TROJ_VB.KCB

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %System Root%\DOCUME~1
• %System Root%\DOCUME~1\ADMINI~1
• %User Profile%\LOCALS~1
• %User Temp%\nsj3.tmp
• %User Profile%\Thinstall\ChordWizard Songtrix Gold 3.0
• %User Profile%\Application Data\Thinstall
• %User Profile%\ChordWizard Songtrix Gold 3.0\4000001600002i
• %User Profile%\ChordWizard Songtrix Gold 3.0\%Profile%
• %User Profile%\%Profile%\Local Settings
• %User Profile%\%Profile%\Cookies
• %User Profile%\History\History.IE5
• %User Profile%\ChordWizard Songtrix Gold 3.0\400000d00002i
• %User Profile%\ChordWizard Songtrix Gold 3.0\%AppData%
• %User Profile%\%AppData%\Microsoft
• %User Profile%\Microsoft\HTML Help

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This Trojan deletes the following files:

• %User Temp%\nsd1.tmp
• %User Temp%\nsj3.tmp
• %User Profile%\ChordWizard Songtrix Gold 3.0\Registry.rw.lck
• %User Profile%\ChordWizard Songtrix Gold 3.0\Registry.tvr.backup

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\nsj2.tmp
• %User Temp%\nsj3.tmp\Portable ChordWizard Songtrix Gold 3.0d.exe
• %User Temp%\nsj3.tmp\Server.exe
• %User Profile%\ChordWizard Songtrix Gold 3.0\Registry.rw.lck.BRIAN-A1E99833F.ffffffff6bc
• %User Profile%\ChordWizard Songtrix Gold 3.0\Registry.rw.tvr.tmp-6bc6bc
• %User Profile%\ChordWizard Songtrix Gold 3.0\Registry.tvr.backup.6c0
• %User Profile%\4000001600002i\Cwsound.exe.6c06bc.tmp
• %Temporary Internet Files%\Content.IE5\index.dat-1724.1728.tmp
• %User Profile%\Cookies\index.dat-1724.1728.tmp
• %User Profile%\History.IE5\index.dat-1724.1728.tmp
• %User Profile%\400000d00002i\Cwhelper.exe.6c06bc.tmp
• %User Profile%\HTML Help\hh.dat-196.1948.tmp
• %User Temp%\~DFdbea.tmp
• %User Temp%\~DFdc09.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7.)

This report is generated via an automated analysis system.