arrow_back
search
close

PE_DOWN

October 09, 2012
 Analysis by: Christopher Daniel So
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW


This file infector infects executable files (.EXE).

It drops copy(ies) of itself in all removable drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It attempts to access certain websites to download files, which are possibly malicious.

This file infector may be dropped by other malware.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

EXE

Memory Resident:

Yes

Arrival Details

This file infector may be dropped by other malware.

Other System Modifications

This file infector adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application name}
Debugger = "ntsd"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\AppMgmt

Where {application name} may be any of the following:

  • 360SoftMgrSvc.exe
  • 360hotfix.exe
  • 360rp.exe
  • 360rpt.exe
  • 360safe.exe
  • 360safebox.exe
  • 360sd.exe
  • 360se.exe
  • 360speedld.exe
  • 360tray.exe
  • AvastUI.exe
  • CCenter.exe
  • FilMsg.exe
  • KVMonXP.exe
  • KVMonXP.kxp
  • KVSrvXP.exe
  • MPMon.exe
  • MPSVC.exe
  • MPSVC1.exe
  • MPSVC2.exe
  • McNASvc.exe
  • McProxy.exe
  • McSACore.exe
  • Mcagent.exe
  • Mcods.exe
  • Mcshield.exe
  • MpfSrv.exe
  • RavMonD.exe
  • RavTask.exe
  • RsAgent.exe
  • RsTray.exe
  • ScanFrm.exe
  • SfCtlCom.exe
  • SpIDerMl.exe
  • TMBMSRV.exe
  • TmProxy.exe
  • Twister.exe
  • UfSeAgnt.exe
  • afwServ.exe
  • ast.exe
  • avcenter.exe
  • avfwsvc.exe
  • avgnt.exe
  • avguard.exe
  • avmailc.exe
  • avp.exe
  • avshadow.exe
  • avwebgrd.exe
  • bdagent.exe
  • ccSvcHst.exe
  • dwengine.exe
  • egui.exe
  • ekrn.exe
  • kavstart.exe
  • kissvc.exe
  • kmailmon.exe
  • kpfw32.exe
  • kpfwsvc.exe
  • kpopserver.exe
  • krnl360svc.exe
  • ksmgui.exe
  • ksmsvc.exe
  • kswebshield.exe
  • kwatch.exe
  • kwstray.exe
  • kxedefend.exe
  • kxesapp.exe
  • kxescore.exe
  • kxeserv.exe
  • kxetray.exe
  • livesrv.exe
  • mcmscsvc.exe
  • mcsysmon.exe
  • mcvsshld.exe
  • msksrver.exe
  • qutmserv.exe
  • rsnetsvr.exe
  • safeboxTray.exe
  • sched.exe
  • seccenter.exe
  • spideragent.exe
  • spidernt.exe
  • spiderui.exe
  • vsserv.exe
  • zhudongfangyu.exe

File Infection

This file infector infects the following file types:

  • EXE

Propagation

This file infector creates the following folders in all removable drives:

  • recycle.{645FF040-5081-101B-9F08-00AA002F954E}

It drops the following copy(ies) of itself in all removable drives:

  • {removable drive letter}:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\{random file name}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This file infector attempts to access the following websites to download files, which are possibly malicious:

  • http://{BLOCKED}.{BLOCKED}.85.199/cl/80.exe
  • http://{BLOCKED}.{BLOCKED}.113.108/msdownload/update/v5/redir/wuredirt.rar
  • http://{BLOCKED}t.mvps.org/resources/tools/getpublicip.shtml
  • http://{BLOCKED}{BLOCKED}.85.205/msdownload/update/v5/redir/wuredirt.rar

  SOLUTION

Minimum Scan Engine:

9.200

Trend customers:

    Keep your pattern and scan engine files updated. Trend Micro antivirus software can clean or remove most types of computer threats. Malware, though, such as Trojans, scripts, overwriting viruses and joke programs which are identified as uncleanable, should simply be deleted.

All Internet users:

    1. Use HouseCall - the Trend Micro online threat scanner to check for malware that may already be on your PC.
    2. Catch malware/grayware before they affect your PC or network. Secure your Web world with Trend Micro products that offer the best anti-threat and content security solutions for home users, corporate users, and ISPs. Go here for more information on Trend Micro products that fit your needs.


Did this description help? Tell us how we did.