Troj/Karag-Q exhibits the following characteristics:
File Information
- Size
- 134K
- SHA-1
- 5ee0d8c03188cdbb0bafddd216f5a0fc9ced93a1
- MD5
- d5d034945a89c76d9c94742dcd1b2480
- CRC-32
- 1e1c0f3c
- File type
- Windows executable
- First seen
- 2012-11-14
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Application Data\Task Scheduler\Task Scheduler.exe
Dropped Files
- c:\Documents and Settings\test user\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#get-locked.info\settings.sol
- Size
- 56
- SHA-1
- e8e182dd9908aa9390895ea3d61f1c6847cd6c24
- MD5
- 06d353b92678bb534c15082820056860
- CRC-32
- 5d7f2cd5
- File type
- Unspecified binary - probably data
- First seen
- 2012-11-14
- c:\Documents and Settings\test user\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- Size
- 184
- SHA-1
- 715e7b21d7707e7b1e68e46e13fa1062ef620056
- MD5
- fb0a9544bed8fdf0262443180538f199
- CRC-32
- 8031da3c
- File type
- Unspecified binary - probably data
- First seen
- 2012-11-14
- c:\Documents and Settings\test user\Start Menu\Programs\Startup\Task Scheduler.lnk
- Size
- 695
- SHA-1
- 3325f04a64e6ae0b5631d70a5839c705cf92e8d5
- MD5
- 08c60694cf87edc2ff35d0e29c724965
- CRC-32
- 4b49eaba
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2012-09-11
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Task Scheduler
- "c:\Documents and Settings\test user\Application Data\Task Scheduler\Task Scheduler.exe"
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
- "c:\Documents and Settings\test user\Application Data\Task Scheduler\Task Scheduler.exe"
- DisableNXShowUI
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
- "c:\Documents and Settings\test user\Application Data\Task Scheduler\Task Scheduler.exe"
- DisableNXShowUI
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Task Scheduler
- "c:\Documents and Settings\test user\Application Data\Task Scheduler\Task Scheduler.exe"
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012111420121115
- CacheRepair
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- HideIcons
- 0x00000001
- HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
- Name
- Task Scheduler.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
- DisableTaskMgr
- 0x00000001
Processes Created
- c:\Documents and Settings\test user\application data\task scheduler\task scheduler.exe
- c:\windows\system32\ipconfig.exe
HTTP Requests
- http://get-locked.info/usa/bg_USA.jpg
- http://get-locked.info/usa/fresh_buttons/buttons.css
- http://get-locked.info/usa/index.php
- http://get-locked.info/usa/jquery-ui.css
- http://get-locked.info/usa/jquerywebcamhelper.swf
- http://get-locked.info/usa/js/jquery-ui.js
- http://get-locked.info/usa/js/jquery.flash.js
- http://get-locked.info/usa/js/jquery.min.js
- http://get-locked.info/usa/js/jquery.webcam.js
- http://get-locked.info/usa/js/keyboard.js
DNS Requests