HolisticInfoSec.org
July 3, 2008
Russ McRee
holisticinfosec at gmail.com
STORM SAMPLE: FIREWORKS.EXE
Sample source:
http://66.31.118.34/
Source web page:
Colorful Independence Day Fireworks
 |
| Colorful Independence Day events have already started throughout the country. The largest firework happens on the last weekday before the Fourth of July. Unprecedented sum of money was spent on this fabulous show. If you want to see the best Independence Day firework just click on the video and run it. |
Sample details:
File: fireworks.exe
MD5: d7d350e34809adc4a56e592b58f9d4ad
Size: 118785
---------------------------------------------------------------------------
VirusTotal:
http://www.virustotal.com/analisis/a9d59c2e1f3393fa8f7373d32e327dea
---------------------------------------------------------------------------
Sandbox analysis
Files
New Files C:\WINDOWS\msserv.exe
C:\WINDOWS\msserv.config
Opened Files C:\WINDOWS\AppPatch\sysmain.sdb
C:\WINDOWS\AppPatch\systest.sdb
\Device\NamedPipe\ShimViewer
C:\WINDOWS\msserv.exe
C:\WINDOWS\AppPatch\sysmain.sdb
C:\WINDOWS\AppPatch\systest.sdb
\Device\NamedPipe\ShimViewer
C:\WINDOWS\system32\netsh.exe
C:\WINDOWS\system32\w32tm.exe
\\.\PIPE\lsarpc
C:\WINDOWS\Registration\R00000000000b.clb
\\.\PIPE\lsarpc
C:\WINDOWS\msserv.exe
Deleted Files
Chronological Order Copy File: c:\malware\fireworks.exe to C:\WINDOWS\msserv.exe
Open File: C:\WINDOWS\AppPatch\sysmain.sdb (OPEN_EXISTING)
Open File: C:\WINDOWS\AppPatch\systest.sdb (OPEN_EXISTING)
Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING)
Open File: C:\WINDOWS\msserv.exe ()
Find File: msserv.exe
Open File: C:\WINDOWS\AppPatch\sysmain.sdb (OPEN_EXISTING)
Open File: C:\WINDOWS\AppPatch\systest.sdb (OPEN_EXISTING)
Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING)
Open File: C:\WINDOWS\system32\netsh.exe ()
Find File: netsh.exe
Open File: C:\WINDOWS\system32\w32tm.exe ()
Find File: w32tm.exe
Get File Attributes: C:\WINDOWS\msserv.config Flags: (SECURITY_ANONYMOUS)
Create File: C:\WINDOWS\msserv.config
Open File: \\.\PIPE\lsarpc (OPEN_EXISTING)
Get File Attributes: C:\WINDOWS\Registration Flags: (SECURITY_ANONYMOUS)
Open File: C:\WINDOWS\Registration\R00000000000b.clb (OPEN_EXISTING)
Get File Attributes: C:\WINDOWS\system32\WBEM\Logs\ Flags: (SECURITY_ANONYMOUS)
Open File: \\.\PIPE\lsarpc (OPEN_EXISTING)
Open File: C:\WINDOWS\msserv.exe (OPEN_EXISTING)
Registry
Changes HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "" = C:\WINDOWS\msserv.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "" = C:\WINDOWS\msserv.exe:*:Enabled:enable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Parameters "" = time.windows.com,time.nist.gov
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Parameters "" = NTP
Reads HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter ""
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared ""
HKEY_CURRENT_USER\Keyboard Layout\Toggle ""
HKEY_CURRENT_USER\Keyboard Layout\Toggle ""
HKEY_CURRENT_USER\Keyboard Layout\Toggle ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService ""
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ""
Processes
Process Management Creates Process - Filename () CommandLine: (netsh firewall set allowedprogram "C:\WINDOWS\msserv.exe" enable) As User: () Creation Flags: ()
Creates Process - Filename () CommandLine: (w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov) As User: () Creation Flags: ()
Creates Process - Filename () CommandLine: (w32tm /config /update) As User: () Creation Flags: ()