Trojan.Win32.Swrort.3_66f786d36a

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

WebProtectorPlus.exe:644
f4.exe:428
f1.exe:1340
%original file name%.exe:316
wmic.exe:1852
LiveUpdateWPP.exe:928
LiveUpdateWPP.exe:312
schtasks.exe:1076
schtasks.exe:1072
f5.exe:1312
find.exe:1800

The Trojan injects its code into the following process(es):

ntvdm.exe:640

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process WebProtectorPlus.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WebProtectorPlus\SetupComponents.exe (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (34 bytes)

The process f4.exe:428 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (6 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe (11656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (11 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (4092 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (0 bytes)

The process f1.exe:1340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WebProtector\ToolbarData.ini (847 bytes)
%Program Files%\WebProtector\WebProtector.dll (3073 bytes)
%Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
%Program Files%\WebProtector\hotbtn.ico (1 bytes)
%Program Files%\WebProtector\btn.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdD.tmp (0 bytes)

The process ntvdm.exe:640 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (10145 bytes)
%System%\wbem\Logs (4 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%WinDir%\Temp\scs10.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (4 bytes)
%Program Files%\WebProtectorPlus (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (676 bytes)
%System%\wbem\Repository\FS (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\WebProtector (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (480 bytes)
C:\$Directory (1284 bytes)
%System% (5152 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (4 bytes)
%WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%System%\wbem (864 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs10.tmp (0 bytes)
%WinDir%\Temp\scs11.tmp (0 bytes)

The process %original file name%.exe:316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (46772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (33956 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (5621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (37172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)

The process wmic.exe:1852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WebProtectorPlus\TempWmicBatchFile.bat (0 bytes)

The process f5.exe:1312 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files%\WebProtectorPlus\uninstall.exe (877 bytes)
%Program Files%\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (6 bytes)
%Program Files%\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files%\WebProtectorPlus\Setup64.bat (466 bytes)
%Program Files%\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files%\WebProtectorPlus\uninst.bat (135 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssA.tmp (12336 bytes)
%Program Files%\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files%\WebProtectorPlus\WebProtectorPlus.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (11 bytes)
%Program Files%\WebProtectorPlus\verdata (16 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc9.tmp (0 bytes)

Registry activity

The process WebProtectorPlus.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WebProtectorPlus]
"SetupComponents.exe" = "SetupComponents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1446831959"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 9C 60 1B AD FF 16 F0 DB DB B8 0F 85 EF B9 6F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process f4.exe:428 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 11 B3 FC AC 58 09 D2 B6 84 20 BF B3 8B 9F 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{9797C852-D94F-40EA-8E5F-7345C207D60A}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"last" = "0"
"IDIR" = "%Program Files%\LiveUpdateWPP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"
"Src" = "9804"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"
"UninstallString" = "%Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe"

The process f1.exe:1340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files%\WebProtector\btn.ico"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "WebProtect IE"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKLM\SOFTWARE\WebProtector]
"Path" = "%Program Files%\WebProtector"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\WebProtector"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"URLInfoAbout" = "http://web-protector.net"
"DisplayIcon" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"
"Publisher" = "WebProtector"
"UninstallString" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files%\WebProtector\hotbtn.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "4.2.0.2645"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B C4 83 49 35 A7 93 B3 31 3E D5 85 F3 46 68 99"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process %original file name%.exe:316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 92 8B 8D ED 8A C1 92 58 53 F7 0C AB B8 0C F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgwNA=="

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "40008F10-885F-465A-A235-D4AB1F3555A7"

The process wmic.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 EE A6 C1 BF E2 F0 06 0D C8 FC 7B 75 F2 8C 6B"

The process LiveUpdateWPP.exe:928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C C6 D8 A4 6F F3 27 B2 45 6D 79 D9 0F 9B 78 67"

The process LiveUpdateWPP.exe:312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B D2 20 3D CB 23 B6 29 0F 28 49 49 4A 6D 30 AB"

The process schtasks.exe:1076 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 2C 4D 4C 1E 7D 0C 6B 82 09 78 91 1C 08 E5 F2"

The process schtasks.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 F5 55 CE D5 12 EC 20 49 4A 30 0B 2C 19 F7 0A"

The process f5.exe:1312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"UninstallString" = "%Program Files%\WebProtectorPlus\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 D7 1A 4A 08 CC 0B F0 C7 C0 84 9D E9 31 D4 0F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files%\WebProtectorPlus"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Protector Plus Agent" = "%Program Files%\WebProtectorPlus\WebProtectorPlus.exe"

The process find.exe:1800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 8C 3D 08 9C 7D 5F 5B 1C 10 B2 E1 C8 EF B3 D0"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   WebProtectorPlus.exe:644
   f4.exe:428
   f1.exe:1340
   %original file name%.exe:316
   wmic.exe:1852
   LiveUpdateWPP.exe:928
   LiveUpdateWPP.exe:312
   schtasks.exe:1076
   schtasks.exe:1072
   f5.exe:1312
   find.exe:1800

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Program Files%\WebProtectorPlus\SetupComponents.exe (177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (34 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (6 bytes)
   %Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe (11656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (11 bytes)
   %Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (4092 bytes)
   %Program Files%\WebProtector\ToolbarData.ini (847 bytes)
   %Program Files%\WebProtector\WebProtector.dll (3073 bytes)
   %Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
   %Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
   %Program Files%\WebProtector\hotbtn.ico (1 bytes)
   %Program Files%\WebProtector\btn.ico (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (11 bytes)
   %WinDir%\Temp\scs11.tmp (10145 bytes)
   %System%\wbem\Logs (4 bytes)
   %Documents and Settings%\%current user%\FAVORITES (4 bytes)
   %WinDir%\Temp\scs10.tmp (33880 bytes)
   %Program Files%\Internet Explorer (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (676 bytes)
   %System%\wbem\Repository\FS (4 bytes)
   %Documents and Settings%\All Users (4 bytes)
   C:\$Directory (1284 bytes)
   %WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
   %WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
   C:\PROGRAM FILES (8 bytes)
   %Documents and Settings%\All Users\Documents (4 bytes)
   %Documents and Settings%\%current user%\My Documents (4 bytes)
   %Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
   %System%\config (8 bytes)
   %Documents and Settings%\All Users\Start Menu (4 bytes)
   %WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
   %Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (46772 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (33956 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (5621 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (37172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)
   %Program Files%\WebProtectorPlus\TempWmicBatchFile.bat (0 bytes)
   %Program Files%\WebProtectorPlus\Setup32.bat (457 bytes)
   %Program Files%\WebProtectorPlus\uninstall.exe (877 bytes)
   %Program Files%\WebProtectorPlus\SetupVista32.bat (449 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (6 bytes)
   %Program Files%\WebProtectorPlus\SetupOld32.bat (429 bytes)
   %Program Files%\WebProtectorPlus\Setup64.bat (466 bytes)
   %Program Files%\WebProtectorPlus\SetupVista64.bat (458 bytes)
   %Program Files%\WebProtectorPlus\uninst.bat (135 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nssA.tmp (12336 bytes)
   %Program Files%\WebProtectorPlus\SetupOld64.bat (438 bytes)
   %Program Files%\WebProtectorPlus\WebProtectorPlus.exe (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (11 bytes)
   %Program Files%\WebProtectorPlus\verdata (16 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Web Protector Plus Agent" = "%Program Files%\WebProtectorPlus\WebProtectorPlus.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name: wprotectplusin4.2.0.1924
Product Name: mwprotectplusin4.2.0.1924p
Product Version: 4.2.0.1924
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.2.0.1924
File Description:
Comments:
Language: Language Neutral

Company Name: wprotectplusin4.2.0.1924Product Name: mwprotectplusin4.2.0.1924pProduct Version: 4.2.0.1924Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 4.2.0.1924File Description: Comments: Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2
777a1efb6dde482d64e6724bffa444b2
1335a16c91bc63153524ffa5ffaa6103

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /c/SetupComponents.exe HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: webprotectionfree.com

Cache-Control: no-cache

HTTP/1.1 403 Forbidden

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:52 GMT

Content-Type: text/html

Content-Length: 177

Connection: keep-alive

<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:52 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep-alive..<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>....

GET /pin.gif?e=tracking&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 HTTP/1.1

User-Agent: Microsoft Internet Explorer

Host: stat.webprotectionfree.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:52 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:52 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;..

