ThreatExpert Report: Trojan.Fakeavalert, Trojan-Downloader.Win32.Agent.cgxu, FakeAlert-CM..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 18 July 2009, 00:12:31
Processing time: 7 min 39 sec
Submitted sample:

File MD5: 0x687B3419EC8092620EDF5F55096A897D
File SHA-1: 0xD04D58B07F04BC047AED739E07253CDD5D0393E9
Filesize: 74,755 bytes
Alias:

Trojan.Fakeavalert [Symantec]
Trojan-Downloader.Win32.Agent.cgxu [Kaspersky Lab]
FakeAlert-CM [McAfee]
Mal/EncPk-IV [Sophos]
TrojanDownloader:Win32/FakeRean [Microsoft]
Trojan-Dropper.Agent [Ikarus]
Win-Trojan/Agent.74755 [AhnLab]

Summary of the findings:

What's been found	Severity Level
Attempts to use BITS (Background Intelligent Transfer Service). Some threats are known to use BITS to evade firewall filtering and download files without firewall inspection.
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
RogueAntiSpyware.PCDefender	RogueAntispyware.PCDefender is fake antispyware that tries to get attention from users by prompting them to register and buy their products.
Adware.Component.Generic	Common Components that may be used by AdMedia, Adware.Allsum, Adware.Agent.BN, Trojan.Downloader.VideoCach and other adwares.

Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\Microsoft\Network\Downloader\qmgr0.dat	5,242 bytes	MD5: 0x1259F7DC6D9412E812BCF81847DD18EE SHA-1: 0x38BA42B9794184C65A6E59A0F9131B04F093BE79	(not available)
2	%CommonAppData%\Microsoft\Network\Downloader\qmgr1.dat	4,232 bytes	MD5: 0xA1E4448BAC117DB80A515A41B9584FEA SHA-1: 0x910B4A725C79472733F6B38874B42D40E3732459	(not available)
3	%AppData%\bh1.bat	173 bytes	MD5: 0x322E7ACB7A804290A5DA665EFE30C12A SHA-1: 0xCE0DFCD3CAE9DCD70846266C841B1B0A803A9B0A	(not available)
4	%Windir%\kernel32lib.dll	29,184 bytes	MD5: 0x8080C00839C9EE53BCEB1FAEB2349F24 SHA-1: 0xE76AE8242FF9BB6E840445433F95DD0F53E4B09A	Trojan.Fakeavalert [Symantec] Mal/Generic-A [Sophos] Trojan:Win32/Tibs.gen!lds [Microsoft]
5	[file and pathname of the sample #1]	74,755 bytes	MD5: 0x687B3419EC8092620EDF5F55096A897D SHA-1: 0xD04D58B07F04BC047AED739E07253CDD5D0393E9	Trojan.Fakeavalert [Symantec] Trojan-Downloader.Win32.Agent.cgxu [Kaspersky Lab] FakeAlert-CM [McAfee] Mal/EncPk-IV [Sophos] TrojanDownloader:Win32/FakeRean [Microsoft] Trojan-Dropper.Agent [Ikarus] Win-Trojan/Agent.74755 [AhnLab]

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directory was created:

%CommonAppData%\Microsoft\Network\Downloader

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	151,552 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

The following system services were modified:

Service Name	Display Name	New Status	Service Filename
BITS	Background Intelligent Transfer Service	"Running"	%System%\svchost.exe -k netsvcs
wscsvc	Security Center	"Stopped"	%System%\svchost.exe -k netsvcs

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}
HKEY_CURRENT_USER\Software\WinPC Defender

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\VersionIndependentProgID]

(Default) = "VMwareApp.VMware"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\TypeLib]

(Default) = "{b360243e-09e8-402f-8721-00b6798089ad}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\ProgID]

(Default) = "VMwareApp.VMware.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}\InprocServer32]

(Default) = "%Windir%\kernel32lib.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}]

(Default) = "VMware Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib]

(Default) = "{B360243E-09E8-402F-8721-00B6798089AD}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}]

(Default) = "_IBhoAppEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib]

(Default) = "{B360243E-09E8-402F-8721-00B6798089AD}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]

(Default) = "IBhoApp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0\win32]

(Default) = "%Windir%\kernel32lib.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\HELPDIR]

(Default) = "%Windir%\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0]

(Default) = "VMware 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware\CurVer]

(Default) = "VMwareApp.VMware.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware\CLSID]

(Default) = "{f2acf493-e0f5-41dd-a6da-ec66a88b382c}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware]

(Default) = "VMware Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware.1\CLSID]

(Default) = "{f2acf493-e0f5-41dd-a6da-ec66a88b382c}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VMwareApp.VMware.1]

(Default) = "VMware Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

AntiVirusDisableNotify = "1"
FirewallDisableNotify = "1"
UpdatesDisableNotify = "1"

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f2acf493-e0f5-41dd-a6da-ec66a88b382c}]

NoExplorer = 0x00000001

[HKEY_CURRENT_USER\Control Panel\don't load]

scui.cpl = "No"
wscui.cpl = "No"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

NotifyDownloadComplete = "yes"

[HKEY_CURRENT_USER\Software\WinPC Defender]

Minimize = "0"
Start = "1"
Scan = "1"
id = "103"
UpdateDate = "19-06-2009"
fstart = "1"
site = "http://payorderthis.com/pp2/?id="

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

AntiVirusDisableNotify = 0x00000001
FirewallDisableNotify = 0x00000001
UpdatesDisableNotify = 0x00000001

Other details

Analysis of the file resources indicate the following possible country of origin:

Ukraine

To mark the presence in the system, the following Mutex objects were created:

_SHuassist.mtx
CritOpMutex

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
911pornox.com	80	(null)	(null)

The following GET request was made:

videosz.php

Heuristics Analysis

Heuristically identified capability to use BITS (Background Intelligent Transfer Service) to schedule the following download task:

http://911pornox.com/installed.php?id=103

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.