Gen.Variant.Kazy.563771_cfdabe64f3 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

AdobeARM.exe:1512
%original file name%.exe:584

The Trojan injects its code into the following process(es):

NesIMIQs.exe:500
fGAwoYMM.exe:1072
reIEcoQI.exe:1552

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process AdobeARM.exe:1512 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ArmUI.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AdobeARM.log (1308 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ArmUI.ini (0 bytes)

The process %original file name%.exe:584 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7761 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AdobeARM.exe (6400 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IsQkUUMg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IsQkUUMg.bat (0 bytes)

Registry activity

The process NesIMIQs.exe:500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D A0 4F 64 4D B6 61 0D 50 5B E2 0B AA 4A 28 4C"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process fGAwoYMM.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E FA 5C C4 5F 91 1B 6A B2 B0 9B ED 97 E4 E6 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:1552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 42 0B 5C EE BA B2 B3 FE 03 07 6C D4 80 3D 9F"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process AdobeARM.exe:1512 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 FE B9 C9 EE 86 ED 56 4C DC 2C 7A 90 2A F8 38"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Adobe\Adobe ARM\1.0\ARM]
"iLastSvcSuccess"

[HKCU\Software\Adobe\Adobe ARM\1.0\ARM]
"iNotify"

The process %original file name%.exe:584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 FE E6 31 AE A6 A9 9A 86 0F 86 C9 F0 66 90 B0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
cc788b8ded62da2d701d2ff1940b9da0	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
eb8b4ad56cf35c9884eccb60d0e90f86	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
9981c7af30d9fef16c5bffd1cef79c23	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
61d78994fee39d6e48e2ca4c483e5b2c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
8b95258ea705c0300be266d66dbd77b2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
1be5575844285067c9ea2bd13bd8897c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
29da8c918c26be20d8a74c7f3691ce12	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
50fec8745410dc0a1faf05c3f2c89997	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
256dafb5dbfbf8e43b3776f6333ab059	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
f6e854557dda24853c1649fcb154c61c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
7e1a5ca6b22a30bd7a59f4ba7ec7c222	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
ac8f56e38f740e37503c3ab189c85c29	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
d91fff5ce59ff3953b554f7d3de76810	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
4a4eb8575b775588ea70ac3c067fa0d8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
3feb3da07d736dbdb77f6bf77c489db7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
d666514ce43cfbce97e9cbebd3b2a617	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
685ded4b4d793ae5c8a8f71e0bcc9dff	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
f5f6ad87cdb72f08a35ea0f36d583cb8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
f573a51d26555839e9961f43dd1682a1	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
b18338a132637adb4bbc0bb44007b639	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
4a3b6c841b8b8bc9c28ca796d6a784ac	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
556665a993d6e37659048ba2c71a7f7e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
36a0e9756955d08b77af597fa57f9146	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
860ab5b5c215306cdd6b9858a97e023e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
74fa9202fbd56e6e0676e1ddf6750b1e	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
0bd0571af8e28e3dc8cd0487cfb157f4	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
5a5bb2ecbde31ef8925fbefa6f129bcd	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
49af236fd0ee290daef1891289d75672	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
e07f9272d81b759efae90ce94c9fba0d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
36eb83f53768722f6bf1ceca30af9720	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
0d59e9b91237fdb3ed8aceebddb53c1d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
e89a3213b1f83ee87df507dda57f96ba	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
516ddd1bfa7dda43b735d875b0f0667f	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
47ea5f76fab723c61ab4a0d79bad512c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\AdobeARM.exe
624751d10357a625e6a2655e4808dbfe	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
1008bbef525ccede4ed77aeb7b8c6b2c	c:\Perl\eg\IEExamples\ie_animated.gif.exe
0e4946fd67018ce9f85668f41c3e3523	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
a15fad7f8c93534c44a65d13f1b719a9	c:\Perl\eg\aspSamples\ASbanner.gif.exe
080e7b4be5559e2a2162ff805a344b51	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
47716d90d3714945cb1099820cc8b365	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
ab7fb6574a57da3a1adea64f9621e157	c:\Perl\html\images\AS_logo.gif.exe
328f1cbf78a7aff6f14386630d237485	c:\Perl\html\images\PerlCritic_run.png.exe
df5b5ead59257c1f45448b4d86868c90	c:\Perl\html\images\aslogo.gif.exe
fb45e00074e2e95bc288e21954c05414	c:\Perl\html\images\ppm_gui.png.exe
71944c5e7cf9dbb645643c4b95b30661	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
e085e9663e5acae08a6e572a5c76ee24	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
e17bf3d178084b1b24e3166f69b937df	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
6f653fde11c622574b659214dea68afd	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
d7720ac286d49f3d5996bf25b7a2bbbe	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
4b6f8b2aea57913e21755948b9e0c4b5	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
b361363a3ddcf18c80a83de8501d6a91	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
200aa5edfc06a3a834313c8cf7654a74	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
9bf72c07a1e64f4932cdc0a44e40636b	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
c3509dce1018c4231fbfd98c9f7acdfe	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
26c77a3d8950a1d0e488a8025a8b06c9	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
511c2d55fd3d3a36efb163c8790c0e67	c:\totalcmd\TCMADMIN.EXE.exe
f4f24e0c2ca8766bdcf7c141f888ab44	c:\totalcmd\TCMDX32.EXE.exe
cb1621b348a74b8647e4859f63d65916	c:\totalcmd\TCUNINST.EXE.exe
4fa04d60fbc6549b3d6467c0f1bdd604	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
AdobeARM.exe:1512
%original file name%.exe:584
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ArmUI.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AdobeARM.log (1308 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7761 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AdobeARM.exe (6400 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IsQkUUMg.bat (4 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1949696	1947136	5.31499	57273593a36eb11cc9636fe174ba9096
.rdata	1953792	4096	512	2.15094	2972156c185ddda1362b672f173d4d97
.data	1957888	5	512	0.067931	6d948125d16c8e2013f3b1107f8a5d22
.rsrc	1961984	4444	4608	3.47705	2caefe6204a241140411be0308412d28

