TROJ_VB3.TOMA

October 09, 2012

ALIASES:

Trojan:Win32/VB.NP (Microsoft); W32/PJTbinder!hv (McAfee); W32.Pajetbin (Symantec); Trojan.Win32.VB.chg, Trojan.Win32.VB.chg (Kaspersky); Trojan.Win32.VB.chg (v) (Sunbelt)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size:

79,871 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

09 Oct 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

%System Root%\10a0699fa37928d39c
%System Root%\documen

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
FileProtector = "%System Root%\10a0699fa37928d39c\spfirewall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
RegSCRLib = "regsvr32.exe /s scrrun.dll"

Other System Modifications

This Trojan deletes the following files:

%Desktop%\vcredist_x86.exe
%Desktop%\WinPcap_4_1_2.exe
%Program Files%\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
%Program Files%\Common Files\Microsoft Shared\Speech\sapisvr.exe
%Program Files%\Internet Explorer\Connection Wizard\icwconn1.exe
%Program Files%\Internet Explorer\Connection Wizard\icwconn2.exe
%Program Files%\Internet Explorer\Connection Wizard\icwrmind.exe
%Program Files%\Internet Explorer\Connection Wizard\icwtutor.exe
%Program Files%\Internet Explorer\Connection Wizard\inetwiz.exe
%Program Files%\Internet Explorer\Connection Wizard\isignup.exe
%Program Files%\Internet Explorer\iedw.exe
%Program Files%\Internet Explorer\IEXPLORE.EXE
%Program Files%\Messenger\msmsgs.exe
%Program Files%\Movie Maker\moviemk.exe
%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
%Program Files%\MSN\MSNCoreFiles\Install\msnsusii.exe
%Program Files%\MSN Gaming Zone\Windows\bckgzm.exe
%Program Files%\MSN Gaming Zone\Windows\chkrzm.exe
%Program Files%\MSN Gaming Zone\Windows\hrtzzm.exe
%Program Files%\MSN Gaming Zone\Windows\Rvsezm.exe
%Program Files%\MSN Gaming Zone\Windows\shvlzm.exe
%Program Files%\MSN Gaming Zone\Windows\zClientm.exe
%Program Files%\NetMeeting\cb32.exe
%Program Files%\NetMeeting\conf.exe
%Program Files%\NetMeeting\wb32.exe
%Program Files%\Outlook Express\msimn.exe
%Program Files%\Outlook Express\oemig50.exe
%Program Files%\Outlook Express\setup50.exe
%Program Files%\Outlook Express\wab.exe
%Program Files%\Outlook Express\wabmig.exe
%Program Files%\Windows Media Player\migrate.exe
%Program Files%\Windows Media Player\mplayer2.exe
%Program Files%\Windows Media Player\setup_wm.exe
%Program Files%\Windows Media Player\wmplayer.exe
%Program Files%\Windows NT\Accessories\wordpad.exe
%Program Files%\Windows NT\Pinball\PINBALL.EXE
%Program Files%\Windows NT\dialer.exe
%Program Files%\Windows NT\hypertrm.exe
%Program Files%\WinPcap\rpcapd.exe
%Program Files%\WinPcap\Uninstall.exe
%Windows%\Help\Tours\mmTour\tour.exe
%Windows%\inf\unregmp2.exe
%Windows%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%Windows%\Installer\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}\ARPPRODUCTICON.exe
%Windows%\msagent\agentsvr.exe
%Windows%\mui\muisetup.exe
%Windows%\pchealth\helpctr\binaries\HelpCtr.exe
%Windows%\pchealth\helpctr\binaries\HelpHost.exe
%Windows%\pchealth\helpctr\binaries\HelpSvc.exe
%Windows%\pchealth\helpctr\binaries\HscUpd.exe
%Windows%\pchealth\helpctr\binaries\msconfig.exe
%Windows%\pchealth\helpctr\binaries\notiflag.exe

(Note: %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories\
{7DD95801-9882-11CF-9FA9-00AA006C42C4}

HKEY_CLASSES_ROOT\HTML.HostEncode

HKEY_CLASSES_ROOT\ASP.HostEncode

HKEY_CLASSES_ROOT\JSFile.HostEncode

HKEY_CLASSES_ROOT\VBSFile.HostEncode

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}
TypeLib = "{420B2830-E718-11CF-893D-00A0C9054228}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}
ProgID = "Scripting.Dictionary"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Scripting.Dictionary
CLSID = "{EE09B103-97E0-11CF-978F-00A02463E06F}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}
TypeLib = "{420B2830-E718-11CF-893D-00A0C9054228}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}
ProgID = "Scripting.FileSystemObject"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Scripting.FileSystemObject
CLSID = "{0D43FE01-F093-11CF-8940-00A0C9054228}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}
TypeLib = "{420B2830-E718-11CF-893D-00A0C9054228}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}
ProgID = "Scripting.Encoder"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Scripting.Encoder
CLSID = "{32DA2B15-CFED-11D1-B747-00C04FC2B085}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}
InprocServer32 = "%System%\scrrun.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}
ProgID = "HTML.HostEncode"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
HTML.HostEncode
CLSID = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}
InprocServer32 = "%System%\scrrun.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}
ProgID = "ASP.HostEncode"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ASP.HostEncode
CLSID = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}
InprocServer32 = "%System%\scrrun.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}
ProgID = "JSFile.HostEncode"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JSFile.HostEncode
CLSID = "{85131630-480C-11D2-B1F9-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}
InprocServer32 = "%System%\scrrun.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}
ProgID = "VBSFile.HostEncode"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
VBSFile.HostEncode
CLSID = "{85131631-480C-11D2-B1F9-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
htmlfile
ScriptHostEncode = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
aspfile
ScriptHostEncode = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JSFile
ScriptHostEncode = "{85131630-480C-11D2-B1F9-00C04F86C324}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
VBSFile
ScriptHostEncode = "{85131631-480C-11D2-B1F9-00C04F86C324}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{42C642C1-97E1-11CF-978F-00A02463E06F}\TypeLib
Version = "1.0"