ThreatExpert Report: Trojan.Gen

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 18 September 2012, 00:52:57
Processing time: 9 min 38 sec
Submitted sample:

File MD5: 0x54D08C10F78E9B952E77FB99F7D9C736
File SHA-1: 0x4284C062EE4C8EADD702648741C0DE820C5F82DB
Filesize: 1,324,520 bytes
Alias & packer info:

Trojan.Gen [Symantec]
packed with: UPX [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DownloadedProgramFiles%\TouchEnKey.dll %System%\TouchEnKey.dll %System%\XecureCK.dll	512,384 bytes	MD5: 0xE949B1DDD50D82F34B774E0825929054 SHA-1: 0x49A93C1F8E85644D29F054529A0D1E6922E5B9BA	(not available)
2	%DownloadedProgramFiles%\TouchEnKey.inf	1,036 bytes	MD5: 0x8C56C9FBF345E42C12C0B4F5BB6075FA SHA-1: 0x1FA03FD1456A8C7D7B67B5F1D4B4DB6F208D2318	(not available)
3	%System%\CKAgent.dat %System%\CKAgent.exe	138,320 bytes	MD5: 0xBFEA1ECB48EAE14087C6236F057669C3 SHA-1: 0x8F8A726EE8A86B9896D648D795BB9AF05A20A15B	(not available)
4	%System%\CKApp.dll	199,760 bytes	MD5: 0x9743813D93640CD918C8034A37B00F9F SHA-1: 0x3B4FB767B566852DD087CECDC082B12BA135F8FF	(not available)
5	%System%\CKCSP.dll	434,428 bytes	MD5: 0x0A8C13A73710F5025FA95D75A1464B1A SHA-1: 0xE920B5CE9AA1A1A1F042E176823E4475228D1C84	(not available)
6	%System%\CKKeyProCert.dll	80,976 bytes	MD5: 0x31856C75B56949AB671C0323A4C8FD69 SHA-1: 0x43EB4A538ECC7B26D4468544B108B60E9AEC694B	(not available)
7	%System%\CKSetup32.dat %System%\CKSetup32.exe	1,260,624 bytes	MD5: 0x84074BCECAAFEDB5EC4809D05B5B47A8 SHA-1: 0xC7FE98D347A596AAD58E625FD7E4DF651FED763F	(not available)
8	%System%\jrsoftcp.dll	134,224 bytes	MD5: 0x7C9C8F7CDAC7C6C8100D53FF26A603BF SHA-1: 0x975BB2DEB325AB532AB1AD0A9B92CF187E7E3CFD	(not available)
9	%System%\JRSUKD25.SYS	22,480 bytes	MD5: 0x139D9D538284EC721D759DF7238B8850 SHA-1: 0xF6E11C776F235295A8EC61970B293A1CDC5C5DC6	(not available)
10	%System%\kcrtx86.sys	126,048 bytes	MD5: 0xCBBC332B9A94D9EB16E3328B50760587 SHA-1: 0x6BF95D3165FCF545B1664509FDE6E99E7CA7DA5B	packed with PE_Patch [Kaspersky Lab]
11	%System%\kcrypto.dll	191,072 bytes	MD5: 0xF9060327C8DB272AC4BF9D52C7022AD5 SHA-1: 0x8ABF59A23A05ABD32616D6ECAD2E196C84CEE204	(not available)
12	%System%\npKeyPro.dll	261,200 bytes	MD5: 0x8FB4DDB690CE4A58794C602AD5010B8E SHA-1: 0x8BEE2A22DFF7529EEF887AE3C53EA0FD0AD57F4C	(not available)
13	[file and pathname of the sample #1]	1,324,520 bytes	MD5: 0x54D08C10F78E9B952E77FB99F7D9C736 SHA-1: 0x4284C062EE4C8EADD702648741C0DE820C5F82DB	Trojan.Gen [Symantec] packed with UPX [Kaspersky Lab]

Notes:

%DownloadedProgramFiles% is a variable that refers to the file system directory containing downloaded program files. A typical path is C:\Windows\Downloaded Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	4,194,304 bytes
CKSetup32.exe	%System%\CKSetup32.exe	1,261,568 bytes
ckagent.exe	%System%\ckagent.exe	139,264 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8FD68F8A-641E-4204-AE47-DD835C1AE756}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XecureCK
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4ABB12B3-8A8B-481D-874A-93E16F930A8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8FD68F8A-641E-4204-AE47-DD835C1AE756}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains\Files
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\DownloadInformation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InstalledVersion
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@softforum.com/npKeyPro
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\VersionIndependentProgID]

(Default) = "XecureCK.XecureCKKB"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\ProgID]

(Default) = "XecureCK.XecureCKKB.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InprocServer32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\VersionIndependentProgID]

(Default) = "XecureCK.XecureCKEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\ProgID]

(Default) = "XecureCK.XecureCKEventSink.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\InprocServer32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}]

(Default) = "IXecureCKEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}]

(Default) = "IXecureCKKB"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0\win32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\HELPDIR]

(Default) = "%DownloadedProgramFiles%\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0]

(Default) = "XecureCK 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CurVer]

(Default) = "XecureCK.XecureCKEventSink.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CLSID]

(Default) = "{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1\CLSID]

(Default) = "{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CurVer]

(Default) = "XecureCK.XecureCKKB.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CLSID]

(Default) = "{6CE20149-ABE3-462E-A1B4-5B549971AA38}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1\CLSID]

(Default) = "{6CE20149-ABE3-462E-A1B4-5B549971AA38}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

Compatibility Flags = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8FD68F8A-641E-4204-AE47-DD835C1AE756}]

Compatibility Flags = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

AppName = "CKAgent.exe"
AppPath = "%Windir%\system32"
Policy = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XecureCK]

DisplayName = "TouchEn Key with E2E for 32bit"
UninstallString = "%System%\CKSetup32.exe /uninstall"
DisplayIcon = "%System%\CKSetup32.exe "
Publisher = "SoftSecurity Co., Ltd."
URLInfoAbout = "http://www.softsecurity.co.kr/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains\Files]

%DownloadedProgramFiles%\TouchEnKey.dll = ""
%System%\CKApp.dll = ""
%System%\CKSetup32.exe = ""
%System%\Jrsoftcp.dll = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InstalledVersion]

(Default) = "3,1,0,3"
LastModified = "Tue, 18 Sep 2012 07:53:05 GMT"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\DownloadInformation]

CODEBASE = "[file and pathname of the sample #1]"
INF = "%DownloadedProgramFiles%\TouchEnkey.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

Installer = "MSICD"
SystemComponent = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@softforum.com/npKeyPro]

Path = "%System%\npKeyPro.dll"
Description = "SoftForum?TouchEn?Key"
ProductName = "SoftForum?TouchEn?Key"
Vendor = "SoftForum Co., Ltd."
Version = ""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000]

Service = "JRSKD24"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000]

Service = "kcrtx86"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Enum]

0 = "Root\LEGACY_JRSKD24\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\JRSKD24.SYS"
DisplayName = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Enum]

0 = "Root\LEGACY_KCRTX86\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\kcrtx86.sys"
DisplayName = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000]

Service = "JRSKD24"

Other details

Analysis of the file resources indicate the following possible country of origin:

Republic of Korea

To mark the presence in the system, the following Mutex objects were created:

TouchEnKeyRunningMutex
CKSetup32Running
_mtx_CKAgent_Running
@mtx_CKAgent

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.