TROJ_DNSCHANGE.G

Changes the TCP Port of Internet Information Services (IIS) of the affected system to a new random number. The new port number is saved by the malware in a specific registry.

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following file(s)/component(s):

• %System%\spool\driver\PMTP_TEMP_CONFIG.INI

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\spool\drivers\PTMP.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
Type = 10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
ImagePath = %System%\spool\drivers\PTMP.exe /Start

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
DisplayName = PTMPService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Network Port Services
Description = This Service analysis Port Map name. If this service was stopped, the computer will not be able to resolve PTMP name and location Active Directory domain controller. If this service is disabled, any clear rely on its services will not be able to start.

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService_Temp

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
Service = PTMPService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
Programe = PTMP.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
Description = This Service analysis Port Map name. If this service was stopped, the computer will not be able to resolve PTMP name and location Active Directory domain controller. If this service is disabled, any clear rely on its services will not be able to start.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
ClientID = Ours

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
FirstServer = http://www.highest-developments.com/ptmp2.php

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
SecondServer = http://www.moderinnovation.com/ptmp2.php

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
ThirdServer = http://www.spf-domainkey.com/ptmp2.php

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
Disallow = bl.php

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
DomainVer = du.txt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
DomainList = dd.txt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PTMPService
IISPort = {new IIS Port number}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
BW-PTMP = %System%\spool\drivers\PTMP.exe:*:enabled:Explorer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
BW-PTMP = %System%\spool\drivers\PTMP.exe:*:enabled:Explorer

Download Routine

This Trojan connects to the following malicious URLs:

• http://www.{BLOCKED}t-developments.com/ptmp2.php
• http://www.{BLOCKED}nnovation.com/ptmp2.php
• http://www.{BLOCKED}mainkey.com/ptmp2.php

Other Details

This Trojan does the following:

• Changes the TCP Port of Internet Information Services (IIS) of the affected system to a new random number. The new port number is saved by the malware in the following registry:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PTMPService
  IISPort = {new IIS Port value}