TROJ_INJECTO.VID

October 09, 2012
 Analysis by: Jed Valderama
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

164,352 bytes

File Type:

EXE

Initial Samples Received Date:

25 Jun 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

  • %System%\{random filename}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan adds the following Image File Execution Options registry entries to automatically execute itself whenever certain applications are run:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
userinit.exe
Debugger = "{random filename}.exe"

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401
B5C9 = "dword:00000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401
@ = "{hex values}"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings
GlobalUserOffline = "dword:00000000"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
DefaultConnectionSettings = "{hex values}"

It modifies the following registry entries:

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cookies = "%System%\config\systemprofile\Cookies"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Cookies.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cache = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
History = "%System%\config\systemprofile\Local Settings\History"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Local Settings\History.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "dword:00000000"

(Note: The default value data of the said registry entry is dword:00000001.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths
Directory = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path1
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path2
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path3
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path4
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache4.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = "dword:00000091"

(Note: The default value data of the said registry entry is dword:0000008e.)