Trojan.Click3.4725

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Bluetooth Software' = '"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'CTFMon' = '"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Apple Push' = '"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RDP Clip Monitor' = '"%APPDATA%\Microsoft\Windows\rdpclip.exe"'

Creates or modifies the following files:

Malicious functions:

Executes the following:

'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 19 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 30 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 16 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' -u node.bot5 -p x -o http://yp###.net:8081 -t 2 -m8
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 8 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 33 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Windows Desktop Gadgets" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""

Modifies file system :

Creates the following files:

%APPDATA%\Microsoft\Windows\~fcdshva.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~injpxur.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~zdjvbph.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~eosqbfw.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~nhilsui.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%APPDATA%\Mozilla\Firefox\msvcr110.dll
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~dhhgirf.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~akanghd.tmp
%APPDATA%\Microsoft\Windows\~yczaath.tmp
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~xnynwfr.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~vwcrrkw.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~yijghlo.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~yzclyvd.tmp

Deletes the following files:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~zdjvbph.tmp
%APPDATA%\Microsoft\Windows\~fcdshva.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~eosqbfw.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~akanghd.tmp
<SYSTEM32>\Restore\MachineGuid.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~dhhgirf.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~injpxur.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\~nhilsui.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~yijghlo.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Microsoft\Windows\~yczaath.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~xnynwfr.tmp
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\plugin-container.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~yzclyvd.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~vwcrrkw.tmp

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: