BackDoor.Spy.2600

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[\REGISTRY\USER\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] '9Y7Y1ZUJWF7XWA0VSTOD' = 'C:\Recycle.Bin\B6232F3A48D.exe'

Malicious functions

Injects code into

the following user processes:

b6232f3a48d.exe
xanb23e.exe
iexplore.exe
firefox.exe

Hooks functions

in browsers

firefox.exe process, wininet.dll module
iexplore.exe process, advapi32.dll module
iexplore.exe process, crypt32.dll module
firefox.exe process, advapi32.dll module
firefox.exe process, crypt32.dll module
iexplore.exe process, wininet.dll module

Modifies settings of Windows Internet Explorer

[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{00,00,00,00}'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1409' = '00000003'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1409' = '00000003'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1409' = '00000003'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1406' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1409' = '00000003'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'

Modifies file system

Creates the following files

C:\recycle.bin\b6232f3a48d.exe
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\index.dat
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\low\index.dat
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\q821h772\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\9wtbxkep\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\qouzwe3x\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\ccguzu8f\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
%WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
%WINDIR%\temp\xanb23e.exe
C:\recycle.bin\45a9b7866343df4
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@www.microsoft[1].txt

Sets the 'hidden' attribute to the following files

%WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\ccguzu8f\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\qouzwe3x\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\9wtbxkep\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\q821h772\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini

Deletes itself.

Network activity

TCP

HTTP GET requests