TROJ_NECURS.E

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Windows%\Installer\{F0FC1B6B-F278-BDE4-CBB5-71C0A76A75D4}\syshost.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders:

• %Windows%\Installer\{F0FC1B6B-F278-BDE4-CBB5-71C0A76A75D4}

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Other System Modifications

This Trojan deletes the following files:

• {malware path and file name}.tmp
• %Windows%\Installer\{F0FC1B6B-F278-BDE4-CBB5-71C0A76A75D4}\syshost.exe:Zone.Identifier
• %Windows%\Installer\{F0FC1B6B-F278-BDE4-CBB5-71C0A76A75D4}\syshost.exe.tmp
• %User Temp%\bf848931.tmp

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
32e9b2d3f2a550ca = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
a934a00cc2cf6250 = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
42615720cb250aab = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
9fe51f4d180df75d = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
7807c43c32333839 = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\syshost32
639c07b219a0da1 = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

Dropping Routine

This Trojan drops the following files:

• %Temp%\d23f4e98-9070-cb58-4015-75944de7a9ef.tmp

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}kwkbhagnp.org/forum/db.php

This report is generated via an automated analysis system.