There are two samples that I fetched from this forum, with guessing it as the subject (looks wrong ones in the end..)
Both work with the same logic. so let's call it as per filename TcpAdaptorService.exe I started with the below details.
Yes I run it:
![Image](../../lh4.googleusercontent.com/-uOAZej9Y-NA/UQplcIVR7SI/AAAAAAAAKMU/DGQcsfWYFF8/s487/001.jpg)
It run net command & executed net1.exe to start the malicious daemon process:
![Image](../../lh3.googleusercontent.com/-HlcTYd-oLxI/UQple1fBrhI/AAAAAAAAKMk/Mx3lJDGrepo/s655/002.jpg)
In the end this process/daemon is responsible for everything and stays resident.
With the service name retalix:
During infecting, it runs this operation:
http://pastebin.com/raw.php?i=99FE4MYs
You'll see registry, file queries. The points is, it sets this Cryptography values (see long above/ not FP, important to crack the crypt)
Code: Select all"RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: 6D 7B CA A8 FF C8 F9 02 99 7F B6 FD 9C 12 11 DE"
Additionally the below values are queried:
Code: Select allHKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
HKLM\System\CurrentControlSet\Control\Terminal Server\TSUserEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
HKLM\System\CurrentControlSet\Control\ServiceCurrent\(Default)","SUCCESS","Type: REG_DWORD, Length: 4, Data: 13"
HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode","NAME NOT FOUND","Length: 16"
You'll see more details in pastebin, so what about the Daemon/Process kicked ?
This is the full log:
http://pastebin.com/raw.php?i=U08Re7GF
And the highlights are: The computer name info, Terminal Server & \WinSock2\Parameters data was grabbed.
In memory we know how it executed:
What had happened if we let this run?
Actually NO networking at my monitoring case.. Oh yes I captured every traffic fo rsome hours, PoC:
Capture Data;
I had memory dump strings here
http://pastebin.com/raw.php?i=80kHafVK with binary here
http://www.mediafire.com/?7alsybv27c9rwvt
All the registry I shot is here:
http://pastebin.com/raw.php?i=KrPg2n23 <maybe There's a little miss, pls check/
Sorry cant share the PCAP for privacy purpose..(nothing in there anyway)