TROJ_AGENT_011969.TOMB

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies files, disabling programs and applications from properly running.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan modifies the following files:

• %Windows%\hh.exe
• %Windows%\NOTEPAD.EXE
• %Windows%\regedit.exe
• %Windows%\TASKMAN.EXE
• %Windows%\twunk_16.exe
• %Windows%\twunk_32.exe
• %Windows%\winhelp.exe
• %Windows%\winhlp32.exe
• %Windows%\Help\Tours\mmTour\tour.exe
• %Windows%\msagent\agentsvr.exe
• %Windows%\mui\muisetup.exe
• %Windows%\pchealth\helpctr\binaries\HelpCtr.exe
• %Windows%\pchealth\helpctr\binaries\HelpHost.exe
• %Windows%\pchealth\helpctr\binaries\HelpSvc.exe
• %Windows%\pchealth\helpctr\binaries\HscUpd.exe
• %Windows%\pchealth\helpctr\binaries\msconfig.exe
• %Windows%\pchealth\helpctr\binaries\notiflag.exe
• %Windows%\pchealth\UploadLB\Binaries\UploadM.exe
• %System%\accwiz.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Dropping Routine

This Trojan drops the following files:

• %User Profile%\Application Data\Paint.exe
• %User Startup%\Paint.lnk
• %Desktop%\WinPcap_4_1_2.exe
• %Desktop%\vWinPcap_4_1_2.ico
• %Windows%\vhh.ico
• %Windows%\vNOTEPAD.ico
• %Windows%\vregedit.ico
• %Windows%\vTASKMAN.ico
• %Windows%\vtwunk_16.ico
• %Windows%\vtwunk_32.ico
• %Windows%\vwinhelp.ico
• %Windows%\vwinhlp32.ico
• %Windows%\Help\Tours\mmTour\vtour.ico
• %Windows%\msagent\vagentsvr.ico
• %Windows%\mui\vmuisetup.ico
• %Windows%\pchealth\helpctr\binaries\vHelpCtr.ico
• %Windows%\pchealth\helpctr\binaries\vHelpHost.ico
• %Windows%\pchealth\helpctr\binaries\vHelpSvc.ico
• %Windows%\pchealth\helpctr\binaries\vHscUpd.ico
• %Windows%\pchealth\helpctr\binaries\vmsconfig.ico
• %Windows%\pchealth\helpctr\binaries\vnotiflag.ico
• %Windows%\pchealth\UploadLB\Binaries\vUploadM.ico
• %System%\vaccwiz.ico
• %Temp%\00003bcd\cacheMod.exe
• %Temp%\00003bcd\vcacheMod.ico
• %System Root%\hold.inf
• %System Root%\Paint

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

This report is generated via an automated analysis system.