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	216.58.209.206

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kwwSVZ-zLoyu8weJ44KACA

Content-Length: 262

Date: Wed, 25 Mar 2015 01:17:07 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kwwSVZ-zLoyu8weJ44KACA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kwwSVZ-zLoyu8weJ44KACA..Content-Length: 262..Date: Wed, 25 Mar 2015 01:17:07 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=kwwSVZ-zLoyu8weJ44KACA">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=lQwSVbX-JIqu8wes14G4Bw

Content-Length: 262

Date: Wed, 25 Mar 2015 01:17:09 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=lQwSVbX-JIqu8wes14G4Bw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=lQwSVbX-JIqu8wes14G4Bw..Content-Length: 262..Date: Wed, 25 Mar 2015 01:17:09 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=lQwSVbX-JIqu8wes14G4Bw">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_1072:

.text

.rdata

@.data

7.qU6

TNcMdI

vND.LOrg

.eH^\

w|.LV

QfC%d

dW0WaZ@%di

O%%Sg

[%dZr

l}9fT{

E!.Lg:

\D.vY

m.TpM

.WYky?

?%sn6

.wbK3

Am%foEW

%d[k#

k[w[.dx

Ho%sd^

.pgVM

.XU\:

.TU:67Y[

mre%s

Rx.AF{-F

.dA}R

9zE46}GF{-A}d8

Rx.AMb

Rx.AJ

Vy-A}y1

]~]{:&]{>

Mr.0M8.wM

F@%uF

5@.FJ

r|M-

9Q2.QD

s]{>EkAC.AZ?

]mYS_;-h}_/

%s>Ab

GcMd

7FZZZZ%

&aTF{-A}d8

Rx.AZu`\Vb)

Rx.AN~2

Rx.AF z

x.ASs)

Rx.AF{-6s z

]sc.Pu

).KQ>6V

yT%FZ

d?%x1

u2S.cp

~%m"%U

R.BFX7

.Cd"w

/1:,*-.1

#k%U,

:EW.yY

%cMV=

hC%x}7

.Gl^z

>fAd:%U

.cW a

]{.iA8

8=d0,.eJ

KV.eb

.CYf?a8

=Btcp

Microsoft Windows

{Nb%6x

P:.wX

P:.tYZ

P:\ sm#

P:\C_k#

).Lla!T$

9.Lny!G$

nz.nno?no=no:nl

ntdll.dll

kernel32.dll

user32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global 3 is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

fGAwoYMM.exe_1072_rwx_00401000_000EA000: