Trojan.Win32.Swrort_567e45c71e – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:176

The Trojan injects its code into the following process(es):

spoolsv.exe:636

File activity

The process %original file name%.exe:176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\spoolsv.exe (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8XKL8N8T\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OSFK0HBG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AHP4HQKJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVMJQJ2B\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 DE FB 15 94 52 8A 55 EA 29 0B 88 7D D2 56 07"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Msn" = "C:\Windows\system32\Drivers\spoolsv.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:176
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\spoolsv.exe (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8XKL8N8T\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OSFK0HBG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AHP4HQKJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVMJQJ2B\desktop.ini (67 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Msn" = "C:\Windows\system32\Drivers\spoolsv.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	20180	20480	4.18336	e3813cab21782484dae91fcff783ca6d
.data	24576	19584	19968	5.12527	77aa69eb5410927418d55b7c6516171f
.rdata	45056	1032	1536	2.43541	1665546ed03231308c1ca49ed3166cba
.bss	49152	16672	0	0	d41d8cd98f00b204e9800998ecf8427e
.edata	69632	73	512	0.562331	1093b65d31dca17165cb4b81c8a10efd
.idata	73728	1696	2048	2.97431	28485cb22887f073da270fe186b8c860
.rsrc	77824	924	1024	2.43818	75c22e74c7d5cfe6b035105e53a89ced
.reloc	81920	58368	1024	3.75276	9f39025d8ef8620ad5434305a1f59404

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

spoolsv.exe_636:

`.rsrc

SSSh$z@

FVSSh

ddos.syn

ddos.ack

ddos.random

ddos.supersyn

ddos.udp

msn.spread

msn.msg

msn.stats

msn.addcontact

[UDP] Failed to start flood thread, error: <%d>

[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)

[DDoS]: Failed to start flood thread, error: <%d>.

%s Flooding %s:%s for %s seconds

%s Downloading update from: %s to: %s.

%seraseme_%d%d%d%d%d.exe

%s Downloading URL: %s to: %s.

%s address %s added to msn.

%s Thread Activated: Sending Message.

%s Thread Activated: Sending Zipfile.

%s Thread Activated: Sending Zipfile and Message.

%s Visiting Website Now

MSN MSG

%s Failed to parse command.

USER %s * 0 :%s

NICK %s

PASS %s

QUIT %s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

MODE %s %s %s

MODE %s %s

Ping Timeout? (%d-%d)%d/%d

PONG %s

NICK

PRIVMSG

JOIN

icmp.dll

shlwapi.dll

ShellExecuteA

shell32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

user32.dll

kernel32.dll

%s!%s@%s

%s No %s thread found.

%s %s thread stopped. (%d thread(s) stopped.)

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

[DDoS]: Send error: <%d>.

wonk.ack

wonk.syn

%s Done with flood (%iKB/sec).

%s Flooding %s:%s with %s for %s seconds

%s Bad URL or DNS Error, error: <%d>

%s Update failed: Error executing file: %s.

%s Process Finished: "%s", Total Running Time: %s.

%s Created process: "%s", PID: <%d>

%s Failed to create process: "%s", error: <%d>

%s Couldn't parse path, error: <%d>

%s File download: %.1fKB to: %s @ %.1fKB/sec.

A%s Couldn't open file for writing: %s.

[UDP] Finished sending packets to %s

[UDP] Error sending udp packets to %s.

%s Failed to get requested URL from HTTP server.

%s URL visited.

%s Failed to connect to HTTP server.

%s Could not open a connection.

%s Invalid URL.

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

autorunme.exe

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

Infected drive: %s

%s Welcome Bitch.

%s Fail.

%s %s out.

%s <%i> out.

%s No user at: <%i>

%s Invalid slot: <%i>

%s Kill: <%d> threads

%s No threads

%s Killed thread: <%s>

%s %s already running: <%d>.

%s Fail start %s, err: <%d>.

[msn]: Message & Zipfile sent to: %d contacts.

[msn]: Message sent to: %d Contacts.

[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Go fuck yourself %s.

%s logged in.

Removed by: %s!%s@%s

%s main thread

%s mis param.

C:\Windows\system32\Drivers\

spoolsv.exe

*@nasa.gov

ircd.novaraja.org

ircd.grandetrivic.com

GetWindowsDirectoryA

RegCreateKeyExA

RegCloseKey

_acmdln

_amsg_exit

keybd_event

VkKeyScanA

.text

`.rdata

@.data

.rsrc

mGuperQOudpv

[UDP] F

^ror: <%d>_Se

URLwt

VeuWeb

PASSQUIT

-myJOIN

UrlA'O:k`

rGFtpPL

e7P HTTP

up,.eU7

=%SynmR

*@nasa.govX

SKey

5_>keybdv

.MN<?

