Trojan.Win32.IEDummy_fe11832ffb
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Generic.pak!cobra (VIPRE), Backdoor.Win32.Fynloski!IK (Emsisoft), Trojan.Win32.IEDummy.FD, WormRebhip.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: fe11832ffbca24b53b3f3eadf3311185
SHA1: ac2e7f405cb4838cd4c01efaa462bc52a15f9ecb
SHA256: 712f1858b8fd243f0f7d2bcf4e94ffb9a54bf06b17304ee371d51946626f2634
SSDeep: 24576:obDglp5mMWfkAioZfpr0YtKOqr1iXmADvvECGE/Yq:3lrmxkwZfprrtRmmcnE/B
Size: 913408 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2013-06-25 08:24:43
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
fe11832ffbca24b53b3f3eadf3311185.exe:240
fe11832ffbca24b53b3f3eadf3311185.exe:456
setup.exe:2204
setup.exe:2140
The Trojan injects its code into the following process(es):
iexplore.exe:324
File activity
The process fe11832ffbca24b53b3f3eadf3311185.exe:240 makes changes in a file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe (6841 bytes)
The process fe11832ffbca24b53b3f3eadf3311185.exe:456 makes changes in a file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\347C9500 (14 bytes)
The process setup.exe:2140 makes changes in a file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\347C9500 (14 bytes)
The process iexplore.exe:324 makes changes in a file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (14464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (56 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (0 bytes)
Registry activity
The process fe11832ffbca24b53b3f3eadf3311185.exe:240 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 94 EC CA C0 82 46 F0 C4 25 57 53 32 27 6E 35"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"KernelFualtCheck" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"KernelFualtCheck" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Shield Installer" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"setup recommend" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe"
The process fe11832ffbca24b53b3f3eadf3311185.exe:456 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 B8 29 78 D4 BC 27 74 F2 26 1F F2 03 12 22 DD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Enigma Protector\546D76260E220698-0AAEA72614F3796B]
"Options" = "18 91 61 0C 14 94 81 0E 6C 3E A0 D7 EE A0 80 3E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Enigma Protector\546D76260E220698-0AAEA72614F3796B\75BF346BD4696CEB-1037D8B04A307292]
"6970BB7C" = "89 C7 2C 88 1F D9 FF 66 0D 1A C1 56 59 1D"
The process setup.exe:2204 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C D0 6F 72 30 12 69 1E 22 94 69 0D E1 76 FA FE"
The process setup.exe:2140 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E CE 99 22 93 22 D3 E4 EC D5 8D A7 FA 90 CD 55"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Enigma Protector\546D76260E220698-0AAEA72614F3796B]
"Options" = "18 91 61 0C 14 94 81 0E 6C 3E A0 D7 EE A0 80 3E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Enigma Protector\546D76260E220698-0AAEA72614F3796B\75BF346BD4696CEB-1037D8B04A307292]
"6970BB7C" = "89 C7 2C 88 1F D9 FF 66 0D 1A C1 56 59 1D"
The process iexplore.exe:324 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 E0 42 56 B5 EB 0B 75 77 88 14 85 22 1B D9 DD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\6-2413]
"FirstExecution" = "15/08/2013 -- 02:29"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}]
"setup.exe" = "Micorsoft wnidow opreating systems"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\6-2413]
"NewIdentification" = "6-2413"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
Network activity (URLs)
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
fe11832ffbca24b53b3f3eadf3311185.exe:240
fe11832ffbca24b53b3f3eadf3311185.exe:456
setup.exe:2204
setup.exe:2140 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\347C9500 (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (14464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (56 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Shield Installer" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"setup recommend" = "%WinDir%\Installer\{78F1739F-0B41-196E-A127-1F7F5EGDDEFC}\setup.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
