TROJ_KAZY.TP

This Trojan opens a certain registry key. It then queries the data under a specific value for the subkeys under a certain key. For the paths that it finds, it will append a certain line. It will then create certain folders under the found paths. It also creates non-malicious files.

This Trojan may hijack search results. It affects the Mozilla Firefox browser and specifically targets certain search engines.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\{random file name}32.dll - also detected as TROJ_KAZY.TP
• %System%\1243398548 - non-malicious file

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\{random file name}32.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}32
ImagePath = "%System%\{random file name}32.exe"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CLASSES_ROOT\CLSID\{random CLSID}\
InprocServer32
(default) = "%System%\{random file name}32.dll"

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{random CLSID}

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
XMLHTTP_UUID_Default = "{hex values}"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Internet Explorer\Main
XMLHTTP_UUID_Default = "{hex values}"

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\.fsharproj

HKEY_CLASSES_ROOT\Hrkkdxtnkr

HKEY_CLASSES_ROOT\CLSID\{random CLSID}

HKEY_CLASSES_ROOT\Software\Hrkkdxtnkr

HKEY_CURRENT_USER\Software\Hrkkdxtnkr

HKEY_USERS\.DEFAULT\Software\
Hrkkdxtnkr

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• chrome.exe

NOTES:

It opens the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\ProfileList

It then queries the data under the value "ProfileImagePath" for the subkeys under the said key. For the paths that it finds, it will append the following:

• \Application Data\Mozilla\Firefox\Profiles\*

It will then create the following folders under the found paths:

• \extensions\{random CLSID for Firefox}
• \extensions\{random CLSID for Firefox}\chrome
• \extensions\{random CLSID for Firefox}\defaults
• \extensions\{random CLSID for Firefox}\defaults\preferences

For example:

• %User Profile%\Application
  Data\Mozilla\Firefox\Profiles\{random}.default\extensions\{ab2b9058-b165-4c0e-994c-4669ed0054d4}

It also creates the following non-malicious files:

• %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}.default\extensions\{random CLSID for Firefox}\chrome\xulcache.jar
• %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}.default\extensions\{random CLSID for Firefox}\chrome.manifest
• %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}.default\extensions\{random CLSID for Firefox}\defaults\preferences\xulcache.js
• %User Profile%\Application Data\Mozilla\Firefox\Profiles\{random}.default\extensions\{random CLSID for Firefox}\install.rdf

It does the same routine for the following:

• \Local Settings\Application Data\Google\Chrome\User Data\Default

It then creates the following folder:

• %Application Data%\Google\Chrome\User Data\Default\Default\{random folder name}

It then creates the following non-malicious files:

• %Application Data%\Google\Chrome\User Data\Default\Default\{random folder name}\contentscript.js
• %Application Data%\Google\Chrome\User Data\Default\Default\{random folder name}\manifest.json

It may hijack search results. It affects the Mozilla Firefox browser and specifically targets the following search engines:

• AOL
• Ask
• Bing
• Google
• Yahoo!