Method of Infection
When executed, Bube.A copies itself to
%System%\soft.exe.
It then modifies the registry to ensure that this file is executed at each Windows start:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\run\Web Service = "%System%\soft.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\run\Web Service =" %System%\soft.exe"
HKCU\Software\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}\StubPath = "%System%\soft.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run = "%System%\soft.exe"
Note: '%System%' and '%Windows%' are variable locations. The trojan determines the location of these folders by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
Back to top
Payload
Modifies files
Bube terminates the process explorer.exe, modifies it, and then re-opens it. The trojan then overwrites the following copies of explorer.exe if they exist:
%Windows%\ServicePackFiles\i386\explorer.exe
%System%\dllcache\explorer.exe
Modifies Registry
The trojan alters the following registry value so as to disable System Restore, making the restoration of the file more difficult:
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR = 1
The trojan alters the following registry values associated with the Security Center in Windows XP Service Pack 2, setting them to zero:
HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify
HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify
HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify
as well as disabling automatic updates by altering the following registry values:
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions
Backdoor Functionality
The trojan contacts a site on the www.admin2cash.biz domain in order to receive commands, probably concerned with downloading and installing adware and/or other trojans. This part of the payload is performed by the modified explorer.exe.
Back to top
For additional information:
On Windows XP machines, the following File Protection dialog will be shown when explorer.exe is altered:
Analysis by Matt McCormack
Back to top