sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

Trial 2
Nteps, soapr, to691 are removed to test if these files are needed for the malware to start.
Windows update traffic starts after 1:40 min of starting rundll for startup. At iexplore exit
ccalc32.sys immediately appeared. ~HLV files appear about 1:20 min after the appearance of
ccalc32.sys. The exact timestamp was 23:45:00 (local time), the sharp seconds value (:00)
seems suspicious.
Results: nteps, soapr, to691 are not needed for startup
Trial 4
Starting with Rundll32 at 23:49:20
23:51:06 windowsupdate traffic begins
23:52:48 iexplore quits, about 3 seconds later ccalc appears
23:54:25 ~HVL files found in windows/temp
msglu32.ocx exists, creation time is 2004, change time is current local time
Trial 5
Removing nteps, soapr, to691, msglu to be sure that msglu is indeed created during startup.
Results: Malware is still running, msglu32 is created just at the same time as ~HLV files begin
to be created. Order of events:
1. iexplore + windowsupdate traffic
2. traffic stops, ccalc32 created, some 1:20 min delay
3. ~HLV files begin to appear and msglu is deployed
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 16