Analysis by: Roland Marco Dela Paz
ALIASES:

MonitoringTool:Win32/LanAgent (Microsoft)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Hacking Tool

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This hacking tool may be manually installed by a user.

  TECHNICAL DETAILS

File Size: 4,910,592 bytes
File Type: PE
Memory Resident: No
Initial Samples Received Date: 11 May 2012

Arrival Details

This hacking tool may be manually installed by a user.

Installation

This hacking tool drops the following file(s)/component(s):

  • %User Profile%\Application Data\Microsoft\Installer\{B892B9BB-6FF7-431B-869A-25538F4B4BC1}\ARPPRODUCTICON.exe
  • %System%\sysuser\ChooseAdapter.exe
  • %System%\sysuser\CompShut.dat
  • %System%\sysuser\LOG\agent(date 18-40-36).xmd
  • %System%\sysuser\LOG\Service(date 18-40-35).xmd
  • %System%\sysuser\LOG\sniff(date 18-40-36).xmd
  • %System%\sysuser\LOG\sniff(date 18-43-00).xmd
  • %System%\sysuser\LOG\sniff(date 18-47-07).xmd
  • %System%\sysuser\NetMon.ltx
  • %System%\sysuser\settingsXML.dat
  • %System%\sysuser\svchost.exe
  • %System%\sysuser\sys.dat
  • %System%\sysuser\sys.dll
  • %System%\sysuser\system.exe
  • %System%\sysuser\Uninstall_pcap.exe
  • %System%\sysuser\wssfcmai.exe
  • %System%\WanPacket.dll

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

  • %User Profile%\Application Data\Microsoft\Installer
  • %User Profile%\Application Data\Microsoft\Installer\{B892B9BB-6FF7-431B-869A-25538F4B4BC1}
  • %System%\sysuser
  • %System%\sysuser\caped
  • %System%\sysuser\LOG

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other System Modifications

This hacking tool adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Installer

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.msi

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{B892B9BB-6FF7-431B-869A-25538F4B4BC1}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\MSSystem

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
UpgradeCodes\847D7DD3F49289B4B9D53BFD28438101

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%System%\sysuser\ = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%System%\sysuser\Logs\ = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%User Profile%\Application Data\Microsoft\Installer\{B892B9BB-6FF7-431B-869A-25538F4B4BC1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%User Profile%\Application Data\Microsoft\Installer =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\Uninstall_pcap.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\Install_pcap.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\AdapterSelector.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\system.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\svchost.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\SetRights.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\ChooseAdapter.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\wssfcmai.exe = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\sysuser\sys.dll = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\wpcap.dll = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\Packet.dll = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\WanPacket.dll = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\SharedDlls
%System%\pthreadVC.dll = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\sysuser\system.exe = "%System%\sysuser\system.exe:*:Enabled:SYSTEM"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
47658:TCP = "47658:TCP:*:Enabled:SYSTEM_TCP47658"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Print\
Printers\Microsoft Office Document Image Writer
Attributes = "101"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Print\
Printers\Microsoft XPS Document Writer
Attributes = "141"

(Note: The default value data of the said registry entry is 40.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Print\Printers\
Microsoft Office Document Image Writer
Attributes = "101"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Print\Printers\
Microsoft XPS Document Writer
Attributes = "141"

(Note: The default value data of the said registry entry is 40.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = "84"

(Note: The default value data of the said registry entry is 82.)