Trojan.Click1.63090

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '161d939f6661d24c.exe' = '<LS_APPDATA>\161d939f6661d24c.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\189e4bfa2188754f] 'Start' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\189e4bfa2188754f] 'ImagePath' = '<DRIVERS>\189e4bfa2188754f.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\25673] 'Start' = '00000001'

Malicious functions:

Creates and executes the following:

<LS_APPDATA>\161d939f6661d24c.exe

Hooks the following functions in System Service Descriptor Table (SSDT):

NtOpenThread, handler: 189e4bfa2188754f.sys
NtOpenProcess, handler: 189e4bfa2188754f.sys

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\hralert_back[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\greenalert_back[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\alert_button[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\background[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\redcross_list[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\greencheck_list[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\r_t_bl[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\cr[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\l_t_bl[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\r_b_bl[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\l_b_bl[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\redalert_back[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\menu_configuration[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\header_button[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\red_arrow_back[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\hr_back[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\menu_firewall[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\menu_perform_scan[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\menu_main[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\menu_internet_security[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\menu_proactive_defence[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\menu_personal_security[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\style[2].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\alert_reg[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\alert_danger[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\13[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\serial[1].html
%HOMEPATH%\Desktop\Buy Advanced PC Shield 2012.lnk
<DRIVERS>\25673.sys
<LS_APPDATA>\161d939f6661d24c.exe
<DRIVERS>\189e4bfa2188754f.sys
%HOMEPATH%\Start Menu\Programs\Advanced PC Shield 2012\Buy Advanced PC Shield 2012.lnk
%HOMEPATH%\Start Menu\Programs\Advanced PC Shield 2012\Launch Advanced PC Shield 2012.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\base.alert[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\scripts[1].js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\DD_belatedPNG[2].js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\style[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\style[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\base.index[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\base.reg[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\base.reset[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\14[1].html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\base.reset[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\DD_belatedPNG[1].js

Deletes the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\DD_belatedPNG[1].js
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\style[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\style[1].css
<DRIVERS>\25673.sys
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\base.reset[1].css
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\base.reset[1].css

Moves itself: