TROJ_MAXIMUS.HU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\{random name}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Program Files%\Common files\Microsoft Shared\OFFICE12

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This Trojan creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
PathName = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
1001 = "%SystemRoot%\system32\mswsock.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
1002 = "%SystemRoot%\system32\mswsock.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
1003 = "%SystemRoot%\system32\mswsock.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
1004 = "%SystemRoot%\system32\rsvpsp.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\mswsock32
1005 = "%SystemRoot%\system32\rsvpsp.dll"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000001
PackedCatalogItem = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL {hex values}"

(Note: The default value data of the said registry entry is {Default values}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000002
PackedCatalogItem = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL {hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000003
PackedCatalogItem = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL {hex values}"

(Note: The default value data of the said registry entry is {Default values}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000004
PackedCatalogItem = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL {hex values}"

(Note: The default value data of the said registry entry is {Default values}.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinSock2\Parameters\
Protocol_Catalog9\Catalog_Entries\000000000005
PackedCatalogItem = "%Program Files%\Common Files\Microsoft Shared\OFFICE12\MSO32.DLL {hex values}"

(Note: The default value data of the said registry entry is {Default values}.)

Dropping Routine

This Trojan drops the following files:

• %Program Files%\Common files\Microsoft Shared\OFFICE12\MSO32.DLL

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Other Details

This Trojan deletes the initially executed copy of itself