TROJ_FAKESYS.AJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System Root%\Documents and Settings\All Users\Application Data\{random filename2}.exe - detected as TROJ_FAKESYS.AK

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\{random filename1}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following non-malicious file:

• %System Root%\Documents and Settings\All Users\Application Data\{random filename2}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %User Temp%\smtmp
• %User Temp%\smtmp\1
• %User Temp%\smtmp\2
• %User Temp%\smtmp\3
• %User Temp%\smtmp\4

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random filename1} = "%System Root%\Documents and Settings\All Users\Application Data\{random filename1}.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Control Panel
7f6b3266-31c5-43a8-9547-e7911ad6fb33 = ""

HKEY_CURRENT_USER\Control Panel
nsreg = "{hex value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDesktop = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = "1"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = "no"

(Note: The default value data of the said registry entry is yes.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

Rootkit Capabilities

This malware does not have rootkit capabilities.

Other Details

This Trojan deletes the initially executed copy of itself

This malware moves specific files in the following directories:

Operating System major version is 6 (Vista, 2008, 7)
From: %System Root%\ProgramData\Start Menu\
To: %User Temp%\smtmp\1\
From: %User Profile%\Application Data\Roaming\Microsoft\Internet Explorer\Quick Launch\
To: %User Temp%\smtmp\2\
From: %User Profile%\Application Data\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\
To: %User Temp%\smtmp\3\
From: %System Root%\ProgramData\Desktop\
To: %User Temp%\smtmp\4\

It also modifies the attributes of files found in the affected system into Hidden, to trick the users that the files have been deleted.