my.exe - A Second PWS Trojan Infection

Windows Security Tutorials - Herong's Tutorial Examples

∟PWS (Password Stealer) Trojan Infection Removal

∟my.exe - A Second PWS Trojan Infection

This section describes a second possible PWS Trojan infection that executed my.exe from C:\WINDOWS\Temp and another .exe file from C:\WINDOWS\system32. Both of them tried to install .sys files.

3 hours later on the same day, more Trojan activities were detected by McAfee VirusScan. See OnAccessScanLog.txt log file records below:

<date> 9:34:40 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\Temp\my.exe
   c:\windows\system32\drivers\beep.sys PWS-Mmorpg.gen (Trojan)

<date> 9:34:41 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\Temp\my.exe
   C:\WINDOWS\SYSTEM32\DRIVERS\BEEP.SYS PWS-Mmorpg.gen (Trojan)

<date> 9:34:42 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\Temp\my.exe
   C:\WINDOWS\system32\drivers\beep.sys PWS-Mmorpg.gen (Trojan)

<date> 9:35:00 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM 
   C:\WINDOWS\system32\yvspqn.exe C:WINDOWS\system32\drivers\opxyz.sys

<date> 9:35:00 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe c:\windows\system32\drivers\opxyz.sys 
   PWS-Mmorpg.gen (Trojan)

<date> 9:35:00 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:\WINDOWS\SYSTEM32\DRIVERS\OPXYZ.SYS 
   PWS-Mmorpg.gen (Trojan)

<date> 9:35:01 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:\WINDOWS\system32\drivers\opxyz.sys 
   PWS-Mmorpg.gen (Trojan)

<date> 9:36:05 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:WINDOWS\SYSTEM32\PCXYQR.EXE PWS-Mmorpg.gen (Trojan)

<date> 9:36:05 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:\WINDOWS\system32\pcxyqr.exe\pcxyqr.exe\0000d500.EXE 
   PWS-Mmorpg.gen (Trojan)

<date> 9:36:06 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:\WINDOWS\SYSTEM32\BPCXYQ.EXE PWS-Mmorpg.gen (Trojan)

<date> 9:36:06 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32
   \yvspqn.exe C:\WINDOWS\system32\bpcxyq.exe\bpcxyq.exe\0000d500.EXE 
   PWS-Mmorpg.gen (Trojan)

As you can see that 2 more malicious executable programs, my.exe and yvspqn.exe, got installed and executed, similar to xyoqrxybpq.exe mentioned in the previous section.

But there were some things new here in these records:

The execution owner was NT AUTHORITY\SYSTEM instead of hyang. This tells me that the Trojan has gained access with a system user role.
The location of my.exe was in the C:\WINDOWS\Temp folder, not in the C:\WINDOWS\system32 folder.
The Trojan is trying to install malicious .sys files into the C:\WINDOWS\system32\drivers folder.