TROJ_FRAUD.AL

This Trojan arrives as attachment to mass-mailed email messages. However, as of this writing, the said sites are inaccessible.

It executes then deletes itself afterward.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives as attachment to mass-mailed email messages.

However, as of this writing, the said sites are inaccessible.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{Random Folder 1}\{Random Filename}.exe
• %System%\CbEvtSvc.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %Application Data%\{Random Folder 2}\{Random Filename 2}.dic

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It executes then deletes itself afterward.

It is injected into the following processes running in memory:

• explorer.exe
• rdpclip.exe
• ctfmon.exe
• wscntfy.exe
• taskeng.exe
• taskhost.exe
• dwm.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{6D28A461-0014-C635-1588-762C8F7E3B1C} = {Malware Path and File Name}.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\CbEvtSvc
DisplayName =

(Note: The default value data of the said registry entry is .)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\CbEvtSvc
ImagePath = "%System%\CbEvtSvc.exe -k netsvcs"

(Note: The default value data of the said registry entry is .)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services
CbEvtSvc =

(Note: The default value data of the said registry entry is .)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Privacy
CleanCookies = 0

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{Random Key}

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://www.{BLOCKED}ol.com/ccnr.exe
• http://www.{BLOCKED}ol.com/putmuk24111.exe
• http://www.{BLOCKED}ol.com/ruiosd221212.exe

Other Details

This Trojan connects to the following website to send and receive information: