Gen.Variant.Kazy.164827_7d89be22f9 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

cvtres.exe:1652
rundll32.exe:440
mscorsvw.exe:172
vbc.exe:688
dumprep.exe:1848
dumprep.exe:700

The Trojan injects its code into the following process(es):

%original file name%.exe:1272
svchost.exe:1488

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process cvtres.exe:1652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RESB5.tmp (2900 bytes)

The process vbc.exe:688 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.out (1093 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vbcB4.tmp (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.dll (3456 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RESB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vbcB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.dll (0 bytes)

The process dumprep.exe:1848 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER040e.dir00\svchost.exe.hdmp (224604 bytes)

The process dumprep.exe:700 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WER040e.dir00\svchost.exe.mdmp (100055 bytes)

The process %original file name%.exe:1272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.out (267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AppLaunch\App.ine (7547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.0.vb (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.cmdline (200 bytes)
%Documents and Settings%\%current user%\Application Data\VProtect Application.exe (4185 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.out (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.0.vb (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.err (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.cmdline (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zieho6c7.tmp (0 bytes)

Registry activity

The process cvtres.exe:1652 makes changes in the system registry.