arrow_back
search
close

TROJ_SIREFEF.SME

February 12, 2013
 Analysis by: Rhena Inocencio
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

  TECHNICAL DETAILS

File Size:

191,488 bytes

File Type:

EXE

Initial Samples Received Date:

27 Jun 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

  • %Application Data%\{GUID}\@
  • %Windows%\Installer\{GUID}\@
  • %Windows%\Installer\{GUID}\U\00000001.@
  • %Windows%\Installer\{GUID}\U\800000cb.@
  • %Windows%\Installer\{GUID}\U\80000000.@

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

It drops and executes the following files:

  • %Application Data%\{GUID}\n
  • %Windows%\Installer\{GUID}\n

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders:

  • %Windows%\Installer\{GUID}\L
  • %Windows%\Installer\{GUID}\U

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It executes then deletes itself afterward.

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{GUID}\InprocServer32
@ = "%Application Data%\{GUID}\n"

HKEY_CURRENT_USER\CLSID\{GUID}\
InprocServer32
ThreadingModel = "Both"

It modifies the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32
(Default) = "\.\globalroot\systemroot\Installer\{GUI}\n"

(Note: The default value data of the said registry entry is "%System%\wbem\wbemess.dll".)