Report - CrySyS Lab

5. The script also writes an autorun path into the registry for “C:\altnet.exe” by setting the key
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunOnce\altnet”.
6. The script repeats the same checks and steps for “C:\altnet.exe” as in step 3 for IExplore.exe.
7. Finally, the script uses an HTML javascript tag to close the current browser window, an HTML
body section with an “img” reference to image.php and a closing HTML tag (). We
suspect that this file must have been the final part of a larger script.
bi_1.txt
hash: CBF6F449C54F11D4AC28FAD203C1D88A
compile time: 2004-01-24
Most likely a screen capture module.
Creates two files in \Documents and Settings\user\Local Settings\Temp
3.exe and bi~.tmp
3.exe has a hash of ED12789B2EFC87C4F39FA2367755C835 and interestingly does not has valid PE
header. It was created with Borland C++ compiler. It writes to the bi~.tmp file.
The created bi~.tmp observed was of length 11074 bytes long and contains binary data, most likely
some graphical image, e.g screen capture or similar, but we did not analyze this in details.
The same information is also saved to c:\sysdll7.txt by bi_1.exe.
bi_1.exe also starts windows component ntvdm.exe which then writes temporary information into
\windows\temp\scs8.tmp and scs7.tmp in the same directory.
42