TROJ_EXPLOYT.YZS

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops and executes the following files:

• %User Temp%\{malware name and extension} - nonmalicious .RTF file

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This Trojan modifies the following file(s):

• {malware path and file name} - modifies itself into a normal file

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Office\{office version}\Word\
Resiliency\StartupItems

Dropping Routine

This Trojan drops the following files:

• %User Temp%\word.exe - detected as BKDR_PROXY.YZS

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It takes advantage of the following software vulnerabilities to drop malicious files:

• (MS12-027) Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

More information on this vulnerability can be found below:

• CVE-2012-0158