BackDoor.Tdss.9860

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\Msi.Patch\shell\Open\command] '' = '"<SYSTEM32>\msiexec.exe" /p "%1" %*'
[<HKLM>\SOFTWARE\Classes\Msi.Package\shell\Open\command] '' = '"<SYSTEM32>\msiexec.exe" /i "%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Malicious functions:

Creates and executes the following:

'C:\gbfxe.exe'
'C:\cclx.exe'
'C:\uhjb.exe'
'C:\vefuq.exe'
'C:\baif.exe'
'C:\sbvyj.exe'
'C:\-1998166001'
'C:\vwhqlwgw.exe'
'C:\ofgitsly.exe'
'C:\bktdl.exe'
'%TEMP%\IXP000.TMP\msiinst.exe' /i instmsi.msi /qb+
'%TEMP%\IXP000.TMP\msiexec.exe' /regserver
'%TEMP%\nss3.tmp\InstMsiW.exe'
'%TEMP%\nss3.tmp\Apps.exe'
'%TEMP%\nss3.tmp\EP.exe'
'C:\mmpmegx.exe'
'C:\ryxy.exe'
'%TEMP%\nss3.tmp\e4u.exe'
'%TEMP%\IXP000.TMP\msiexec.exe' /i instmsi.msi /qb+
'%TEMP%\IXP000.TMP\msiexec.exe' /V
'C:\cclx.exe' (downloaded from the Internet)
'C:\gbfxe.exe' (downloaded from the Internet)
'C:\-1998166001' (downloaded from the Internet)
'C:\vefuq.exe' (downloaded from the Internet)
'C:\baif.exe' (downloaded from the Internet)
'C:\uhjb.exe' (downloaded from the Internet)
'C:\mmpmegx.exe' (downloaded from the Internet)
'C:\ryxy.exe' (downloaded from the Internet)
'C:\vwhqlwgw.exe' (downloaded from the Internet)
'C:\sbvyj.exe' (downloaded from the Internet)
'C:\ofgitsly.exe' (downloaded from the Internet)
'C:\bktdl.exe' (downloaded from the Internet)

Executes the following:

'<SYSTEM32>\msiexec.exe' /regserverCA

Injects code into

the following system processes:

<SYSTEM32>\spoolsv.exe

Modifies file system :

Creates the following files:

C:\ofgitsly.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\hohhveswgc[1].php
C:\Config.Msi\2b58b.rbs
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\irxhiiffp[1].php
C:\bktdl.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\zgzzjjwli[1].php
C:\baif.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ohnbbyyif[1].php
C:\ryxy.exe
%WINDIR%\Installer\MSI8.tmp
C:\uhjb.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\iouvvfgcd[1].php
C:\cclx.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bhrnbylv[1].php
C:\-1998166001
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bhanx[1].php
C:\gbfxe.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zfpcdmakt[1].php
C:\sbvyj.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\jqqankx[1].php
C:\vwhqlwgw.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wtqanbo[1].php
C:\vefuq.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mbhrobl[1].php
%TEMP%\IXP000.TMP\msihnd.dll
%TEMP%\IXP000.TMP\msiexec.exe
%TEMP%\IXP000.TMP\msi.dll
%TEMP%\IXP000.TMP\imagehlp.dll
%TEMP%\IXP000.TMP\cabinet.dll
%TEMP%\IXP000.TMP\msimsg.dll
%TEMP%\nss3.tmp\EP.exe
%TEMP%\nss3.tmp\InstMsiW.exe
%TEMP%\nsx2.tmp
%TEMP%\IXP000.TMP\msiinst.exe
%TEMP%\nss3.tmp\e4u.exe
%TEMP%\nss3.tmp\Apps.exe
%WINDIR%\Installer\2b58a.msi
%WINDIR%\Temp\5.tmp
<SYSTEM32>\spool\prtprocs\w32x86\4.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hnkppz[1].php
C:\mmpmegx.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wcyijjt[1].php
%TEMP%\IXP000.TMP\usp10.dll
%TEMP%\IXP000.TMP\riched20.dll
%TEMP%\IXP000.TMP\mspatcha.dll
%TEMP%\IXP000.TMP\instmsi.msi
%TEMP%\IXP000.TMP\shfolder.dll
%TEMP%\IXP000.TMP\msls31.dll

Deletes the following files:

<SYSTEM32>\spool\prtprocs\w32x86\4.tmp
%WINDIR%\Temp\5.tmp
C:\Config.Msi\2b58b.rbs
%WINDIR%\Installer\MSI8.tmp
%TEMP%\nss3.tmp\e4u.exe
%TEMP%\nss3.tmp\Apps.exe
%TEMP%\nss3.tmp\InstMsiW.exe
%TEMP%\nss3.tmp\EP.exe

Network activity:

Connects to:

'ab###der.com':80
'fr####rts-2009.com':80

TCP:

HTTP GET requests:

ab###der.com/tdfpmmn/wtqanbo.php?ad########
ab###der.com/tdfpmmn/mbhrobl.php?ad########
ab###der.com/tdfpmmn/jqqankx.php?ad########
ab###der.com/tdfpmmn/bhanx.php?ad#################################################
ab###der.com/tdfpmmn/zfpcdmakt.php?ad########
ab###der.com/tdfpmmn/bhrnbylv.php?ad########
ab###der.com/tdfpmmn/irxhiiffp.php?ad########
ab###der.com/tdfpmmn/ohnbbyyif.php?ad########
ab###der.com/tdfpmmn/hnkppz.php?ad########
ab###der.com/tdfpmmn/wcyijjt.php?ad########
ab###der.com/tdfpmmn/zgzzjjwli.php?ad########
ab###der.com/tdfpmmn/hohhveswgc.php?ad########
ab###der.com/tdfpmmn/iouvvfgcd.php?ad########