TROJ_ZACCES.SMQK

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It employs registry shell spawning by adding certain registry entries. This allows this malware to execute even when other applications are opened.

It modifies certain registry entries to disable Security Center functions. Doing this allows this malware to execute its routines without being detected. It modifies registry entries to disable the Windows Firewall settings. This action allows this malware to perform its routines without being deteted by the Windows Firewall.

It deletes the initially executed copy of itself.

File Size:

274,432 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

16 Jan 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

%Application Data%\{random three letters}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

%System Root%\Documents and Settings\All Users\Application Data\ags173q7g2p14omx43315rjvv
%Application Data%\ags173q7g2p14omx43315rjvv
%User Temp%\ags173q7g2p14omx43315rjvv
%User Profile%\Templates\ags173q7g2p14omx43315rjvv

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan employs registry shell spawning to ensure its execution when certain file types are accessed by adding the following entries:

HKEY_CLASSES_ROOT\ah\shell\
open\command
{default} = ""%Application Data%\{random three letters}.exe" -a "%1" %*"

HKEY_CLASSES_ROOT\.exe\shell\
open\command
{default} = ""%Application Data%\{random three letters}.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
.exe\shell\open\
command
{default} = ""%Application Data%\{random three letters}.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
ah\shell\open\
command
{default} = ""%Application Data%\{random three letters}.exe" -a "%1" %*"

Other System Modifications

This Trojan modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CLASSES_ROOT\.exe
{default} = "ah"

(Note: The default value data of the said registry entry is exefile.)

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\FIREFOX.EXE\shell\
open\command
{default} = ""%Application Data%\{random three letters}.exe" -a "%Program Files%\Mozilla Firefox\firefox.exe""

(Note: The default value data of the said registry entry is %Program Files%\Mozilla Firefox\firefox.exe.)

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\FIREFOX.EXE\shell\
safemode\command
{default} = ""%Application Data%\{random three letters}.exe" -a "%Program Files%\Mozilla Firefox\firefox.exe" -safe-mode"

(Note: The default value data of the said registry entry is "%Program Files%\Mozilla Firefox\firefox.exe" -safe-mode.)

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\IEXPLORE.EXE\shell\
open\command
{default} = ""%Application Data%\{random three letters}.exe" -a "%Program Files%\Internet Explorer\iexplore.exe""

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe".)

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\ah

HKEY_CLASSES_ROOT\.exe\shell

HKEY_CLASSES_ROOT\.exe\shell\
runas

HKEY_CURRENT_USER\Software\Classes\
.exe

HKEY_CURRENT_USER\Software\Classes\
.exe\shell\runas

HKEY_CURRENT_USER\Software\Classes\
ah

HKEY_CURRENT_USER\Software\Classes\
ah\shell\runas

It modifies the following registry entries to disable Security Center functions:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"