Trojan.Win32.Inject.euxi (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.Win32.IEDummy.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, Worm.Win32.AutoIt.FD, WormRebhip.YR, WormAutoItGen.YR, GenericInjector.YR, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Worm, VirTool, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 740c09e9b968c9a6ff4b22d234ae7f67
SHA1: de480822f4055b7930e5fd469990c35834cad3e9
SHA256: 10a35cf58aca668fa6e2b9255caeb5eb7b3e14d4ca8e5d7306e5151820beb720
SSDeep: 24576: RmJkcoQricOIQxiZY1ia/M86t0flZctX7IJaXl:rJZoQrbTFZY1ia/M8tOLp
Size: 1039688 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: QuickSet
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
Firefox-Agent.exe:204
Firefox-Agent.exe:948
%original file name%.exe:1676
%original file name%.exe:1516
The Worm injects its code into the following process(es):
iexplore.exe:656
File activity
The process Firefox-Agent.exe:204 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3481 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
The process %original file name%.exe:1676 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Program Files%\Mozilla\Firefox-Agent.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (236 bytes)
The process %original file name%.exe:1516 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\msupd.exe (196 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
The process iexplore.exe:656 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (11888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (16 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (0 bytes)
Registry activity
The process Firefox-Agent.exe:204 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 FF F9 C0 4C 0B C9 95 AA C3 19 E3 3E A5 EC 5E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process Firefox-Agent.exe:948 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 F9 30 B3 A3 C7 90 47 CB 42 00 6F AF CF 7B 83"
The process %original file name%.exe:1676 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 0D 1B 1A 9E 96 5A 6A CB 8C 22 CC 1B 67 1E F7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Videocodec" = "%Program Files%\Mozilla\Firefox-Agent.exe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{AVWH7X33-5AD2-8J13-G548-08KS7PQ4325X}]
"StubPath" = "%Program Files%\Mozilla\Firefox-Agent.exe Restart"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Videocodec" = "%Program Files%\Mozilla\Firefox-Agent.exe"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"
The process %original file name%.exe:1516 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8B 7E B1 7E 54 BD AF DB 9F FD 99 B2 A4 40 57"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process iexplore.exe:656 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 4A 2D 4A D7 E4 28 D9 92 FC 1E C4 5F 17 72 7E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Mozilla]
"Firefox-Agent.exe" = "Firefox-Agent"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\new34]
"NewIdentification" = "new34"
"FirstExecution" = "22/12/2013 -- 09:20"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
"ProxyBypass" = "1"
Network activity (URLs)
No activity has been detected.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
Firefox-Agent.exe:204
Firefox-Agent.exe:948
%original file name%.exe:1676
%original file name%.exe:1516 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3481 bytes)
%Program Files%\Mozilla\Firefox-Agent.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\msupd.exe (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (11888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (16 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.