Trojan.Win32.FlyStudio_45d93e6f1b

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1852
regedit.exe:1240
regedit.exe:892
attrib.exe:452
taskkill.exe:1244

The Trojan injects its code into the following process(es):No processes have been created.

File activity

The process %original file name%.exe:1852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\system\addis\svchost.reg (332 bytes)
%System%\addis\svchost.exe (3830 bytes)
%WinDir%\wsjv9nG.bat (1 bytes)
%WinDir%\system\addis\svchost.exe (3830 bytes)

Registry activity

The process %original file name%.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 0F 09 17 A4 D3 B4 95 CD C6 9C C9 59 6D 49 B8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

The process regedit.exe:1240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 AA BD 4F D6 BC 1C CB 2E 09 F1 79 9C EB E9 25"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]
"Startup" = "EventStartup"
"Asynchronous" = "1"
"Impersonate" = "0"
"DllName" = "wminotify.dll"

The process regedit.exe:892 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 D9 AD C8 E6 16 3A E0 06 3C 7A AC C1 E6 B7 1E"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"360safe" = "c:\windows\system32\addis\svchost.exe"

The process attrib.exe:452 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F C5 B1 93 E7 97 8D 35 A4 A4 30 6C 58 51 6D 76"

The process taskkill.exe:1244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 7B 6C 4C 1D 10 63 8E 1B 25 33 21 56 F5 21 9C"

Dropped PE files

MD5	File path
890b163514ac2019b05832e6968ad21d	c:\WINDOWS\system32\addis\svchost.exe
9e23b782c099d1ff851c1a14ba86d567	c:\WINDOWS\system32\wminotify.dll
890b163514ac2019b05832e6968ad21d	c:\WINDOWS\system\addis\svchost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1852
   regedit.exe:1240
   regedit.exe:892
   attrib.exe:452
   taskkill.exe:1244

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %WinDir%\system\addis\svchost.reg (332 bytes)
   %System%\addis\svchost.exe (3830 bytes)
   %WinDir%\wsjv9nG.bat (1 bytes)
   %WinDir%\system\addis\svchost.exe (3830 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "360safe" = "c:\windows\system32\addis\svchost.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1019904	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1024000	421888	421888	5.48538	5480885fdc8a9dccf2d89510b79a55e4
.rsrc	1445888	32768	31744	3.32549	ff751478b7bf41bbd819efe1604707fe

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
062bfc362f28aca2234b9653b28e7226

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_1840:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u.hLvJ

u.hLvJ

.tTPV

.tTPV

FTPjK

FTPjK

FtPj;

FtPj;

F.PjRWj

F.PjRWj

u.hX&I

u.hX&I

u.WWj

u.WWj

u.VVj

u.VVj

u$SShe

u$SShe

wininet.dll

wininet.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

EnumWindows

EnumWindows

@.reloc

@.reloc

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

GetCPInfo

GetCPInfo

Hookmsgina.dll

Hookmsgina.dll

msgina.dll

msgina.dll

\boot.dat

\boot.dat

%d/%d/%d/%d:%d:%d

%d/%d/%d/%d:%d:%d

7"72787|7"8

7"72787|7"8

%System%\wminotify.dll

%System%\wminotify.dll

%System%\On.reg

%System%\On.reg

regedit -s %System%\On.reg

regedit -s %System%\On.reg

%System%\boot.dat

%System%\boot.dat

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber

http://www.ip138.com/ips.asp?ip=

http://www.ip138.com/ips.asp?ip=

smtp.163.com

smtp.163.com

a5961846@163.com

a5961846@163.com

szlgg_163@163.com

szlgg_163@163.com

Pass =

Pass =

OldPass =

OldPass =

http://www.net.cn/static/customercare/yourIP.asp

http://www.net.cn/static/customercare/yourIP.asp

http://

http://

https://

https://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

http=

HTTP/1.1

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

F%*.*f

F%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

portuguese-brazilian

portuguese-brazilian

RASAPI32.dll

RASAPI32.dll

iphlpapi.dll

iphlpapi.dll

SHLWAPI.dll

SHLWAPI.dll

MPR.dll

MPR.dll

WINMM.dll

WINMM.dll

WS2_32.dll

WS2_32.dll

VERSION.dll

VERSION.dll

GetProcessHeap

GetProcessHeap

WinExec

WinExec

GetWindowsDirectoryA

GetWindowsDirectoryA

GetKeyState

GetKeyState

GetKeyboardLayout

GetKeyboardLayout

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

COMCTL32.dll

COMCTL32.dll

WSOCK32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

WININET.dll

WININET.dll

CreateDialogIndirectParamA

CreateDialogIndirectParamA

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

comdlg32.dll

comdlg32.dll

.PAVCException@@

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.prn)|*.prn|

(*.*)|*.*||

(*.*)|*.*||

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

User32.dll

User32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

: %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

out.prn

out.prn

%d.%d

%d.%d

%d / %d

%d / %d

%d/%d

%d/%d

Bogus message code %d

Bogus message code %d

(%d-%d):

(%d-%d):

%ld%c

%ld%c

HTTP/1.0

HTTP/1.0

%s <%s>

%s <%s>

Reply-To: %s

Reply-To: %s

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

Cc: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

%a, %d %b %Y %H:%M:%S

HELO %s

HELO %s

SMTP

SMTP

AUTH LOGIN

AUTH LOGIN

LOGIN

LOGIN

AUTH=LOGIN

AUTH=LOGIN

EHLO %s

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

MAIL FROM:<%s>

RCPT TO:<%s>

RCPT TO:<%s>

Service Pack %d

Service Pack %d

Windows 2003

Windows 2003

Windows XP

Windows XP

Windows 2000

Windows 2000

Windows NT

Windows NT

Windows ??

Windows ??

Windows Millenium Edition

Windows Millenium Edition

Windows 98 Second Edition

Windows 98 Second Edition

Windows 98 SP1

Windows 98 SP1

Windows 98

Windows 98

Windows 95 OSR2

Windows 95 OSR2

Windows 95 SP1

Windows 95 SP1

Windows 95

Windows 95

Windows CE

Windows CE

Windows

Windows

Microsoft Windows Me

Microsoft Windows Me

Microsoft Windows 98

Microsoft Windows 98

Microsoft Windows 95

Microsoft Windows 95

Microsoft Windows 2003

Microsoft Windows 2003

Microsoft Windows XP

Microsoft Windows XP

Microsoft Windows 2000

Microsoft Windows 2000

Microsoft Windows NT

Microsoft Windows NT

KERNEL32.DLL

KERNEL32.DLL

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCArchiveException@@

zcÁ

zcÁ

%System%\addis\svchost.exe

%System%\addis\svchost.exe

#include "l.chs\afxres.rc" // Standard components

#include "l.chs\afxres.rc" // Standard components

%#.ippqrvvvu

%#.ippqrvvvu

User = %s

User = %s

Domain = %s

Domain = %s

Pass = %s

Pass = %s

OldPass = %s

OldPass = %s

5.1.2600.2180

5.1.2600.2180

termsrv.exe

termsrv.exe

wminotify.dll

wminotify.dll

Microsoft(R) Windows(R) Operating System

Microsoft(R) Windows(R) Operating System

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

Windows Registry Editor Version 5.00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]

"DllName"="wminotify.dll"

"DllName"="wminotify.dll"

(*.*)

(*.*)