PE_ERMA.A

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
LasErma = "%System%\Ermasys32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
LasErma = "%System%\Ermasys32.exe"

Other System Modifications

This file infector deletes the following files:

• %System Root%\LasiafErma.exe
• %User Profile%\Internet Explorer\brndlog.txt
• %User Temp%\dd_vcredistMSI5DA7.txt
• %Temporary Internet Files%\Content.IE5\2TPM8950\10[1].htm
• %Temporary Internet Files%\Content.IE5\4H9MXTT9\10[1].htm
• %Temporary Internet Files%\Content.IE5\SMCZPN4M\10[1].htm
• %Temporary Internet Files%\Content.IE5\X9QQH2D9\192.168.100[1].htm
• %User Profile%\Templates\excel.xls
• %User Profile%\User Account Pictures\Administrator.bmp
• %User Profile%\Default Pictures\airplane.bmp
• %User Profile%\Sample Pictures\Blue hills.jpg
• %User Temp%\dd_vcredistMSI6806.txt

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices

Dropping Routine

This file infector drops the following files:

• %Windows%\Ermasys32.exe
• %System%\Ermasys32.exe
• %Windows%\Lasiaf.exe
• %System%\kernel32.exe
• %Windows%\csrss.exe
• %System%\mode.exe
• %User Profile%\Internet Explorer\brndlog.txt.exe
• %User Temp%\dd_vcredistMSI5DA7.txt.exe
• %Temporary Internet Files%\Content.IE5\2TPM8950\10[1].htm.exe
• %Temporary Internet Files%\Content.IE5\4H9MXTT9\10[1].htm.exe
• %Temporary Internet Files%\Content.IE5\SMCZPN4M\10[1].htm.exe
• %Temporary Internet Files%\Content.IE5\X9QQH2D9\192.168.100[1].htm.exe
• %User Profile%\Templates\excel.xls.exe
• %User Profile%\User Account Pictures\Administrator.bmp.exe
• %User Profile%\Default Pictures\airplane.bmp.exe
• %User Profile%\Sample Pictures\Blue hills.jpg.exe
• %Desktop%\vcredist_x86.exe
• %User Temp%\dd_vcredistMSI6806.txt.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)

This report is generated via an automated analysis system.