Threat behavior
PWS:Win32/Axespec.A is a trojan that steals sensitive information from the infected computer and injects its code into various processes.
Installation
Upon execution, PWS:Win32/Axespec.A copies itself to %SYSTEM%\svrwsc.exe and then sets the creation date to match that of %SYSTEM%\svchost.exe.
Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
In order for %SYSTEM%\svrwsc.ex to execute at each Windows start, the trojan installs it as a service named “SvrWsc”, using the display name “Windows Security Center Service” and description “The service provides COM APIs for independent software vendors to register and record the state of their products to the Security Center service”.
The trojan attempts to inject code into all running processes, avoiding the following:
-
Svchost.exe
-
Explorer.exe
-
Outlook.exe
-
Msimn.exe
-
Iexplore.exe
-
Firefox.exe
The trojan also creates the following registry entries to store information for its own use:
Adds value: 'MSA'
To subkey: HKLM\Software\Microsoft\DirectX
Adds value: 'MSB'
To subkey: HKLM\Software\Microsoft\DirectX
Payload
Steals sensitive information
PWS:Win32/Axespec.A steals sensitive information from the infected system and posts it to a specific domain.
The trojan steals sensitive information, such as any cookies stored in the users' Mozilla Firefox Profiles folder, as well as any documents saved in the MS Office temporary directory, and then saves this information to a log file that is then sent via a POST command to the domain “musiceng.ru”.
Analysis by Amir Fouda
Prevention
