TROJ_KRYPTIK.KJO

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Security Monitor\securityhelper.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Start Menu%\Programs\Security Monitor
• %User Profile%\Application Data\Security Monitor
• %System Root%\DOCUME~1
• %System Root%\DOCUME~1\Wilbert
• %User Profile%\LOCALS~1
• %Application Data%\advMaindlg

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
98fvq9usfw47 = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Security Monitor 2012 Security = "%User Profile%\Security Monitor\securitymanager.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
CRLMappnp = "rundll32.exe %Application Data%\advMaindlg\CRLMappnp.dll,msapidrm sysPaddsc"

Other System Modifications

This Trojan deletes the following files:

• {malware path and file name}:zone.identifier
• %User Profile%\Security Monitor\securityhelper.exe
• %User Temp%\nsj2.tmp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{293342E5-B5F0-74DA-B16C-611CF0B5DA74}\Categories

It adds the following registry entries:

HKEY_CURRENT_USER\CLSID\{293342E5-B5F0-74DA-B16C-611CF0B5DA74}\
Categories
{66CC2F6C-45CE-7F9C-B4D6-C937CE459C7F} = "4i4IjpFqelNArtSWplvkZb"

HKEY_CURRENT_USER\CLSID\{293342E5-B5F0-74DA-B16C-611CF0B5DA74}\
Categories
{526A2876-0C0F-0475-0FC7-EEA9FB98BC58} = "1326920400"

HKEY_CURRENT_USER\CLSID\{293342E5-B5F0-74DA-B16C-611CF0B5DA74}\
Categories
{134E12A4-6E89-F6A5-894D-790405ECD299} = "368589"

Dropping Routine

This Trojan drops the following files:

• %User Temp%\_1.tmpac7d.exe
• %Start Menu%\Programs\Security Monitor.lnk
• %Desktop%\Security Monitor.lnk
• %Start Menu%\Programs\Security Monitor\Security Monitor.lnk
• %Start Menu%\Programs\Security Monitor\Activate Security Monitor.lnk
• %Start Menu%\Programs\Security Monitor\How to Activate Security Monitor.lnk
• %Start Menu%\Programs\Security Monitor\Help Security Monitor.lnk
• %User Profile%\Quick Launch\Security Monitor.lnk
• %User Profile%\Security Monitor\IcoActivate.ico
• %User Profile%\Security Monitor\IcoHelp.ico
• %User Profile%\Security Monitor\IcoUninstall.ico
• %User Profile%\Security Monitor\123.exe
• %User Profile%\Security Monitor\securitymanager.exe
• %User Profile%\Security Monitor\Security_Monitor2012.exe
• %User Temp%\nsz3.tmp
• %User Temp%\xpmapSvcs.dll
• %Application Data%\advMaindlg\CRLMappnp.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

This report is generated via an automated analysis system.