TROJ_TRACUR.VY

This Trojan downloads updated copies of itself from certain websites.

It redirects searches to a specific IP address if the search engine URL contains certain strings.

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\{random file name}.exe
• %System%\midimap32.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following files:

• %System%\avmeter32.dll - detected by Trend Micro as TROJ_TRACUR.VY
• %System%\shmedia32.dll - detected by Trend Micro as TROJ_TRACUR.VY
• %System%\shmedia32.exe - detected by Trend Micro as TROJ_TRACUR.VY
• %User Profile%\Application Data\SysWin\lsass.exe - detected by Trend Micro as TROJ_TRACUR.VY

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious files:

• %System%\1652938413

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %User Profile%\Application Data\SysWin

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
DisplayName = "Performance Logs and Alerts"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
ImagePath = "%System%\{random file name}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}
Type = 10

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "%System%\shmedia32.dll"

(Note: The default value data of the said registry entry is "".)

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{05B1982F-0479-4E6F-9CA5-E8F41FAE4907}

HKEY_CLASSES_ROOT\CLSID\{05B1982F-0479-4E6F-9CA5-E8F41FAE4907}

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{05B1982F-0479-4E6F-9CA5-E8F41FAE4907}\
InprocServer32
(Default) = "%System%\avmeter32.dll"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random key}

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\.fsharproj

HKEY_CLASSES_ROOT\Cfbbbjkdkl

HKEY_CLASSES_ROOT\CLSID\{8efad686-2433-4cc7-9f23-929dfe22d792}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG

It adds the following registry entries:

HKEY_CURRENT_USER\Identities
Curr version = "35"

HKEY_CURRENT_USER\Identities
Last Date = "{date of last execution}"

HKEY_CURRENT_USER\Identities
Send Inst = "ok"

HKEY_CURRENT_USER\Identities
Inst Date = "{date of installation}"

HKEY_CURRENT_USER\Identities
Popup count = "0"

HKEY_CURRENT_USER\Identities
Popup time = "0"

HKEY_CURRENT_USER\Identities
Popup date = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
XMLHTTP_UUID_Default = {random numbers}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableFileTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableConsoleTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
FileTracingMask = ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
ConsoleTracingMask = ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
MaxFileSize = 100000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
FileDirectory = "%windir%\tracing"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
982bc1da = {random numbers}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\{random file name}.exe = "%System%\{random file name}.exe:*:Enabled:Windows Update Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%System%\{random file name}.exe = "%System%\{random file name}.exe:*:Enabled:Windows Update Service"

Download Routine

This Trojan downloads updated copies of itself from the following websites:

• http://{BLOCKED}.{BLOCKED}.153.48/{random string}
• http://{BLOCKED}.{BLOCKED}.1.173/{random string}
• http://{BLOCKED}.{BLOCKED}.1.174/{random string}

It saves the files it downloads using the following names:

• %Windows%\{random file name}wow.exe - detected by Trend Micro as TROJ_TRACUR.VY

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

NOTES:

It creates the following registry entries to enable automatic execution of downloaded updated copy of itself at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
{random file name}wow.exe="%Windows%\{random file name}wow.exe"

It redirects searches to the IP address {BLOCKED}.{BLOCKED}.117.107 if the search engine URL contains the following strings:

• alltheweb.com
• altavista.com
• ask.com
• bing.com
• gigablast.com
• google
• hotbot.com
• search.aol.com
• search.lycos.com
• search.netscape.com
• search.yahoo.com
• snap.com