GET /node/?s=9804&br=4 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/LiveUpdateWPP_is.exe

0......

GET /c/LiveUpdateWPP_is.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:31 GMT

Content-Type: application/octet-stream

Content-Length: 365343

Last-Modified: Tue, 21 Jul 2015 11:42:33 GMT

Connection: keep-alive

ETag: "55ae3029-5931f"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t..........8............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc...8............z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /node/?s=9804&br=5 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:48 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/SetupWPP.exe

0......

GET /c/SetupWPP.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:48 GMT

Content-Type: application/octet-stream

Content-Length: 257237

Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT

Connection: keep-alive

ETag: "54e9a18a-3ecd5"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s..........(............................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...(............v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /node/?s=9804&br=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:49 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Location: ../c/webprotector_installer.exe

0......

GET /c/webprotector_installer.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:49 GMT

Content-Type: application/octet-stream

Content-Length: 288291

Last-Modified: Wed, 14 Oct 2015 14:06:25 GMT

Connection: keep-alive

ETag: "561e6161-46623"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....n3T.................\...........0.......p....@.......................................@..................................s...........C...........................................................................p...............................text...|Z.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata...@...@...........................rsrc....C.......D...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /pin.gif?e=start&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:31 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:31 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;....

GET /pin.gif?e=installer&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0

Host: stat.webprotectionfree.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Fri, 06 Nov 2015 17:45:52 GMT

Content-Type: image/gif

Content-Length: 34

Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT

Connection: keep-alive

ETag: "54bfc526-22"

Accept-Ranges: bytes

GIF89a.............,...........C.;..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

LiveUpdateWPP.exe_928:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

%b %d %H : %M : %S %Y

%b %d %H : %M : %S %Y

%m / %d / %y

%m / %d / %y

%I : %M : %S %p

%I : %M : %S %p

%d / %m / %y

%d / %m / %y

0123456789-

0123456789-

GetProcessWindowStation

GetProcessWindowStation

operator

operator

()$^.* ?[]|\-{},:=!

()$^.* ?[]|\-{},:=!

C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb

C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb

WTSAPI32.dll

WTSAPI32.dll

USERENV.dll

USERENV.dll

WinHttpReceiveResponse

WinHttpReceiveResponse

WinHttpSetOption

WinHttpSetOption

WinHttpSendRequest

WinHttpSendRequest

WinHttpConnect

WinHttpConnect

WinHttpCloseHandle

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpen

WinHttpOpenRequest

WinHttpOpenRequest

WinHttpCrackUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpReadData

WINHTTP.dll

WINHTTP.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

ReportEventW

ReportEventW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

zcÁ

zcÁ

.?AVARegKey@@

.?AVARegKey@@

.?AVASysWriteKey@@

.?AVASysWriteKey@@

.?AVASysRegKey@@

.?AVASysRegKey@@

11

11

3O5X5

3O5X5

:%:):/:3:(?

:%:):/:3:(?

1 1$1(1,1014181

1 1$1(1,1014181

: :@:\:`:

: :@:\:`:

? ?$?(?,?0?4?`?

? ?$?(?,?0?4?`?

Ckernel32.dll

Ckernel32.dll

Emscoree.dll

Emscoree.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}

{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}

urls

urls

Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.

Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.

AgentTask::Execute :

AgentTask::Execute :

MainTask::Execute

MainTask::Execute

Software\Mozilla\Mozilla Firefox

Software\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__

Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Clients\Windows\StartMenuInternet

Software\Clients\Windows\StartMenuInternet

http\shell\open\command

http\shell\open\command

firefox

firefox

Firefox/

Firefox/

chrome

chrome

Chrome/

Chrome/

opera

opera

OPERA

OPERA

Windows NT

Windows NT

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

ul_cmd

ul_cmd

%s : %s

%s : %s

2.1.1.22

2.1.1.22

%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe

%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe

Maintains your Web Protector Plus synchronized.

Maintains your Web Protector Plus synchronized.

LiveUpdateWPP.exe

LiveUpdateWPP.exe

WebProtectorPlus.exe_644:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

vSSSh

vSSSh

FTPjK

FTPjK

FtPj;

FtPj;

C.PjRV

C.PjRV

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

portuguese-brazilian

portuguese-brazilian

operator

operator

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL