Trojan.Click2.35476

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updmgr' = '%CommonProgramFiles%\updmgr\updmgr.exe'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\sheclangs.scr'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\IncrediFind\BHO\setup.exe guidgenerate
%CommonProgramFiles%\updmgr\updmgr.exe
%CommonProgramFiles%\updmgr\rvupdmgr.exe updmgr.exe
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe 84722637-E866-4188-A9D7-45C915C61A76ended
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe CD074655-28AD-4899-A6A1-3DE8476C4CCDended 0EBBB0F8-2504-404F-8A4B-EF2953B72002
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe dateandtime
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe 84722637-E866-4188-A9D7-45C915C61A76start
%PROGRAM_FILES%\ScreenSavers\sheclangs\incredifind_williamhung.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\regw.exe SCRNSAVE.EXE <SYSTEM32>\sheclangs.scr
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe 90D0BD04-B5E7-4E58-89B0-817A4D624177start
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe 90D0BD04-B5E7-4E58-89B0-817A4D624177ended
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup_powersearch_williamhung.exe

Executes the following:

%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.si###arch.com/toolbar/partner/williamhung/installed.html
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.si###arch.com/toolbar/partner/williamhung/failed.html?gg##################################################################################################################

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\IncrediFind\BHO\guid.txt
%PROGRAM_FILES%\IncrediFind\BHO\IncFindBHO150.dll
%PROGRAM_FILES%\IncrediFind\BHO\date.txt
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe
%CommonProgramFiles%\updmgr\simgr.exe
%CommonProgramFiles%\updmgr\data1.dat
%CommonProgramFiles%\updmgr\data2.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tracker[1].cfm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mgmt[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mgmt[1].htm
%TEMP%\IncrediFindBHOLog.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tracker[1].cfm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tracker[1].cfm
%CommonProgramFiles%\updmgr\updmgr.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\incredifind_williamhung.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup_powersearch_williamhung.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tracker[1].cfm
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe
<SYSTEM32>\sheclangs.scr
%PROGRAM_FILES%\ScreenSavers\sheclangs\regw.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\uninstall.ico
%PROGRAM_FILES%\PowerSearch\Toolbar\pwrshung.dll
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe
%CommonProgramFiles%\updmgr\rvupdmgr.exe
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ScreenSavers\sheclangs\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ScreenSavers\sheclangs\Configure ScreenSaver.lnk

Deletes the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mgmt[1].htm
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mgmt[1].htm
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\IncrediFind\BHO\guid.txt
%PROGRAM_FILES%\IncrediFind\BHO\date.txt

Network activity:

Connects to:

'up####.#hunderdownloads.com':80
'localhost':1045
'localhost':1048
'localhost':1040
'localhost':1035
'tr######.thunderdownloads.com':80
'localhost':1039

TCP:

HTTP GET requests:

tr######.thunderdownloads.com/tracker.cfm?ac###########################################################################################################
tr######.thunderdownloads.com/tracker.cfm?ac##################################################################
tr######.thunderdownloads.com/tracker.cfm?ac###############################################################

HTTP POST requests: