Gen.Variant.Adware.Symmi.41092_bd17d95d0e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:1096
gpupdate.exe:764
%original file name%.exe:1384

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1384 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome.manifest (149 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\ffMediaWatchV1home8316.js (747 bytes)
%System%\GroupPolicy\Machine\Registry.pol (408 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\overlay.xul (344 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (224 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\install.rdf (788 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\icons\default\MediaWatchV1home8316_32.png (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB3.tmp\aminsis.dll (18748 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ie\MediaWatchV1home8316.dll (1467 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\uninstall.exe (11397 bytes)
C:\extensions.ini (83 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ch\MediaWatchV1home8316.crx (1568 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\icons\Thumbs.db (564 bytes)
%System%\GroupPolicy\gpt.ini (315 bytes)
%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\ffMediaWatchV1home8316ffaction.js (678 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsfB2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB3.tmp\aminsis.dll (0 bytes)

Registry activity

The process regsvr32.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 89 FD 7B 94 B1 7F B3 33 2F EF DF C1 A6 6B 6F"

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}\InprocServer32]
"(Default)" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\ie\MediaWatchV1home8316.dll"

[HKCR\Interface\{36A74137-E66D-402D-9E75-C7A1D0320CA6}]
"(Default)" = "IMediaWatchV1home8316BHO"

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{36A74137-E66D-402D-9E75-C7A1D0320CA6}\TypeLib]
"Version" = "1.1"

[HKCR\Interface\{36A74137-E66D-402D-9E75-C7A1D0320CA6}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}]
"(Default)" = "MediaWatchV1home8316"

[HKCR\Interface\{36A74137-E66D-402D-9E75-C7A1D0320CA6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{FE98987B-878C-48A6-B681-1239F5D03F63}\1.1]
"(Default)" = "MediaWatchV1home8316Lib"

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}\Version]
"(Default)" = "1.1"

[HKCR\TypeLib\{FE98987B-878C-48A6-B681-1239F5D03F63}\1.1\HELPDIR]
"(Default)" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\ie"

[HKCR\Interface\{36A74137-E66D-402D-9E75-C7A1D0320CA6}\TypeLib]
"(Default)" = "{FE98987B-878C-48A6-B681-1239F5D03F63}"

[HKCR\TypeLib\{FE98987B-878C-48A6-B681-1239F5D03F63}\1.1\0\win32]
"(Default)" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\ie\MediaWatchV1home8316.dll"

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}\TypeLib]
"(Default)" = "{fe98987b-878c-48a6-b681-1239f5d03f63}"

[HKCR\TypeLib\{FE98987B-878C-48A6-B681-1239F5D03F63}\1.1\FLAGS]
"(Default)" = "0"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8afda607-2367-462f-b161-becee009ecde}]
"(Default)" = "MediaWatchV1home8316"

"NoExplorer" = "1"

The process gpupdate.exe:764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 98 11 E7 FD 96 A3 15 95 65 7D 0D E1 D9 C4 74"

The process %original file name%.exe:1384 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"NoModify" = "1"

[HKLM\SOFTWARE\Google\Chrome\Extensions\ppmchhbfeheohajbnoogelfhonjabong]
"Version" = "1.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"DisplayIcon" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\uninstall.exe"
"DisplayName" = "Media Watch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software\Policies\Google\Chrome\ExtensionInstallWhitelist]
"1" = "ppmchhbfeheohajbnoogelfhonjabong"

[HKLM\SOFTWARE\MediaWatchV1home8316\Components]
"CH" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"UninstallString" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"Publisher" = "Media Watch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Mozilla\Firefox\extensions]
"ext@MediaWatchV1home8316.net" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\ff"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"NoRepair" = "1"
"DisplayVersion" = "1.1"

[HKLM\SOFTWARE\MediaWatchV1home8316\Components]
"ie" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"gpupdate.exe" = "Microsoft® Group Policy Refresh Utility"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsvB3.tmp\aminsis.dll,"

[HKLM\SOFTWARE\MediaWatchV1home8316]
"Path" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316"

[HKLM\SOFTWARE\MediaWatchV1\Media Watch]
"Installed" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{8afda607-2367-462f-b161-becee009ecde}" = "51 66 7A 6C 4C 1D 3B 1B 17 B9 E7 97 54 72 43 0C"

[HKLM\SOFTWARE\MediaWatchV1home8316\Components]
"ff" = "1"

[HKLM\SOFTWARE\Google\Chrome\Extensions\ppmchhbfeheohajbnoogelfhonjabong]
"Path" = "%Program Files%\MediaWatchV1\MediaWatchV1home8316\ch\MediaWatchV1home8316.crx"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 E3 22 C5 C9 CB DC 82 12 66 5B 6E C3 90 48 2E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaWatchV1home8316]
"URLInfoAbout" = ""

[HKCR\CLSID\{8afda607-2367-462f-b161-becee009ecde}]
"(Default)" = "Media Watch"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software\Policies\Google\Chrome\ExtensionInstallWhitelist]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software\Policies\Google]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software\Policies]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}Machine\Software\Policies\Google\Chrome]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{274D8D2F-EAC4-420F-B5FA-2028E87CB89E}User]

Dropped PE files

MD5	File path
51ba1095f0ae45a2d444bea506cb9ad4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsvB3.tmp\aminsis.dll
a0c88a2e2b84896a3bef110746662bed	c:\Program Files\MediaWatchV1\MediaWatchV1home8316\ie\MediaWatchV1home8316.dll
f986ae5d5a445b51d7c680e5516f85b8	c:\Program Files\MediaWatchV1\MediaWatchV1home8316\uninstall.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   regsvr32.exe:1096
   gpupdate.exe:764
   %original file name%.exe:1384

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome.manifest (149 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\ffMediaWatchV1home8316.js (747 bytes)
   %System%\GroupPolicy\Machine\Registry.pol (408 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\overlay.xul (344 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (224 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\install.rdf (788 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\icons\default\MediaWatchV1home8316_32.png (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB3.tmp\aminsis.dll (18748 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ie\MediaWatchV1home8316.dll (1467 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\uninstall.exe (11397 bytes)
   C:\extensions.ini (83 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ch\MediaWatchV1home8316.crx (1568 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\icons\Thumbs.db (564 bytes)
   %System%\GroupPolicy\gpt.ini (315 bytes)
   %Program Files%\MediaWatchV1\MediaWatchV1home8316\ff\chrome\content\ffMediaWatchV1home8316ffaction.js (678 bytes)

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Media Watch
Product Name: Media Watch home 8316
Product Version: 1.1
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1
File Description:
Comments:
Language: English (United States)

Company Name: Media WatchProduct Name: Media Watch home 8316Product Version: 1.1Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.1File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	45056	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	237568	3120	3584	2.92164	813e5a36ad046c0e3f27fadc0a3fbee1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 921
66840532e694f3313495d419a8de01d3
843604fa73df1c46cdf81c87cbb180ea
e36fb129673e7b52096f40f3b850c687
dc87bbc730b0c5838a1cde61ed835d51
158f2ccb716304c727b06d988ceaac0b
eb28c2a06fcfc69d405b7d7b19d76a69
3f1782d3393e6953f7bbbb02e6a55048
fb23bc26230b6c36024878c018e8601a
4d5f46b65f2f609a682d5524ca6dc60c
002f72c934bc04a02244435a7293a831
bbf3653c95900c95ad3bc40769234903
4feb3e46c0e80a2c926babd6b764b09a
650fba80462cb8553381a92989eba87d
8d8fe08878652bee0f2794cc8f021f82
0229becf239707ea1ca8d86215dc33ab
322e0c3eed8db63cbb179026c951c04b
40b65d02f87e33a20e633877c31f8a97
898d5ed5eff308af6b381627e574e27a
03e29863f924d46b672c192188fef174
df5fc4dea8a2266bff8314b0693ac540
76affeb516b57062b88d6874474017fa
2756ee04e3082ac2813b83f7c136f45b
3cdc4ddb5f6ba60d1ab75685e4bcbb0e
e986f15ea9d4355f7577d511187e7d7f
f1bb36543560036033170282a6196536

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

wuauclt.exe_540:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

wuauclt.pdb

wuauclt.pdb

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

msvcrt.dll

msvcrt.dll

ntdll.dll

ntdll.dll

ole32.dll

ole32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyExW

ADVAPI32.dll

ADVAPI32.dll

USER32.dll

USER32.dll

OLEAUT32.dll

OLEAUT32.dll

SHLWAPI.dll

SHLWAPI.dll

zcÁ

zcÁ

version="6.0.0.0"

version="6.0.0.0"

name="Microsoft.Windows.windowsupdate.wuauclt"

name="Microsoft.Windows.windowsupdate.wuauclt"

true

true

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

wuaueng.dll

wuaueng.dll

Error: 0xx. wuauclt handler: failed to spawn COM server

Error: 0xx. wuauclt handler: failed to spawn COM server

Error: 0xx. wuauclt handler: failed to load wuaueng

Error: 0xx. wuauclt handler: failed to load wuaueng

/ReportNow

/ReportNow

/ShowWindowsUpdate

/ShowWindowsUpdate

/CloseWindowsUpdate

/CloseWindowsUpdate

wuauclt.exe failed to get proc address for UI export object with error %#lx

wuauclt.exe failed to get proc address for UI export object with error %#lx

Failed to load %s with error %X

Failed to load %s with error %X

wucltui.dll

wucltui.dll

wucltux.dll

wucltux.dll

call RunAUClientUI on wucltui.dll/wucltux.dll

call RunAUClientUI on wucltui.dll/wucltux.dll

Ntdll.dll

Ntdll.dll

WuSqm %ls session datapoint (id:%d) is incremented with dword %d.

WuSqm %ls session datapoint (id:%d) is incremented with dword %d.

wuauclt.exe is exiting with code 0xX

wuauclt.exe is exiting with code 0xX

wuauclt.exe launched with command line %s

wuauclt.exe launched with command line %s

kernel32.dll

kernel32.dll

WUWeb

WUWeb

Report

Report

7.6.7600.256

7.6.7600.256

Global\WindowsUpdateTracingMutex

Global\WindowsUpdateTracingMutex

WindowsUpdate.log

WindowsUpdate.log

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace

Windows

Windows

shell32.dll

shell32.dll

%s: %s [

%s: %s [

%s: %s

%s: %s

%s\%s

%s\%s

= Module: %s

= Module: %s

= Module:

= Module:

= Process: %s

= Process: %s

= Process:

= Process:

=========== Logging initialized (build: %s, tz: %s) ===========

=========== Logging initialized (build: %s, tz: %s) ===========

wups2.dll

wups2.dll

wups.dll

wups.dll

Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\

Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\

%hs %ls page "%ls", hr=%X

%hs %ls page "%ls", hr=%X

Microsoft.WindowsUpdate

Microsoft.WindowsUpdate

wupdmgr.exe

wupdmgr.exe

Failed to cocreate IShellWindows, error = 0xlX

Failed to cocreate IShellWindows, error = 0xlX

Failed to obtain window doc for window %d, error = 0xlX

Failed to obtain window doc for window %d, error = 0xlX

Failed to obtain folder view for window %d, error = 0xlX

Failed to obtain folder view for window %d, error = 0xlX

Failed to obtain folder IPersist for window %d, error = 0xlX

Failed to obtain folder IPersist for window %d, error = 0xlX

Window %d is NOT a WU window

Window %d is NOT a WU window

Done enumerating windows

Done enumerating windows

Quit for window %d failed: 0xlX

Quit for window %d failed: 0xlX

Window %d is a WU window. Attempting to close

Window %d is a WU window. Attempting to close

Failed to obtain class ID for window %d, error = 0xlX

Failed to obtain class ID for window %d, error = 0xlX

Got NULL disp interface for window %d

Got NULL disp interface for window %d

Got %d instead of VT_DISPATCH for window %d

Got %d instead of VT_DISPATCH for window %d

Failed to obtain IWebBrowserApp for window %d, error = 0xlX

Failed to obtain IWebBrowserApp for window %d, error = 0xlX

Failed to enumerate window %d, error = 0xlX

Failed to enumerate window %d, error = 0xlX

Found %d explorer windows

Found %d explorer windows

Closing WU explorer windows

Closing WU explorer windows

Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData

Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData

WUAppNotificationWindows

WUAppNotificationWindows

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\

%chdhd

%chdhd