Trojan.Inject1.32630

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe

Substitutes the following executable system files:

<SYSTEM32>\dllcache\msdaenum.dll with <SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdadc.dll with <SYSTEM32>\dllcache\msdadc.dll.new
<SYSTEM32>\dllcache\msdfmap.dll with <SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaorar.dll with <SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdaora.dll with <SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\msdaer.dll with <SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaremr.dll with <SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msaddsr.dll with <SYSTEM32>\dllcache\msaddsr.dll.new
<SYSTEM32>\dllcache\msadds.dll with <SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msadcs.dll with <SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdarem.dll with <SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msdaprst.dll with <SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll with <SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msdaosp.dll with <SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\oledb32r.dll with <SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\oledb32.dll with <SYSTEM32>\dllcache\oledb32.dll.new
<SYSTEM32>\dllcache\msxactps.dll with <SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\wab32res.dll with <SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\wab32.dll with <SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll with <SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msdaurl.dll with <SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\msdasql.dll with <SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\msdasc.dll with <SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdaps.dll with <SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msdatt.dll with <SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\msdatl3.dll with <SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll with <SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\mssoapr.dll with <SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\mssoap1.dll with <SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\fp4autl.dll with <SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\spttseng.dll with <SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\spcommon.dll with <SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\wisc10.dll with <SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\vgx.dll with <SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\spcplui.dll with <SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\dao360.dll with <SYSTEM32>\dllcache\dao360.dll.new
<SYSTEM32>\dllcache\triedit.dll with <SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\sapi.dll with <SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\msader15.dll with <SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\msadcf.dll with <SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msadcer.dll with <SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadce.dll with <SYSTEM32>\dllcache\msadce.dll.new
<SYSTEM32>\dllcache\msadcor.dll with <SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msadco.dll with <SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcfr.dll with <SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\directdb.dll with <SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msador15.dll with <SYSTEM32>\dllcache\msador15.dll.new
<SYSTEM32>\dllcache\msadomd.dll with <SYSTEM32>\dllcache\msadomd.dll.new
<SYSTEM32>\dllcache\msado15.dll with <SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\msjro.dll with <SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\msadrh15.dll with <SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadox.dll with <SYSTEM32>\dllcache\msadox.dll.new

Infects the following executable files:

<SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msaddsr.dll.new
%PROGRAM_FILES%\FireFox\AccessibleMarshal.dll
<SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msadox.dll.new
<SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadce.dll.new
<SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\oledb32.dll.new
<SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\msdadc.dll.new
<SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msador15.dll.new
C:\Far2\Plugins\FarCmds\FARCmds.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
C:\Far2\Plugins\ProcList\Proclist.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Plugins\MacroView\MacroView.dll
C:\Far2\Plugins\Network\Network.dll
C:\Far2\Plugins\Compare\Compare.dll
C:\Far2\FExcept\ExcDump.dll
C:\Far2\FExcept\FExcept.dll
C:\Far2\Far.exe
C:\Far2\FExcept\demangle32.dll
C:\Far2\Plugins\7-Zip\7-ZipFar.dll
C:\Far2\Plugins\Brackets\Brackets.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\arclite\7z.dll
C:\Far2\Plugins\arclite\arclite.dll
<SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\msadomd.dll.new
%CommonProgramFiles%\System\Ole DB\MSDAIPP.DLL
<SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\dao360.dll.new
<SYSTEM32>\dllcache\msinfo32.exe.new
C:\Far2\Plugins\WinSCP\WinSCP.dll
%CommonProgramFiles%\Microsoft Shared\VC\msdia80.dll
<SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\sapisvr.exe.new

Creates the following files on removable media:

<Drive name for removable media>:\Bloc-notes.exe
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\ZPSvCXUi_backup.exe
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\RCX9.tmp
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\ZPSvCXUi.exe
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\mOUwafoo.cpl

Malicious functions:

Creates and executes the following:

'%TEMP%\svchost.exe'
'%TEMP%\cEcmQpCd.exe'

Executes the following:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cvqtuegj.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "%TEMP%\vbc7.tmp"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1z8mwarj.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "%TEMP%\vbc5.tmp"

Injects code into

the following system processes:

<SYSTEM32>\wbem\wmiprvse.exe
<SYSTEM32>\alg.exe
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\cmd.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
<SYSTEM32>\cscript.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\csrss.exe
<SYSTEM32>\smss.exe
<SYSTEM32>\services.exe
%WINDIR%\Explorer.EXE
<SYSTEM32>\svchost.exe
<SYSTEM32>\lsass.exe

a large number of user processes.

Modifies file system :

Creates the following files:

%TEMP%\windowsupdate.ico
%TEMP%\EyLUfGZu.resources
%TEMP%\vbc5.tmp
%TEMP%\RES6.tmp
%TEMP%\1z8mwarj.exe
%TEMP%\gDe.resources
%TEMP%\cvqtuegj.out
%TEMP%\vbc7.tmp
%TEMP%\RES8.tmp
%TEMP%\whatdafock.txt
%TEMP%\cvqtuegj.0.vb
%TEMP%\cvqtuegj.cmdline
%TEMP%\~TM1.tmp
%TEMP%\~TM2.tmp
%TEMP%\087A4c0L.resources
%TEMP%\VYpDoBUt.resources
%TEMP%\cEcmQpCd.exe
%TEMP%\svchost.exe
%TEMP%\MSNPSharp.dll
%HOMEPATH%\niuydqre.log
%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe
%TEMP%\~TM4.tmp
%TEMP%\1z8mwarj.0.vb
%TEMP%\1z8mwarj.cmdline
%TEMP%\1z8mwarj.out

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe

Deletes the following files:

%TEMP%\cvqtuegj.cmdline
%TEMP%\cvqtuegj.0.vb
%TEMP%\RES8.tmp
%TEMP%\vbc7.tmp
%TEMP%\cvqtuegj.out
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\ZPSvCXUi_backup.exe
<Drive name for removable media>:\RECYCLER\S-5-6-62-8420208240-1472184048-175835343-5503\ZPSvCXUi.exe
%TEMP%\EyLUfGZu.resources
%TEMP%\gDe.resources
%TEMP%\windowsupdate.ico
%TEMP%\~TM4.tmp
%TEMP%\RES6.tmp
%TEMP%\~TM1.tmp
%TEMP%\~TM2.tmp
%TEMP%\vbc5.tmp
%TEMP%\1z8mwarj.out
%TEMP%\1z8mwarj.0.vb
%TEMP%\1z8mwarj.exe
%TEMP%\1z8mwarj.cmdline

Network activity:

Connects to:

'aw#####btuitbyatr.com':443
'qw#######ntbyjdtyhvsdtrhr.com':443
'ye####rtxwerh.com':443
'74.##5.232.51':80
'17#.#3.169.14':80
'aw######ybrstuktdybstr.com':443

UDP:

DNS ASK aw#####btuitbyatr.com
DNS ASK qw#######ntbyjdtyhvsdtrhr.com
DNS ASK ye####rtxwerh.com
DNS ASK google.com
DNS ASK yt#####dghvcfgbgvdf.com
DNS ASK aw######ybrstuktdybstr.com

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial