HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Win32.SuspectCrc!IK (Emsisoft), Worm.Win32.Ainslot.VB.FD, GenericAutorunWorm.YR, WormAinslot_VariantOfZeus.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 6e963b4521b280362f3a3f80e43b23fd
SHA1: a3379cd5573f286f0a4295d014d4b664a162f8a1
SHA256: 3807e2c7dc5bc23db9ebe175b1f6c34dd939827b96387aa3ed330b2f85a255f5
SSDeep: 6144:GKWFPj0Xw6smbqBH1gzcvWYoqxXCI/uNNDUtOIfpz:Gxa9qbwnYoqxE0J
Size: 289792 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: SummerSoft
Created at: 2012-11-27 08:24:36
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
reg.exe:388
reg.exe:384
reg.exe:1692
reg.exe:864
6e963b4521b280362f3a3f80e43b23fd.exe:1872
The Worm injects its code into the following process(es):
cvtres.exe:408
File activity
The process cvtres.exe:408 makes changes in a file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\keys (33 bytes)
%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe (35 bytes)
The process 6e963b4521b280362f3a3f80e43b23fd.exe:1872 makes changes in a file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe (35 bytes)
Registry activity
The process reg.exe:388 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A B4 FA 2F 93 F1 39 7C C7 D4 38 EB 93 F8 E6 80"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process reg.exe:384 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 B0 5D 46 AC 11 D8 39 62 F5 82 7E A5 34 AF 53"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"I3KV032IKW.exe" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe:*:Enabled:Windows Messanger"
The process reg.exe:1692 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 9E BD 9A 4A BF B3 18 69 D9 EF A4 CA 6B EC 27"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"cvtres.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe:*:Enabled:Windows Messanger"
The process reg.exe:864 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 20 19 47 5F 95 21 9F EC 0A AC CD 99 43 40 C8"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
The process cvtres.exe:408 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 FD 7A 5E F6 FA CA 86 C0 4D 85 C7 65 A7 98 9E"
[HKCU\Software\Microsoft\Active Setup\Installed Components\{DF9E44FA-4EED-F62E-EEDF-3C770D2DBFDF}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"SXGJ275OCC" = "September 17, 2013"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{DF9E44FA-4EED-F62E-EEDF-3C770D2DBFDF}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"SXGJ275OCC" = "omegle"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
The process 6e963b4521b280362f3a3f80e43b23fd.exe:1872 makes changes in a system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 12 B5 64 7F 0D 4D 18 40 09 43 A7 78 A3 68 F3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
Network activity (URLs)
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
reg.exe:388
reg.exe:384
reg.exe:1692
reg.exe:864
6e963b4521b280362f3a3f80e43b23fd.exe:1872 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\keys (33 bytes)
%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cvtres.exe (35 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Live" = "%Documents and Settings%\%current user%\Application Data\I3KV032IKW.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.