Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CgaViewer' = '%ProgramFiles%\CyberGatekeeper Agent\cgav.exe -check'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CgaHelper' = '%ProgramFiles%\CyberGatekeeper Agent\cgahelp.exe -check'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\CGAgent] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CGAgent] 'ImagePath' = '"%ProgramFiles%\CyberGatekeeper Agent\cgasvc.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\CafeDrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CafeDrv] 'ImagePath' = 'system32\DRIVERS\CafeDrv.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\Iexim] 'ImagePath' = 'system32\DRIVERS\iexim.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\sr] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\sr] 'ImagePath' = 'system32\DRIVERS\sr.sys'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Modifies file system:
Creates the following files:
- %TEMP%\cga.msi
- %WINDIR%\Installer\23850.msi
- %WINDIR%\Installer\MSI33.tmp
- %WINDIR%\Installer\MSI32.tmp
- <DRIVERS>\SET31.tmp
- %WINDIR%\inf\oem5.PNF
- %WINDIR%\inf\oem5.inf
- %TEMP%\Cab2F.tmp
- %TEMP%\Cab2D.tmp
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\oem4.inf
- %TEMP%\Cab29.tmp
- %TEMP%\Cab27.tmp
- <DRIVERS>\SET23.tmp
- %WINDIR%\Installer\{7B9DAF97-68AB-4107-AD5E-E07FE5DA254B}\ProductIcon.exe
- %WINDIR%\inf\INFCACHE.0
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %TEMP%\Cab21.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %WINDIR%\Installer\MSI1E.tmp
- %WINDIR%\Installer\MSI1D.tmp
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI24.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\{7B9DAF97-68AB-4107-AD5E-E07FE5DA254B}\CgavIcon.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %WINDIR%\Installer\MSI1B.tmp
- %ProgramFiles%\CyberGatekeeper Agent\EmaWSC.dll
- %WINDIR%\Installer\MSI38.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- %WINDIR%\Installer\MSI37.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
- %WINDIR%\Installer\MSI35.tmp
- %ProgramFiles%\CyberGatekeeper Agent\EmaAuthx86.dll
- %WINDIR%\Installer\MSI34.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- %ProgramFiles%\CyberGatekeeper Agent\EMAHttp.dll
- %WINDIR%\Installer\MSI1A.tmp
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI18.tmp
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baseim.cat
- %ProgramFiles%\CyberGatekeeper Agent\cgagent.ini
- %ProgramFiles%\CyberGatekeeper Agent\cgagent.exe
- %ProgramFiles%\CyberGatekeeper Agent\Drv\CafeDrv.sys
- %ProgramFiles%\CyberGatekeeper Agent\Drv\CafeDrv.inf
- %ProgramFiles%\CyberGatekeeper Agent\Drv\CafeDrv.cat
- %ProgramFiles%\CyberGatekeeper Agent\CafeDrvLib.dll
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baselwf.sys
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baselwf.inf
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baselwf.cat
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baseim.sys
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baseim_m.inf
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\CyberGatekeeper Agent\cgasvc.exe
- %ProgramFiles%\CyberGatekeeper Agent\cga.msi
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\2384f.rbs
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\2384e.ipi
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2384c.msi
- %TEMP%\cgainstall.log
- %ProgramFiles%\CyberGatekeeper Agent\Drv\baseim.inf
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %ProgramFiles%\CyberGatekeeper Agent\cgav.exe
- %ProgramFiles%\CyberGatekeeper Agent\Drv\iexim.inf
- %ProgramFiles%\CyberGatekeeper Agent\iexauth.exe
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSID.tmp
- %ProgramFiles%\CyberGatekeeper Agent\Drv\iexim.cat
- %WINDIR%\Installer\MSIC.tmp
- %ProgramFiles%\CyberGatekeeper Agent\cgahelp.exe
- %WINDIR%\Installer\MSIA.tmp
- %ProgramFiles%\CyberGatekeeper Agent\vsctool.dll
- %ProgramFiles%\CyberGatekeeper Agent\stopcg.exe
- %ProgramFiles%\CyberGatekeeper Agent\NetFilterBaseDrvLib.dll
- %ProgramFiles%\CyberGatekeeper Agent\NetFilter6DrvLib.dll
- %ProgramFiles%\CyberGatekeeper Agent\NetFilter4DrvLib.dll
- <DRIVERS>\iexnet6.sys
- <DRIVERS>\iexnet4.sys
- %ProgramFiles%\CyberGatekeeper Agent\Drv\iexim.sys
- %ProgramFiles%\CyberGatekeeper Agent\Drv\iexim_m.inf
- %ProgramFiles%\CyberGatekeeper Agent\NetFilterDrvLib.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\CyberGatekeeper Agent\CGAgent Viewer.lnk
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
Deletes the following files:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI1D.tmp
- %TEMP%\Cab21.tmp
- %WINDIR%\Installer\MSI1E.tmp
- %TEMP%\Cab27.tmp
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1A.tmp
- %TEMP%\Cab29.tmp
- %WINDIR%\Installer\MSI24.tmp
- %WINDIR%\Installer\MSI32.tmp
- %WINDIR%\Installer\MSI33.tmp
- %WINDIR%\Installer\MSI34.tmp
- %WINDIR%\Installer\MSI35.tmp
- %WINDIR%\Installer\MSI4.tmp
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab2F.tmp
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSIE.tmp
- C:\Config.Msi\2384f.rbs
- %WINDIR%\Installer\MSI37.tmp
Moves the following system files:
- from %WINDIR%\inf\INFCACHE.1 to %WINDIR%\inf\INFCACHE.2
- from %WINDIR%\inf\INFCACHE.2 to %WINDIR%\inf\OLDCACHE.000
Moves the following files:
- from <DRIVERS>\SET23.tmp to <DRIVERS>\CafeDrv.sys
- from <DRIVERS>\SET31.tmp to <DRIVERS>\iexim.sys
Substitutes the following files:
- %WINDIR%\inf\INFCACHE.0
- %WINDIR%\inf\INFCACHE.1
Network activity:
Connects to:
- 'wp#d':80
- 'download.windowsupdate.com':80
- '10.#3.111.6':11698
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'CGAServiceClass' WindowName: ''
- ClassName: 'CyberGateAgentClass' WindowName: 'CyberGateAgentWindow'
Creates and executes the following:
- '%ProgramFiles%\CyberGatekeeper Agent\stopcg.exe' -service -create
- '%ProgramFiles%\CyberGatekeeper Agent\stopcg.exe' -service -nodepends
- '%ProgramFiles%\CyberGatekeeper Agent\stopcg.exe' -service -start
- '%ProgramFiles%\CyberGatekeeper Agent\cgasvc.exe'
- '%ProgramFiles%\CyberGatekeeper Agent\cgagent.exe' Agent\\cgagent.exe
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 866E465E5C56294024A4850E91D463B6
- '<SYSTEM32>\msiexec.exe' -Embedding 1C177115A81C495C7E5F271512DEB2E1 M Global\MSI0000
- '<SYSTEM32>\runonce.exe' -r
