TROJ_CARBERP.IGG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %Program Files%\NVIDIA Corporation
• %Program Files%\NVIDIA Corporation\Update Center
• %User Temp%\ns{random}.tmp - deleted afterwards

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\MD7H82HHF7EH2D73

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
Service = "NvUpdSrv"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
ConfigFlags = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
Class = Legacy Driver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
ClassGUID = {GUID}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000
DeviceDesc = NVIDIA Update Server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000\Control
*NewlyCreated* = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
Type = 10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
ImagePath = %Program Files%\NVIDIA Corporation\Update Center\nvupdate.exe /svc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
DisplayName = NVIDIA Update Server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv
Description = NVIDIA Settings Update Manager service, used to check new updates from NVIDIA server

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Security
Security = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Enum
0 = Root\LEGACY_NVUPDSRV\0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Enum
Count = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Enum
NextInstance = 1

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NvupdSrv\Enum

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_NVUPDSRV\
0000\Control

Other System Modifications

This Trojan adds the following registry keys:

HKEY_USERS\.DEFAULT\Software\
NVIDIA Corporation

HKEY_USERS\.DEFAULT\Software\
NVIDIA Corporation\Global

HKEY_USERS\.DEFAULT\Software\
NVIDIA Corporation\Global\nvUpdSrv

It adds the following registry entries:

HKEY_USERS\.DEFAULT\Software\
NVIDIA Corporation\Global\nvUpdSrv
value = {date}

HKEY_USERS\.DEFAULT\Software\
NVIDIA Corporation\Global\nvUpdSrv
GUID = {GUID}

Dropping Routine

This Trojan drops the following files:

• %Program Files%\NVIDIA Corporation\Update Center\nvupdate.exe - also detected as TROJ_CARBERP.IGG
• %User Temp%\ns{random}.tmp\System.dll - deleted afterwards

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

NOTES:

It connects to the following IP addresses to download files:

• {BLOCKED}.{BLOCKED}.186.76
• {BLOCKED}.{BLOCKED}.130.17
• {BLOCKED}.{BLOCKED}.208.226
• {BLOCKED}.{BLOCKED}247.50
• {BLOCKED}.{BLOCKED}.218.14
• {BLOCKED}.{BLOCKED}.4.190
• {BLOCKED}.{BLOCKED}.76.42
• {BLOCKED}.{BLOCKED}.140.15
• {BLOCKED}.{BLOCKED}.96.151
• {BLOCKED}.{BLOCKED}.51.32
• {BLOCKED}.{BLOCKED}.99.100
• {BLOCKED}.{BLOCKED}.155.234

It downloads files by connecting to the IP address mentioned above and sending an HTTP GET request. It does this by appending the following strings:

• /stat?uid=%d&downlink=%d&uplink=%d&id=%s&statpass=%s&version=%d&features=%d&;guid=%s&comment=%s&p=%d&s=%s

However, as of this writing, this request attempt fails.