Trojan.Downloader.JRBX_0d97c8ce7b

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:308

Mutexes

The following mutexes were created/opened:

RasPbFileCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex

File activity

The process %original file name%.exe:308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\c8cAa97CF\images\loader.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\c8cAa97CF\images\progressbar.gif (588 bytes)

Registry activity

The process %original file name%.exe:308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib]
"(Default)" = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"

[HKCR\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32]
"(Default)" = "c:\%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32]
"(Default)" = "c:\%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0]
"(Default)" = "JSIELib"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib]
"(Default)" = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"

[HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32]
"ServerExecutable" = "c:\%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 14 D1 06 28 4A 87 7F C7 62 F3 4D 96 73 47 85"

[HKCR\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCR\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR]
"(Default)" = "c:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}]
"(Default)" = "TinyJSObject Class"

[HKCR\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}]
"(Default)" = "ITinyJSObject"

[HKCU\Software\Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version]
"(Default)" = "1.0"

[HKCU\Software\WebApp\Styles]
"MaxScriptStatements" = "4294967295"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\c8cAa97CF\images\loader.gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\c8cAa97CF\images\progressbar.gif (588 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Of The
Product Name: Mineral Usual
Product Version: 1.0.0.8
Legal Copyright: All rights reserved for Of The LTD.
Legal Trademarks:
Original Filename: active-boot-disk.exe
Internal Name: active-boot-disk.exe
File Version: 5.1.3.3
File Description: Or Past
Comments:
Language: Language Neutral

Company Name: Of TheProduct Name: Mineral UsualProduct Version: 1.0.0.8Legal Copyright: All rights reserved for Of The LTD.Legal Trademarks: Original Filename: active-boot-disk.exeInternal Name: active-boot-disk.exeFile Version: 5.1.3.3File Description: Or PastComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	135168	132608	4.661	04debfc21317b5fcdd6bfce16a5d01e3
.data	139264	90112	81408	5.48056	2fdfd311f9ce294362f86df1d10fa89a
.rdata	229376	643072	639488	5.52097	c4d4aec5869674cce1644990e267e083
.rsrc	872448	12288	10752	3.19975	22ff9e8291d4b727b4d5ab1bfdcf01ae
.reloc	884736	8192	7168	3.81129	d741828edf64f6e411e002fd52f030bf

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
3766d6493f29bf1fcb80840fb72974f9
27c63d251e6c4f9da118db8667e9afb8
26815b4b0fb8c511b08071e6ae32a9d3
3139495a29163bcf5aea4597b3c4be48
73fa2f9b1bdc2e1a19dfb42bd9a08186
fc6dbe0b7cdd9e7f14f05c2d8681040f
3b9b4fcbd002e8ecbdd60d922418e0c8
df2404e26156d13f654b35c944525334

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_308:

.text

.text

`.data

`.data

.rdata

.rdata

@.rsrc

@.rsrc

@.reloc

@.reloc

=$.hk

=$.hk

=%.hk

=%.hk

=%u{j

=%u{j

IH>%S

IH>%S

hO.Lqb

hO.Lqb

.TCl!

.TCl!

c:\%original file name%.exe

c:\%original file name%.exe

KERNEL32.dll

KERNEL32.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

APPHELP.dll

APPHELP.dll

GetProcessWindowStation

GetProcessWindowStation

CryptDestroyKey

CryptDestroyKey

CryptDuplicateKey

CryptDuplicateKey

COMCTL32.dll

COMCTL32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

a>~0"%x

a>~0"%x

.mSX ,a

.mSX ,a

&e

&XÝe

ey5`m%X,

ey5`m%X,

tØ%!

tØ%!

.Fh.

.Fh.

;k^Ý;Cz

;k^Ý;Cz

%XLu

%XLu

S~%S[

S~%S[

:%F

:%F

F%xyX

F%xyX

%4s24L|

%4s24L|

|!#{@)2>

|!#{@)2>

.RHOA

.RHOA

j.jb}

j.jb}

BXSqlYoF

BXSqlYoF

@c.SL

@c.SL

(bK.aw.]N

(bK.aw.]N

3Vk%ft

3Vk%ft

|g.BY

|g.BY

.rG\F

.rG\F

ßHW

ßHW

Y\.Wmx

Y\.Wmx

J:\Fi

J:\Fi

ymh.kjhJ

ymh.kjhJ

II$%S)

II$%S)

'-oB}

'-oB}

CMd@Cl

CMd@Cl

@t:%fM

@t:%fM

A%F

A%F

".lY3

".lY3

.Ojwn

.Ojwn

9.lNy>RF

9.lNy>RF

.yi|}

.yi|}

ka.PMO

ka.PMO

n.bA.

n.bA.

k|(,%x

k|(,%x

5.qo"

5.qo"

Z!.ey

Z!.ey

.aM}cY

.aM}cY

lX:%C

lX:%C

tB.BC

tB.BC

g8.QOt

g8.QOt

UKASQLIu

UKASQLIu

>gK.sE

>gK.sE

p0!%x

p0!%x

U%u*"

U%u*"

K7.Ba;

K7.Ba;

{y.bv

{y.bv

.nZkf

.nZkf

|yw.ic_

|yw.ic_

?dK%.vjc

?dK%.vjc

Re.Hf

Re.Hf

.uyD1

.uyD1

stdole2.tlbWWW

stdole2.tlbWWW

Created by MIDL version 7.00.0555 at Thu Sep 11 23:13:06 2014

Created by MIDL version 7.00.0555 at Thu Sep 11 23:13:06 2014

ssssssssssssssssssssssssssssshhhhhhsssss

ssssssssssssssssssssssssssssshhhhhhsssss

sssssssssssssssssssssssssssh

sssssssssssssssssssssssssssh

ssssssssssssssssssssssssssh2

ssssssssssssssssssssssssssh2

sssssssssssssssssssssssssh

sssssssssssssssssssssssssh

sssssssssssssssssssssssssh2

sssssssssssssssssssssssssh2

ssssssssssssssssssssssssh

ssssssssssssssssssssssssh

ssssssssssssssssssssssssh2

ssssssssssssssssssssssssh2

hhhhhssssssssssssssssssssh

hhhhhssssssssssssssssssssh

hsssssssssssssssssssh2

hsssssssssssssssssssh2

hssssssssssssssssssh

hssssssssssssssssssh

hssssssssssssssssssh2

hssssssssssssssssssh2

222222222

222222222

22222222222222

22222222222222

5a6;6]6

5a6;6]6

848>8{8}:

848>8{8}:

32.exe

32.exe

combase.dll

combase.dll

mscoree.dll

mscoree.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

kernel32.dll

kernel32.dll

2USER32.DLL

2USER32.DLL

5.1.3.3

5.1.3.3

active-boot-disk.exe

active-boot-disk.exe

1.0.0.8

1.0.0.8

%original file name%.exe_308_rwx_00D20000_00002000:

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

'()*#$%&

'()*#$%&

>?:;

>?:;