Win32/Trapwot

Installation

The malware copies itself to %TEMP%\<10 random lower case characters>\<8 random lower case characters>.exe, for example %TEMP%\xmblgfoftc\mqtagaea.exe.

It changes the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: <malware's file name without the extension>
With data: <location and name of the malware>

The malware then launches the new copy.

This copy searches the %TEMP% folder and all subfolders for files with the extension .dat. If any are found, it will attempt to decrypt the file as a DLL, load its content into memory, and run it.

If it is unable to find a suitable file, it will attempt to contact a remote host, download an encrypted file, and save it to the same folder as the malware with a filename of <9 random lower case characters>.dat (for example, ehyvohbi.dat).

We have seen it connect to spyware-defender.com to download the file.

It will then decrypt the file as a DLL, load its content into memory, and run it.

Payload

Displays fake scanner

The malware performs a fake scan of your computer, and falsely claims that a number of files on your computer are infected with malware. If you use the fake scan to try to clean the reported infections, you will be prompted to pay money to register the program before it cleans the infected files.

Some examples of the interface, fake alerts, fake scanning results, and pop-ups displayed by the malware are shown below. The malware has a superficial resemblance to Microsoft Security Essentials and other Microsoft antimalware products.

Modifies Security Settings

The malware might modify a number of registry entries to lower your PC's security settings.

It attempts to disable checking for digital signatures on downloaded programs, and to allow software to run if the digital signature is invalid.

In subkey: HKCU\Software\Microsoft\Internet Explorer\Download
Sets value: CheckExeSignatures
With data: "no"

Sets value: RunInvalidSignatures
With data: 1

In subkey:  HKCU\Software\Microsoft\Internet Explorer\Main
Sets value: Error Dlg Displayed On Every Error
With data: "no"

Sets value: Disable Script Debugger
With data: "yes"

Sets value: DisableScriptDebuggerIE
With data: "yes"

It attempts to disable preserving zone information in file attachments (for example, if a file originated from the Internet):

In subkey : HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
Sets value: SaveZoneInformation
With data: 1

It attempts to prevent the display of a security alert when attempting to download files with a .exe extension:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
Sets value: LowRiskFileTypes
With data: ".exe"

Blocks access to websites

The malware installs itself as web proxy running on the local machine (127.0.0.1) on a port such as 46209. This setting can be found in Internet Explorer by:

1. Open Internet options by clicking the gear symbol in the Internet Explorer toolbar, then clicking Internet options.
2. Go to the Connections tab, then click LAN Settings.
3. In the Proxy server section click Advanced.

The malware monitors browsing activity and blocks access to sites which contain any of the following substrings:

• about.com
• aol.com
• ask.com
• avast
• avg
• avira
• bing.com
• bitdefender
• blogspot
• cloudantivirus
• facebook.com
• gmail
• google
• hotmail
• inbox.com
• instagram.com
• linkedin.com
• live.com
• msn.com
• norton
• outlook.com
• tumblr.com
• twitter.com
• yahoo.com
• youtube

Instead it displays a window similar to the following:

Opens web browser windows

The malware might periodically open Internet Explorer windows that go to websites with adult content.

Additional information

The malware uses the following task bar and system tray icons. These appear to be identical to those used by Microsoft Security Essentials.

Analysis by David Wood