MD5: 740c09e9b968c9a6ff4b22d234ae7f67
SHA1: de480822f4055b7930e5fd469990c35834cad3e9
SHA256: 10a35cf58aca668fa6e2b9255caeb5eb7b3e14d4ca8e5d7306e5151820beb720
SSDeep: 24576: RmJkcoQricOIQxiZY1ia/M86t0flZctX7IJaXl:rJZoQrbTFZY1ia/M8tOLp
Size: 1039688 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: QuickSet
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

Firefox-Agent.exe:204
Firefox-Agent.exe:948
%original file name%.exe:1676
%original file name%.exe:1516

The Worm injects its code into the following process(es):

iexplore.exe:656

File activity

The process Firefox-Agent.exe:204 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3481 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)

The process %original file name%.exe:1676 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Program Files%\Mozilla\Firefox-Agent.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (236 bytes)

The process %original file name%.exe:1516 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\msupd.exe (196 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)

The process iexplore.exe:656 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (11888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (16 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (0 bytes)

Registry activity

The process Firefox-Agent.exe:204 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 FF F9 C0 4C 0B C9 95 AA C3 19 E3 3E A5 EC 5E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Firefox-Agent.exe:948 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 F9 30 B3 A3 C7 90 47 CB 42 00 6F AF CF 7B 83"

The process %original file name%.exe:1676 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 0D 1B 1A 9E 96 5A 6A CB 8C 22 CC 1B 67 1E F7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Videocodec" = "%Program Files%\Mozilla\Firefox-Agent.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{AVWH7X33-5AD2-8J13-G548-08KS7PQ4325X}]
"StubPath" = "%Program Files%\Mozilla\Firefox-Agent.exe Restart"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Videocodec" = "%Program Files%\Mozilla\Firefox-Agent.exe"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"

The process %original file name%.exe:1516 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8B 7E B1 7E 54 BD AF DB 9F FD 99 B2 A4 40 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process iexplore.exe:656 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 4A 2D 4A D7 E4 28 D9 92 FC 1E C4 5F 17 72 7E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Mozilla]
"Firefox-Agent.exe" = "Firefox-Agent"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\new34]
"NewIdentification" = "new34"
"FirstExecution" = "22/12/2013 -- 09:20"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Network activity (URLs)

No activity has been detected.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   Firefox-Agent.exe:204
   Firefox-Agent.exe:948
   %original file name%.exe:1676
   %original file name%.exe:1516
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\wupp.pgg (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (3481 bytes)
   %Program Files%\Mozilla\Firefox-Agent.exe (7385 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (3481 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\msupd.exe (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (11888 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (16 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Plugin" = "%Program Files%\Mozilla\Firefox-Agent.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.