Trojan.Macas.7

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] '{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}' = 'fffifile.dll'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%PROGRAM_FILES%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] '{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}' = 'csiddll'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Comeventps] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\mnmsrvc] 'Start' = '00000002'

Infects the following executable system files:

<SYSTEM32>\appmgmts.dll

Substitutes the following executable system files:

<SYSTEM32>\mnmsrvc.exe with <SYSTEM32>\mnmsrvc.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

Creates and executes the following:

%TEMP%\Messenger\setup.exe m2_ss
<SYSTEM32>\plifc.exe
%PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
<DRIVERS>\etc\xiaoyao.exe "%PROGRAM_FILES%\svchost.exe"
%TEMP%\ok.exe
<SYSTEM32>\fake.exe
<SYSTEM32>\korux.exe
%TEMP%\syslive_niu2.exe
<SYSTEM32>\korux.exe /service
<DRIVERS>\etc\ctfmon.exe
<DRIVERS>\etc\lsass.exe
<DRIVERS>\etc\alg.exe
<DRIVERS>\etc\hqtray.exe
<DRIVERS>\etc\User3.exe
<DRIVERS>\etc\svchost.exe
<DRIVERS>\etc\taskmgr.exe
<DRIVERS>\etc\smss.exe
<DRIVERS>\etc\xiaoyao.exe

Executes the following:

<SYSTEM32>\cmd.exe /c 375519961O57540.bat
<SYSTEM32>\cmd.exe /c ""%TEMP%\ope6.bat" "" "<DRIVERS>\etc" "taskmgr.exe""
<SYSTEM32>\net1.exe start Comeventps
<SYSTEM32>\cmd.exe /c %TEMP%\Cls.bat
<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\fffifile.dll
<SYSTEM32>\regsvr32.exe "%TEMP%\Messenger\ThunderSafe.dll" /s
<SYSTEM32>\rundll32.exe try4719.dll , InstallMyDll

Installs hooks to intercept notifications

on keystrokes:

Handler for all processes: %PROGRAM_FILES%\avicap.dll

Searches for windows to

bypass Windows Files Protection (WFP):

ClassName: '#32770' WindowName: 'Windows File Protection'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Microsoft Office\SYSTEM\03.exe
%TEMP%\nsa4.tmp\System.dll
%PROGRAM_FILES%\obj.bin
<SYSTEM32>\mssrcid.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
%TEMP%\Messenger\sysmain.dat
%TEMP%\Messenger\setup.exe
%TEMP%\Messenger\sysvc.dat
%TEMP%\ok.exe
%PROGRAM_FILES%\obj.txt
%TEMP%\syslive_niu2.exe
<DRIVERS>\etc\57540.aqq
<DRIVERS>\etc\375519961O57540.bat
%WINDIR%\aaa\solotan.exe
%WINDIR%\aaa\skyxpserver.exe
%WINDIR%\aaa\goooke.exe
%TEMP%\ope6.bat
%TEMP%\Cls.bat
<SYSTEM32>\fake.exe
<SYSTEM32>\Web.ini
%TEMP%\{B8DF0511-8A07-4F3C-B07A-356FC729594F}.txt
<DRIVERS>\etc\User3.exe
<DRIVERS>\etc\xiaoyao.exe
<DRIVERS>\etc\taskmgr.exe
<SYSTEM32>\try4719.dll
<DRIVERS>\etc\smss.exe
<DRIVERS>\etc\alg.exe
<DRIVERS>\etc\svchost.exe
<DRIVERS>\etc\hqtray.exe
<DRIVERS>\etc\ctfmon.exe
<DRIVERS>\etc\lsass.exe
<SYSTEM32>\dllcache\try4719.dll
%TEMP%\Messenger\ThunderSafe.dll
%PROGRAM_FILES%\cfg.bin
%TEMP%\Messenger\ccfapi32.dll
%TEMP%\Messenger\nvsys.ini
%TEMP%\Messenger\ccfapi321.dll
<SYSTEM32>\00000000000188e6680f50.dat
<SYSTEM32>\fffifile.dll
%PROGRAM_FILES%\_tmp.txt
%PROGRAM_FILES%\Windows Media Player\ycbdf.exe

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\obj.bin
%PROGRAM_FILES%\svchost.exe
%PROGRAM_FILES%\cfg.bin
<DRIVERS>\etc\xiaoyao.exe
%PROGRAM_FILES%\Windows Media Player\ycbdf.exe
<SYSTEM32>\00000000000188e6680f50.dat
%PROGRAM_FILES%\avicap.dll
<DRIVERS>\etc\User3.exe

Deletes the following files:

<DRIVERS>\etc\taskmgr.exe
%TEMP%\ok.exe
<DRIVERS>\etc\lsass.exe
<DRIVERS>\etc\57540.aqq
%PROGRAM_FILES%\_tmp.txt
<SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\fake.exe
%TEMP%\nsa4.tmp\System.dll

Moves the following system files:

from <SYSTEM32>\mnmsrvc.exe to <SYSTEM32>\mnmsrvc.exe.bak

Moves the following files:

from %TEMP%\Messenger\sysvc.dat to <SYSTEM32>\korux.exe
from %TEMP%\Messenger\nvsys.ini to <SYSTEM32>\qmjgd.ini
from %TEMP%\Messenger\sysmain.dat to <SYSTEM32>\plifc.exe
from %PROGRAM_FILES%\obj.txt to %PROGRAM_FILES%\avicap.dll
from %PROGRAM_FILES%\obj.txt to %PROGRAM_FILES%\svchost.exe
from %PROGRAM_FILES%\Microsoft Office\SYSTEM\03.exe to %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe

Network activity:

Connects to:

'ad.##595.com':80

TCP:

HTTP GET requests:

ad.##595.com/come/bho.asp

UDP:

DNS ASK ad.##595.com

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: 'Windows ????????'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial