	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
78e80a5a3aaee18c8f881121736219a5	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
6510ac004e0821d9c9f9cb68b6788696	c:\Documents and Settings\All Users\hUEQccwo\FeEQMIQs.exe
ee8c7dfb92000ead05d079939ac0f86c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\agrsmdel.exe
b303a16f32ee69ea51fa58d807852fde	c:\Documents and Settings\"%CurrentUserName%"\NwIscAww\rSwooYMM.exe
b2b762031c29448ef95e060c33ee1c12	c:\Perl\eg\IEExamples\ie_animated.gif.exe
0e1f9538773ca3e7982fba74b909d4f2	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
60520ffc78f12ee748399585e69b9228	c:\Perl\eg\aspSamples\ASbanner.gif.exe
1af9cd8697b3a64325dfa97f852db8e2	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
989b5a397172b81472f49273b4b62ca9	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
739787d5ebaee73122622604fb2205a1	c:\Perl\html\images\AS_logo.gif.exe
58f889b030a28960bff076faf3e4dda2	c:\Perl\html\images\PerlCritic_run.png.exe
0eae78e7e01e40bc0eedaadb60c4b1d5	c:\Perl\html\images\aslogo.gif.exe
038e27d68fd2ee5053d0b690b7d5cbe5	c:\Perl\html\images\ppm_gui.png.exe
01c9e1628d1865ff2b265d324c60de8c	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
d962ef9a0102e3cfddb95bb6dbedff30	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
24e1039b93058b31838516ea2485a5d3	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
6cba45d710ecff8dafece221450ebce6	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
456d9717757e7c1960b2998c0da8408a	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
4f6487207fca6c11105a94f86fb3f46e	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
1cf7ed1bd5d1e835ecc1c07de535b3ae	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
b5d2f61a0b43cba3157abbd283d27cb1	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
4a4f2cb039df858879560c8a80cbeb19	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
8f049b7c0081c1f677e9a3b67cc4c414	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
9f2c8c80a7cc7e3abf85a985bae1239e	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
d24bd036e6f89249300d434e5290de61	c:\totalcmd\TCMADMIN.EXE.exe
e1bb882865298141114e041ba4e80d6a	c:\totalcmd\TCMDX32.EXE.exe
bd829713a6402797856e1657765e45a3	c:\totalcmd\TCUNINST.EXE.exe
655914aee7534af092eb20a38f2dfc00	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1792
agrsmdel.exe:440
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe (7833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LckgYsIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\agrsmdel.exe (68 bytes)
%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe (7809 bytes)
%Documents and Settings%\All Users\BOAMIgUE\jWcYYUcg.exe (7809 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\MAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
\\STORAGE2\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeEQMIQs.exe" = "%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rSwooYMM.exe" = "%Documents and Settings%\%current user%\NwIscAww\rSwooYMM.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hUEQccwo\FeEQMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1060864	1059328	5.459	b1808b6897ab08721f09c185c0c503e1
.rdata	1064960	4096	512	2.07004	3972c8c276b06fbcb6178b71be85b699
.data	1069056	4	512	0.056519	f55f813606831f95ad8eca4438515541
.rsrc	1073152	4444	4608	0.824876	dfba4a7fd99ce8f4374b130d3f1220dc

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.112.72

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=M7wXVa7aMuqG8Qfj7YH4BQ

Content-Length: 262

Date: Sun, 29 Mar 2015 08:47:47 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=M7wXVa7aMuqG8Qfj7YH4BQ">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=M7wXVanFMumG8QffnIGAAw

Content-Length: 262

Date: Sun, 29 Mar 2015 08:47:47 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=M7wXVanFMumG8QffnIGAAw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

rSwooYMM.exe_996:

.text

.rdata

@.data

b5.ug

.hFgU

.oe`"

t!.lN-=

t&t%xG

TcPoopUk

') 2ÃŸ

.xXlT '

A%fSx01/

-.xOf(

.Gr6nGTny

/T%x8f3x\

-Ã•O3C]i5

.lUnl

dxGjY4%x(

mNUk.xG

.Gm@tt

dFX.xG

C%uYlI

&%6XG

.Vk\.

k.qNk

%XmTgX

> %XUPC,i

'.Tf-

%X]Q|

.TV]S

rP[.wO

h`2%f%

fR[.wO

.FtjhY

S[.wg

.am$%

fR[.wN

v[[.wI

,[.wG

Uk!F%SEQF

4[.ww

.Al|3

x.pzNbR

fR[.wI

u[[.wI

E8[.wc

]%Cs,

fR[.wH

S[.wl

S[.wu

S[.wx

r/%u.

vQ[.wO

L.WZyu

L[.wl

p[.wu

b.Gr,.

L[.wz

S[.wz

f.KpV

D[.wu

w\[.wL

,[.ws

g%fxM1

,[.wt

fR[.wD

wS[.wJ

ZbXBSsh

|[.wv

P[.wH

U[.wI

wR[.wq

vQ[.wJ

fR[.wL

vV[.wI

-3%x(

l[.wc

|[.wq

cX.SA

*`.VR

S[.wv

,[.wv

R[.wO

L[.wN

e#.TP

,[.wz

Af%d

Q[.wH

wP[.ww

Z[.wy

L[.wv

S[.wp

uY[.wO

5"%xdF

w\[.wy

nP.BE

%co ,

2#C

iTCpb

l[.wv

.cqdT

4[.wc

H'%Uzo}m

&T.cp

b{y.xGy

v[[.wH

.Nfe`

wP[.wz

ht%F:jT

n\[.wy

tQ[.wH

,[.wb

{.lng

w\[.ww

6[.wt

,[.wl

3]9%UA{

,[.wu

p[[.wF

v4[.wG

pKt[.wK

p[.wp

5.fz%

V[.wH

l[.wq

sQ[.wH

w\[.wz

P[.wv

~j-2}|

T=.je2

;bG.YY|

fR[.wE

rU[.wG

/O[.wK

vL[.wG

e\[.wG

\[.wG

WwP[.wp

v".bBal

Microsoft Windows

.ge9F!v

1t%UF

ZwCompactKeys

ntdll.dll

kernel32.dll

oleaut32.dll

user32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global III is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

rSwooYMM.exe_996_rwx_009A0000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

FeEQMIQs.exe_1072:

.text

.rdata

@.data

b5.ug

-b}

LG.Zv]a6mT9

FTpV[

W$v%sai

q%dS)7

ei%u u

%S7c(

>%F"1}

a%CrL`

vaUJ(%s7GB

tt%uE

GÃ™,tX

t-.TUz

].lFS

:-mcQ.Oi

9~.%C

?U.gH

acrt

{0O.YvS

J3%Cv

c.jsSz

di%\.yt

U0.zWVV

r{.ND

[^%X

`,.xl

d.zd8

?%fG]O

}.ENy

3.IAuT

_XE

MN3Ã‹

Hd.oa

.AoZr

Q%D>2

@c.On6

[y.LM

.gozn(

-7$.JB

P.pO0

Windows Internet Explorer

Windows Task Manager

taskmgr.execmd.exetaskkill /F /IM taskmgr.exe /T

agrsmdel.exe

ec.exe

.BZ?X

.BF?X

Microsoft Windows

\J.Te

?TÃ¼rY4

?TÃ¼r\

?TÃ¼r.-

?TÃ¼r

4944444444448

advapi32.dll

shell32.dll