TROJ_STARTPA.ACG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\DNSFix

HKEY_LOCAL_MACHINE\SOFTWARE\SoftFix

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}

HKEY_CURRENT_USER\Software\360\
360se3

HKEY_CURRENT_USER\Software\360\
360se5\default\option

It adds the following registry entries:

HKEY_CURRENT_USER\Software\360\
360se3
homepage = "aHR0cDovL3d3dy43NDE3NC5jb20v"

HKEY_CURRENT_USER\Software\360\
360se5\default\option
homepage = "http://www.{BLOCKED}4.com/?se5"

HKEY_LOCAL_MACHINE\SOFTWARE\SoftFix
TB = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\SoftFix
GW = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes
DefaultScope = "{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
DisplayName = "????"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
URL = "http://s8.{BLOCKED}o.com/search?q={searchTerms}&pid=mm_22993410_0_0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
ShowSearchSuggestions = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
SuggestionsURL_JSON = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
SuggestionsURL = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
Codepage = "3a8"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
OSDFileURL = "http://www.{BLOCKED}ery.com/DownloadHandler.ashx?ResourceId=6738"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{8FE24C7B-78F2-4B29-9357-84C3B4625AEE}
FaviconURL = "http://www.{BLOCKED}o.com/favicon.ico"

Dropping Routine

This Trojan drops the following files:

• %User Temp%\aut1.tmp
• %System%\se1.ini
• %User Temp%\aut2.tmp
• %System%\se2.ini
• %User Temp%\aut3.tmp
• %System%\taobao.ico
• %User Temp%\aut4.tmp
• %User Temp%\aut5.tmp
• %User Temp%\aut6.tmp
• %Desktop%\???.url
• %Favorites%\Links\???.url
• %Favorites%\???.url

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}183.222/sogou_pinyin_60_5698.exe
• http://{BLOCKED}183.222/sogou_explorer_silent_2.2.0.2080_3654.exe
• http://{BLOCKED}183.222/KGGWSetup_1050.exe
• http://{BLOCKED}183.222/ppstreamsetup_spl001@xp039.exe
• http://{BLOCKED}183.222/kugou7_2910.exe
• http://{BLOCKED}183.222/FunshionInstall.exe

This report is generated via an automated analysis system.