TROJ_SMALL.SMNH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables Task Manager, Registry Editor, and Folder Options.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\smss.exe
• %System%\drivers\mqtgsvc.exe
• %Windows%\wininit.exe
• %Application Data%\Microsoft\dllhost.exe
• %System%\esentutl.exe
• %User Profile%\sessmgr.exe
• %Application Data%\Microsoft\sessmgr.exe
• %Application Data%\Microsoft\dllhst3g.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\~NwcTemp
• %User Temp%\~NwcTemp\conh11

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MessageService = "%System%\drivers\mqtgsvc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
DCOM = "%Application Data%\Microsoft\dllhost.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
DllHost3g = "%Application Data%\Microsoft\dllhst3g.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Policies\Explorer\Run

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
Session Manager = "%User Profile%\smss.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
run = "%User Profile%\sessmgr.exe"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%System%\esentutl.exe"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
WinInit = "%Windows%\wininit.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Sessmgr = "%Application Data%\Microsoft\sessmgr.exe"

Dropping Routine

This Trojan drops the following files:

• %User Temp%\Twain002.Mtx
• %User Temp%\~NwcTemp\conh11\conhost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://mx1.{BLOCKED}olympic.org/protocol.php?{random characters}
• http://mx1.{BLOCKED}olympic.org/d/conh11.jpg
• http://t22.{BLOCKED}at.org/d/t14.php
• http://mx1.{BLOCKED}olympic.org/img/seek.cgi?lin=100&db=dfd
• http://seek4.{BLOCKED}at.org/img/seek.cgi?lin=100&db=dfd
• http://seek4.{BLOCKED}at.org/ae1.php
• http://seek4.{BLOCKED}at.org/ggu.php
• http://seek4.{BLOCKED}at.org/{random path}
• http://seek4.{BLOCKED}at.org/templates/system/html/footer.php
• http://seek4.{BLOCKED}at.org/zb41/data/tech_01/1272664028/dirs.php
• http://mx1.{BLOCKED}olympic.org/ae1.php
• http://mx1.{BLOCKED}olympic.org/ggu.php
• http://seek4.{BLOCKED}at.org/modules/option.php
• http://mx1.{BLOCKED}olympic.org/{random path}
• http://bt2.{BLOCKED}at.org/ae1.php
• http://seek4.{BLOCKED}at.org/arriveappearance/cache.php
• http://fw.{BLOCKED}at.org/ggu.php
• http://fw.{BLOCKED}at.org/{random path}
• http://seek4.{BLOCKED}at.org/assets/files/Hidraulica/model.php
• http://bt2.{BLOCKED}at.org/ggu.php
• http://bt2.{BLOCKED}at.org/libraries/joomla/html/parameter/element/ini.php
• http://bt2.{BLOCKED}at.org/{random path}
• http://seek4.{BLOCKED}at.org/install/dirs.php
• http://seek4.{BLOCKED}at.org/engineeringdull/options.php
• http://seek4.{BLOCKED}at.org/e107_plugins/pm/languages/options.php
• http://seek4.{BLOCKED}at.org/Error/title.php
• http://seek4.{BLOCKED}at.org/components/com_contact/views/category/tmpl/view.php
• http://seek4.{BLOCKED}at.org/libraries/joomla/language/diff.php
• http://mx1.{BLOCKED}olympic.org/php-bin/bbs/data/theses/1262756619/test.php
• http://seek4.{BLOCKED}at.org/public_html/components/com_media/file.php
• http://seek4.{BLOCKED}at.org/wp-includes/js/tinymce/plugins/wpdialogs/alias.php
• http://seek4.{BLOCKED}at.org/tmp/install_4cd065a314fc7/site/model.php
• http://bt2.{BLOCKED}at.org/eibuaygr/option.php
• http://seek4.{BLOCKED}at.org/sqlbuddy/locale/dirs.php
• http://seek4.{BLOCKED}at.org/wp-includes/Text/Diff/Engine/article.php
• http://mx1.{BLOCKED}olympic.org/libraries/joomla/html/parameter/element/ini.php
• http://mx1.{BLOCKED}olympic.org/public_html/components/com_media/file.php
• http://bt2.{BLOCKED}at.org/e107_plugins/pm/languages/options.php
• http://bt2.{BLOCKED}at.org/public_html/components/com_media/file.php
• http://seek4.{BLOCKED}at.org/catalog/controller/payment/xml.php
• http://seek4.{BLOCKED}at.org/home/logs/include.php
• http://mx1.{BLOCKED}olympic.org/components/com_contact/views/category/tmpl/view.php
• http://seek4.{BLOCKED}at.org/libraries/joomla/html/parameter/element/ini.php
• http://fw.{BLOCKED}at.org/php-bin/bbs/data/theses/1262756619/test.php
• http://fw.{BLOCKED}at.org/public_html/components/com_media/file.php
• http://bt2.{BLOCKED}at.org/php-bin/bbs/data/theses/1262756619/test.php
• http://fw.{BLOCKED}at.org/jomres/uploadedimages/pfeatures/proxy.php
• http://mx1.{BLOCKED}olympic.org/components/com_properties/views/panel/login.php
• http://seek4.{BLOCKED}at.org/php-bin/bbs/data/theses/1262756619/test.php
• http://sportservices.{BLOCKED}o.za/{random path}
• http://seek4.{BLOCKED}at.org/libraries/phpmailer/sql.php
• http://seek4.{BLOCKED}at.org/modules/mod_fpss/mod_fpss/templates/TT/title.php
• http://ninfa.{BLOCKED}g.au/{random path}
• http://seek4.{BLOCKED}at.org/images/banners/error.php
• http://seek4.{BLOCKED}at.org/modules/mod_footer/tmpl/search.php
• http://seek4.{BLOCKED}at.org/wp-content/uploads/2011/02/article.php

This report is generated via an automated analysis system.