Gen.Variant.Adware.Graftor.153852_6e07c3041d

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Installer creates the following process(es):

%original file name%.exe:1552

The Installer injects its code into the following process(es):

setup.exe:264

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process setup.exe:264 makes changes in the file system.

The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)

The process %original file name%.exe:1552 makes changes in the file system.

The Installer creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (7345 bytes)

The Installer deletes the following file(s):

C:\%original file name%.exe (0 bytes)

Registry activity

The process setup.exe:264 makes changes in the system registry.

The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 14 08 E4 A7 E0 24 36 A9 9F 08 F9 73 4D 1B 18"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Installer modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Installer modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Installer modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Installer deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1552 makes changes in the system registry.

The Installer creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 67 AB BA 04 0C 64 F6 59 05 7C 69 16 91 C1 A0"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1552

2. Delete the original Installer file.
   
3. Delete or disinfect the following files created/modified by the Installer:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (7345 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Install Manager
Product Name: Download Manager
Product Version: 2.0.66.0
Legal Copyright: (c) Install Manager
Legal Trademarks:
Original Filename: setup.exe
Internal Name: setup.exe
File Version: 2.0.66.0
File Description: Download Manager
Comments:
Language: English (United States)

Company Name: Install Manager Product Name: Download Manager Product Version: 2.0.66.0Legal Copyright: (c) Install Manager Legal Trademarks: Original Filename: setup.exeInternal Name: setup.exeFile Version: 2.0.66.0File Description: Download ManagerComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1888256	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1892352	864256	862208	5.49421	52d136d6f5c5d3d5445c6b0134d9d33f
.rsrc	2756608	65536	64000	3.60973	1e03c7cc29a7241fa53c2be3e99dfb53

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 226
01687b82e003e54cdcf7e227a62928a1
8e12b9a457b1c73287426c799c5ae0a6
020269fc981552d6d314487df6c1acad
ff83757c9f8b23299c6dc9073e757617
8ac232e8c803cf9994b79d623337aac8
60888bf7bb4c2bb74d2cfc605be97019
dac3061d4ec78ec1d6924fe2a7d3a377
2c0e2cef9fabbf17b96affa61440f478
93dbaa899f4fbf1aaa8a233f6b51a36d
882e6b8a06246f99720fc34f4ec948f3
0d7b202eedba55687de1f31be38a839e
de38de7d2e6b3bf877f6fdbb81a5a6f3
109c7b6805e04284540529b036b8ed89
692935f295561f9c3baa5709a91d3411
041984c562cabea6d2e18de32f49861c
5ee8f3dfa6194bac4eb18bf98e1d83fa
34170675f4bea8cd0ed3e388604f7c05
c2ba2a4ae310845605ae555ab094b226
e5a26e91dde9ce541a7b4d04c99d8c12
cc6e3c92c6a5703b5797bb75095aa756
c4f341d3647db4cdc80687420cc85e90
39ccdb0a8e9fd4531761ad28f22cf525
9bd82d6eda07f9012c2ec0816f0e0c1d
68e141edba56a1957db5d75eab1176dc
f97aaf76bba26082d839d5b86643681d
8dae9a9ca27d52c64e623ac54f306360

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Installer connects to the servers at the folowing location(s):

Strings from Dumps

setup.exe_264:

`.rsrc

`.rsrc

G SSh

G SSh

SSSSSSh

SSSSSSh

f;T$.uBf

f;T$.uBf

QSShXc_

QSShXc_

tFHt:Ht.Ht"Hu`

tFHt:Ht.Ht"Hu`

j%XtL9E

j%XtL9E

SSSSh

SSSSh

t'SShl

t'SShl

u$SShe

u$SShe

tWSShW

tWSShW

tl9_ tgSSh

tl9_ tgSSh

FTCP

FTCP

u.PhD6]

u.PhD6]

tAHt.HHt

tAHt.HHt

FtPW

FtPW

SSh@B

SSh@B

s%j.Zf

s%j.Zf

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

CCmdTarget

CCmdTarget

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

CNotSupportedException

CNotSupportedException

CHttpConnection

CHttpConnection

CHttpFile

CHttpFile

RegDeleteKeyExW

RegDeleteKeyExW

CMDITabProxyWnd

CMDITabProxyWnd

CMDIChildWndEx

CMDIChildWndEx

CMDIFrameWndEx

CMDIFrameWndEx

TaskDialogIndirect

TaskDialogIndirect

CMDIChildWnd

CMDIChildWnd

CMDIFrameWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMDIClientAreaWnd

CMFCToolBarsKeyboardPropertyPage

CMFCToolBarsKeyboardPropertyPage

cmd.exe

cmd.exe

GetProcessWindowStation

GetProcessWindowStation

operator

operator

portuguese-brazilian

portuguese-brazilian

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

taskkill /f /im iexplore.exe

taskkill /f /im iexplore.exe

taskkill /f /im chrome.exe

taskkill /f /im chrome.exe

taskkill /F /IM firefox.exe

taskkill /F /IM firefox.exe

Keys

Keys

urlmon

urlmon

RegOpenKeyTransactedW

RegOpenKeyTransactedW

 

EULA

Privacy Policy