KERNEL32.DLL

ADVAPI32.dll

MSVCR71.dll

ole32.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

WS2_32.dll

spoolsv.exe_636_rwx_00400000_00052000:

`.rsrc

SSSh$z@

FVSSh

ddos.syn

ddos.ack

ddos.random

ddos.supersyn

ddos.udp

msn.spread

msn.msg

msn.stats

msn.addcontact

[UDP] Failed to start flood thread, error: <%d>

[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)

[DDoS]: Failed to start flood thread, error: <%d>.

%s Flooding %s:%s for %s seconds

%s Downloading update from: %s to: %s.

%seraseme_%d%d%d%d%d.exe

%s Downloading URL: %s to: %s.

%s address %s added to msn.

%s Thread Activated: Sending Message.

%s Thread Activated: Sending Zipfile.

%s Thread Activated: Sending Zipfile and Message.

%s Visiting Website Now

MSN MSG

%s Failed to parse command.

USER %s * 0 :%s

NICK %s

PASS %s

QUIT %s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

MODE %s %s %s

MODE %s %s

Ping Timeout? (%d-%d)%d/%d

PONG %s

NICK

PRIVMSG

JOIN

icmp.dll

shlwapi.dll

ShellExecuteA

shell32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

user32.dll

kernel32.dll

%s!%s@%s

%s No %s thread found.

%s %s thread stopped. (%d thread(s) stopped.)

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

[DDoS]: Send error: <%d>.

wonk.ack

wonk.syn

%s Done with flood (%iKB/sec).

%s Flooding %s:%s with %s for %s seconds

%s Bad URL or DNS Error, error: <%d>

%s Update failed: Error executing file: %s.

%s Process Finished: "%s", Total Running Time: %s.

%s Created process: "%s", PID: <%d>

%s Failed to create process: "%s", error: <%d>

%s Couldn't parse path, error: <%d>

%s File download: %.1fKB to: %s @ %.1fKB/sec.

A%s Couldn't open file for writing: %s.

[UDP] Finished sending packets to %s

[UDP] Error sending udp packets to %s.

%s Failed to get requested URL from HTTP server.

%s URL visited.

%s Failed to connect to HTTP server.

%s Could not open a connection.

%s Invalid URL.

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

autorunme.exe

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

Infected drive: %s

%s Welcome Bitch.

%s Fail.

%s %s out.

%s <%i> out.

%s No user at: <%i>

%s Invalid slot: <%i>

%s Kill: <%d> threads

%s No threads

%s Killed thread: <%s>

%s %s already running: <%d>.

%s Fail start %s, err: <%d>.

[msn]: Message & Zipfile sent to: %d contacts.

[msn]: Message sent to: %d Contacts.

[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Go fuck yourself %s.

%s logged in.

Removed by: %s!%s@%s

%s main thread

%s mis param.

C:\Windows\system32\Drivers\

spoolsv.exe

*@nasa.gov

ircd.novaraja.org

ircd.grandetrivic.com

GetWindowsDirectoryA

RegCreateKeyExA

RegCloseKey

_acmdln

_amsg_exit

keybd_event

VkKeyScanA

.text

`.rdata

@.data

.rsrc

mGuperQOudpv

[UDP] F

^ror: <%d>_Se

URLwt

VeuWeb

PASSQUIT

-myJOIN

UrlA'O:k`

rGFtpPL

e7P HTTP

up,.eU7

=%SynmR

*@nasa.govX

SKey

5_>keybdv

.MN<?

KERNEL32.DLL

ADVAPI32.dll

MSVCR71.dll

ole32.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

WS2_32.dll

spoolsv.exe_636_rwx_004A0000_00023000:

.text

.data

.rdata

@.bss

.edata

@.idata

.rsrc

.reloc

(Y.izCa

w86$V.ii

-0A294}\A

*ns.oX^s'

H%s3\HLw4/ha=

/build/buildd/mingw32-3.4.5.20060117.1.dfsg/build_dir/src/gcc-3.4.5-20060117-1-dfsg/gcc/config/i386/w32-shared-ptr.c

result.exe

GetProcessHeap

KERNEL32.dll

msvcrt.dll

kernel32.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps