TROJ_MONKIF.AA

This Trojan may be dropped by other malware.

It may be injected into processes running in memory.

Arrival Details

This Trojan may be dropped by other malware.

Installation

This Trojan adds the following mutexes to ensure that only one of its copies runs at any one time:

• Local\UIEI

It may be injected into processes running in memory.

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• AAWService.exe
• AAWTray.exe
• ABregmon.exe
• ACAAS.exe
• ACAEGMr.exe
• ACAIS.exe
• ACALS.exe
• ACASP.exe
• ACenter.exe
• AFMain.exe
• AGB6.exe
• AGBKrnl.exe
• AGIDSUI.exe
• ALMon.exe
• ALive.exe
• ALsvc.exe
• APVXDWIN.EXE
• ARCATA~1.EXE
• AScheduleService.exe
• AVGIDSAgent.exe
• AVGIDSMonitor.exe
• AVGIDSWatcher.exe
• AVKProxy.exe
• AVKService.exe
• AVKTray.exe
• AVKWCtl.exe
• AVMenu.exe
• Ad-Aware.exe
• AhnSD.exe
• AhnSDsv.exe
• AluSchedulerSvc.exe
• ApVxdWin.exe
• ArcaBackupService.exe
• ArcaBit.Core.Configurator2.exe
• ArcaRemoteSvc.exe
• Arcabit.Core.LoggingService.exe
• BDTUpdateService.exe
• CAGlobal.exe
• CAGlobalLight.exe
• CAPPActiveProtection.exe
• CCSVCHST.EXE
• CClaw.exe
• CONSCTL.exe
• CounterSpy.exe
• EMLPROUI.EXE
• EMLPROXY.EXE
• FAMEH32.exe
• FCH32.exe
• FPAVServer.exe
• FProtTray.exe
• FSM32.exe
• FSMA32.exe
• FSMB32.exe
• FileMonSV.exe
• ForceField.exe
• GDFirewallTray.exe
• GDFwSvc.exeray.exe
• GDSC.exe
• GDScan.exe
• HFACSvc.exe
• HrRes.exe
• IFace.exe
• ISWSVC.exe
• ITMRTSVC.exe
• K7EmlPxy.exe
• K7FWSrvc.exe
• K7PSSrvc.exe
• K7RTScan.exe
• K7SysMon.exe
• K7SysTry.exe
• K7TSMngr.exe
• K7TSecurity.exe
• KVMonXp.kxpxe
• KVSrvXP.exe
• KVXp.kxpkxp
• MAILDISP.EXE
• MSASCui.exe
• MSProxy.ahn
• MWAGENT.exe
• MWASER.exe
• McNASvc.exe
• McProxy.exe
• McSACore.exe
• Mcshield.exe
• MpfSrv.exe
• MsMpEng.exe
• Nbrowser.exe
• NetMonSV.exe
• Nip.exe
• Njeeves.exe
• Nsesvc.exe
• Nvcoas.exe
• ONLINENT.EXE
• ONLNSVC.exe
• OPSSVC.exe
• OcHealthMon.exe
• PAVSRV51.EXE
• PPCtlPriv.exe
• PSANHost.exe
• PSHost.exe
• PSUNMain.exe
• PXAgent.exe
• PXConsole.exe
• PavBckPT.exe
• PavFnSvr.exe
• PavPrSrv.exe
• PslmSvc.exe
• QOELoader.exe
• QUHLPSVC.EXE
• RavMon.exe
• RavTask.exe
• RsTray.exe
• SAVAdminService.exe
• SBAMSvc.exe
• SBAMTray.exe
• SBCSSvc.exe
• SBCSTray.exe
• SCANMSG.exe
• SCANWSCS.exe
• SSU.exe
• SSU.exeperUI.exe
• SavService.exe
• SfCtlCom.exe
• SpIDerAgent.exe
• SpIDerMI.exe
• SpySweeper.exe
• SpySweeperUI.exe
• SpybotSD.exe
• TDWatch.exe
• TFService.exe
• THAV.exe
• THD32.exe
• THSM.exe
• TMBMSRV.exe
• TRAYSSER.EXE
• TRYICOS.exe
• TSCFCommander.exe
• TSCFPlatformCOMSvr.exe
• TeaTimer.exe
• TmPfw.exe
• TmProxy.exe
• UPSCHD.exe
• UfNai.exe
• UfSeAgnt.exe
• UfUpdUi.exe
• UmxAgent.exe
• UmxCfg.exe
• UmxFwHlp.exe
• UmxPol.exe
• VMwareService.exe
• VMwareTray.exe
• VMwareUser.exe
• WEBPROXY.EXE
• WRConsumerService.exe
• WinSSUI.exe
• Zanda.exe
• Zlh.exe
• a2guard.exe
• a2services.exe
• a2start.exe
• acs.exe
• arcarvir.exe
• ashDisp.exe
• ashMaiSv.exe
• ashServ.exe
• ashWebSv.exe
• aswUpdSv.exe
• avas.exe
• avcom.exe
• avesvc.exe
• avgam.exe
• avgamsvr.exe
• avgas.exe
• avgcc.exe
• avgcsrvx.exe
• avgemc.exe
• avgfws8.exe
• avgnsx.exe
• avgrsx.exe
• avgtray.exe
• avgui.exe
• avgupd.exe
• avgupsvc.exe
• avgwdsvc.exe
• avgwsvc.exe
• avinitnt.exe
• avmgma.exe
• avp.exe
• avpmapp.exe
• avtray.exe
• avwebgrd.exe
• caavguiscan.exe
• capfasem.exe
• cappactiveprotection.exe
• casc.exe
• casecuritycenter.exe
• cavrid.exe
• ccSvcHst.exe
• ccschedulersvc.exe
• cctray.exe
• cfp.exe
• cmdagent.exe
• drwebscd.exe
• dvpapi.exe
• dvprpt.exe
• econceal.exe
• econser.exe
• egui.exe
• ekrn.exe
• elogsvc.exe
• escanmon.exe
• forsp.exe
• fsaua.exe
• fsav32.exe
• fsavgui.exe
• fsdfwd.exe
• fsgk32.exe
• fsgk32st.exe
• fsguidll.exe
• fspc.exe
• fsqh.exe
• fssm32.exe
• fsus.exe
• gozer.exe
• guard.exe
• guardxkickoff.exe
• guardxservice.exe
• guardxup.exe
• hcontain.exe
• hpcsvc.exe
• hsvcmod.exe
• isafe.exe
• kavstart.exe
• kissvc.exe
• kmailmon.exe
• kpfw32.exe
• kpfwsvc.exe
• kwatch.exe
• livesrv.exe
• mcagent.exe
• mcmscsvc.exe
• mcshell.exe
• mcsysmon.exe
• mcupdmgr.exe
• mcvsmap.exe
• mcvsshld.exe
• mdmcls32.exe
• msfwsvc.exe
• msksrver.exe
• msseces.exe
• npcsvc32.exe
• npfsvc32.exe
• npfuser.exe
• nprosec.exe
• nuaa.exe
• nvcsched.exe
• nvoy.exe
• op_mon.exe
• pctsAuxs.exe
• pctsGui.exe
• pctsSvc.exe
• pctsTray.exe
• prevx.exe
• psksvc.exe
• qhfw.exe
• rsnetsvr.exe
• sbamui.exe
• seccenter.exe
• spiderml.exe
• spidernt.exe
• spidersgate.exe
• spiderui.exe
• svcprs32.exe
• symlcsvc.exe
• syssvcnt.exe
• tpcfg.exe
• tppfdmm.exe
• tptray.exe
• uiscan.exe
• untray.exe
• vba32ldr.exe
• vbcmserv.exe
• vbsystry.exe
• vetmsg.exe
• virCatch.exe
• virusutilities.exe
• vmacthlp.exe
• vrfwsock.exe
• vrfwsvc.exe
• vrmonnt.exe
• vrmonsvc.exe
• vrrepair.exe
• vrscan.exe
• vsmon.exe
• vsserv.exe
• winss.exe
• winssnotify.exe
• xcommsvr.exe
• zlclient.exe

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}.{BLOCKED}.7.152
• www.{BLOCKED}edia.com
• www.{BLOCKED}ies.com

NOTES:

It creates the following registry entries to install itself as an MIME filter for Internet Explorer:

HKEY_CURRENT_USER\Software\Classes\PROTOCOLS\Filter\text/html
(Default} = "Microsoft Improved HTML MIME Filter"

HKEY_CURRENT_USER\Software\Classes\PROTOCOLS\Filter\text/html
CLSID = {Random UUID}

HKEY_CURRENT_USER\Software\CLSID\{Random UUID}\InProcServer32
(Default) = "{Malware Path and File Name}"

HKEY_CURRENT_USER\Software\CLSID\{Random UUID}\InProcServer32
ThreadingModel = "Apartment"