Trojan.Click2.47282

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %CommonProgramFiles%\Microsoft\CTHELPER.EXE'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\msnapa] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\Marvell\install\pt\ins_lude.bin'
'%PROGRAM_FILES%\Microsoft Office\smss.exe'
'%PROGRAM_FILES%\Marvell\install\mtn\ins_ludelan.bin'
'%PROGRAM_FILES%\WinRAR\ntserver.dat'
'%CommonProgramFiles%\CTHELPER.EXE'
'%CommonProgramFiles%\Microsoft\khalshared\sessmgr.bin'
'%PROGRAM_FILES%\WinRAR\Probe2.bin'

Executes the following:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\sc.exe' start msnapa
'<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 128 %PROGRAM_FILES%\WinRAR\inetsvr.inf
'<SYSTEM32>\runonce.exe' -r

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pv3[1].asp
%PROGRAM_FILES%\Marvell\install\pt\never.txt
%PROGRAM_FILES%\Marvell\install\pt\krnln.fnr
%PROGRAM_FILES%\Marvell\install\mtn\in_paodan.b
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ip[1]
%PROGRAM_FILES%\WinRAR\tmp_778147433196.tmp
%PROGRAM_FILES%\Marvell\install\pt\zlib1.dll
%PROGRAM_FILES%\WinRAR\inetsvr.inf
%PROGRAM_FILES%\Microsoft Office\krnln.fnr
%PROGRAM_FILES%\Microsoft Office\smss.exe
%PROGRAM_FILES%\Marvell\install\pt\again.dll
%PROGRAM_FILES%\Marvell\install\pt\ins_lude.bin
%PROGRAM_FILES%\Marvell\install\pt\in_paodan.b
%PROGRAM_FILES%\Microsoft Office\debug-starttime.txt
%PROGRAM_FILES%\WinRAR\seri.ini
%PROGRAM_FILES%\Marvell\install\mtn\never.txt
%PROGRAM_FILES%\WinRAR\tmp_360122993085.tmp
%PROGRAM_FILES%\WinRAR\tmp_55596766209.tmp
%PROGRAM_FILES%\WinRAR\tmp_85598337574.tmp
%PROGRAM_FILES%\Microsoft Office\debug-startp.txt
%PROGRAM_FILES%\Marvell\install\mtn\zlib1.dll
%PROGRAM_FILES%\Marvell\install\mtn\again.dll
%PROGRAM_FILES%\Marvell\install\mtn\ins_ludelan.bin
%PROGRAM_FILES%\Microsoft Office\debug-start.txt
%PROGRAM_FILES%\Microsoft Office\onceagain.sc
%PROGRAM_FILES%\Marvell\install\mtn\krnln.fnr
%CommonProgramFiles%\com.run
%CommonProgramFiles%\krnln.fnr
%CommonProgramFiles%\Storeymyadmin.exe
%CommonProgramFiles%\res\tc3.tmp
%CommonProgramFiles%\res\tc2.tmp
%CommonProgramFiles%\res\tc1.tmp
%TEMP%\E_4\com.run
<Current directory>\res\fz2.tmp
<Current directory>\res\fz1.tmp
%TEMP%\E_4\krnln.fnr
%CommonProgramFiles%\Microsoft\com.run
%CommonProgramFiles%\Microsoft\krnln.fnr
%CommonProgramFiles%\Microsoft\Storeymyadmin.exe
%PROGRAM_FILES%\WinRAR\com.run
%PROGRAM_FILES%\WinRAR\krnln.fnr
%CommonProgramFiles%\Microsoft\Microsoft.ini
%PROGRAM_FILES%\WinRAR\ntserver-1.sc
%CommonProgramFiles%\Microsoft\khalshared\cPv.ini
%PROGRAM_FILES%\WinRAR\LVComon-1.txt
%CommonProgramFiles%\Microsoft\khalshared\sessmgr.bin
%CommonProgramFiles%\onceagain.sc
%CommonProgramFiles%\mi.g
%CommonProgramFiles%\res\tc4.tmp
%CommonProgramFiles%\Microsoft\khalshared\com.run
%CommonProgramFiles%\Microsoft\khalshared\krnln.fnr
%CommonProgramFiles%\Microsoft\cVer.ini

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\Microsoft Office\onceagain.sc
%PROGRAM_FILES%\Marvell\install\mtn\never.txt
%CommonProgramFiles%\onceagain.sc
%PROGRAM_FILES%\Marvell\install\pt\never.txt

Deletes the following files:

%PROGRAM_FILES%\WinRAR\tmp_85598337574.tmp
%PROGRAM_FILES%\WinRAR\tmp_55596766209.tmp
%PROGRAM_FILES%\WinRAR\tmp_360122993085.tmp
%PROGRAM_FILES%\WinRAR\tmp_778147433196.tmp
%PROGRAM_FILES%\WinRAR\inetsvr.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ip[1]

Moves the following files:

from %PROGRAM_FILES%\WinRAR\ntserver-1.sc to %PROGRAM_FILES%\WinRAR\ntserver-2.sc
from %PROGRAM_FILES%\WinRAR\LVComon-3.txt to %PROGRAM_FILES%\WinRAR\Probe2.bin
from %PROGRAM_FILES%\WinRAR\ntserver-3.sc to %PROGRAM_FILES%\WinRAR\ntserver.dat
from %PROGRAM_FILES%\WinRAR\ntserver-2.sc to %PROGRAM_FILES%\WinRAR\ntserver-3.sc
from %CommonProgramFiles%\Storeymyadmin.exe to %CommonProgramFiles%\CTHELPER.EXE
from %CommonProgramFiles%\Microsoft\Storeymyadmin.exe to %CommonProgramFiles%\Microsoft\CTHELPER.EXE
from %PROGRAM_FILES%\WinRAR\LVComon-2.txt to %PROGRAM_FILES%\WinRAR\LVComon-3.txt
from %PROGRAM_FILES%\WinRAR\LVComon-1.txt to %PROGRAM_FILES%\WinRAR\LVComon-2.txt

Network activity:

Connects to: