JAVA_ADWIND.USMGBFBG

Infection Channel:

Dropped by other malware, Downloaded from the Internet

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

File Size:

532,556 bytes

File Type:

JAR

Memory Resident:

Yes

Initial Samples Received Date:

04 Sep 2018

Payload:

Drops files, Terminates processes, Connects to URLs/IPs

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

%Application Data%\Oracle\{Copies of files under Java installation folder}
%User Profile%\TTHRemLiVBI\ID.txt
%User Profile%\fUTkALeaTxM\ID.txt
%User Temp%\_0.{random numbers}.class
%User Profile%\.oracle_jre_usage\{random filename}.timestamp
%User Profile%\{Random Characters}.{Random Characters}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It drops and executes the following files:

%User Temp%\Retrive{random numbers}.vbs
%User Temp%\{Random string}.reg

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following processes:

xcopy "%Program Files%\Java\jre{version}" "%Application Data%\Oracle\" /e ← copy files and directory trees of Java Installation folder to %Application Data%\Oracle folder
attrib +h "%User Profile%\{random characters}\*.*" ← set attribute of all files under the folder to hidden
attrib +h "%User Profile%\{random characters}" ← set attribute of folder to hidden
%System%\taskkill.exe /IM {process name} /T /F ← where {process name} could be one of the following processes terminated by the malware

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

%User Profile%\TTHRemLiVBI
%User Profile%\fUTkALeaTxM
%Application Data%\Oracle

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

Autostart Technique

This Trojan creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Characters} = "%Application Data%\Oracle\bin\javaw.exe" -jar "%User Profile%\{Random Characters}\{Random Characters}.{Random Characters}"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = .avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;

HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorUser = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System value
PromptOnSecureDesktop = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableConfig = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableSR = 1

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

AVK.exe
AVKProxy.exe
AVKService.exe
AVKTray.exe
AVKWCtlx64.exe
AdAwareDesktop.exe
AdAwareService.exe
AdAwareTray.exe
AgentSvc.exe
BDSSVC.EXE
Bav.exe
BavSvc.exe
BavTray.exe
BavUpdater.exe
BavWebClient.exe
BgScan.exe
BullGuarScanner.exe
BullGuard.exe
BullGuardBhvScanner.exe
BullGuardUpdate.exe
CONSCTLX.EXE
CertReg.exe
CisTray.exe
ClamTray.exe
ClamWin.exe
ConfigSecurityPolicy.exe
EMLPROXY.EXE
FCDBlog.exe
FCHelper64.exe
FPAVServer.exe
FPWin.exe
FProtTray.exe
FSHDLL64.exe
FSM32.EXE
FSMA32.EXE
FilMsg.exe
FilUp.exe
FortiClient.exe
FortiClient_Diagnostic_Tool.exe
FortiESNAC.exe
FortiFW.exe
FortiProxy.exe
FortiSSLVPNdaemon.exe
FortiTray.exe
GDKBFltExe32.exe
GDSC.exe
GDScan.exe
GdBgInx64.exe
K7AVScan.exe
K7CrvSvc.exe
K7EmlPxy.EXE
K7FWSrvc.exe
K7PSSrvc.exe
K7RTScan.exe
K7SysMon.Exe
K7TSMain.exe
K7TSMngr.exe
K7TSecurity.exe
LittleHook.exe
MCS-Uninstall.exe
MCShieldCCC.exe
MCShieldDS.exe
MCShieldRTM.exe
MSASCui.exe
MWAGENT.EXE
MWASER.EXE
MpCmdRun.exe
MpUXSrv.exe
MsMpEng.exe
NS.exe
NisSrv.exe
ONLINENT.EXE
OPSSVC.EXE
PSANHost.exe
PSUAMain.exe
PSUAService.exe
ProcessHacker.exe
PtSessionAgent.exe
PtSvcHost.exe
PtWatchDog.exe
QUHLPSVC.EXE
SAPISSVC.EXE
SASCore64.exe
SASTask.exe
SBAMSvc.exe
SBAMTray.exe
SBPIMSvc.exe
SCANNER.EXE
SCANWSCS.EXE
SDFSSvc.exe
SDScan.exe
SDTray.exe
SDWelcome.exe
SSUpdate64.exe
SUPERAntiSpyware.exe
SUPERDelete.exe
ScSecSvc.exe
TRAYICOS.EXE
TRAYSSER.EXE
UnThreat.exe
UserReg.exe
V3Main.exe
V3Medic.exe
V3Proxy.exe
V3SP.exe
V3Svc.exe
V3Up.exe
VIEWTCP.EXE
VIPREUI.exe
WebCompanion.exe
Zanda.exe
Zlh.exe
acs.exe
av_task.exe
avpmapp.exe
bavhm.exe
capinfos.exe
cavwp.exe
cis.exe
clamscan.exe
cmdagent.exe
coreFrameworkHost.exe
coreServiceShell.exe
dragon_updater.exe
dumpcap.exe
econceal.exe
econser.exe
editcap.exe
escanmon.exe
escanpro.exe
fcappdb.exe
filwscc.exe
fmon.exe
freshclam.exe
freshclamwrap.exe
fsgk32.exe
fshoster32.exe
fsorsp.exe
fssm32.exe
guardxkickoff_x64.exe
guardxservice.exe
iptray.exe
mbam.exe
mbamscheduler.exe
mbamservice.exe
mergecap.exe
nanoav.exe
nanosvc.exe
nbrowser.exe
nfservice.exe
njeeves2.exe
nnf.exe
nprosec.exe
nseupdatesvc.exe
nvcod.exe
nvcsvc.exe
nvoy.exe
nwscmon.exe
op_mon.exe
procexp.exe
psview.exe
quamgr.exe
rawshark.exe
schmgr.exe
scproxysrv.exe
text2pcap.exe
trigger.exe
tshark.exe
twsscan.exe
twssrv.exe
uiSeAgnt.exe
uiUpdateTray.exe
uiWatchDog.exe
uiWinMgr.exe
utsvc.exe
virusutilities.exe
wireshark.exe
Zlhh.exe

Other Details

This Trojan connects to the following possibly malicious URL:

http://OJfax.{BLOCKED}o.com

It does the following:

It disables executing the following applications by adding the following registry entries:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application}
  - debugger = "svchost.exe"
Where {application} can be any of the following:
- AVK.exe
- AVKProxy.exe
- AVKService.exe
- AVKTray.exe
- AVKWCtlx64.exe
- AdAwareDesktop.exe
- AdAwareService.exe
- AdAwareTray.exe
- AgentSvc.exe
- BDSSVC.EXE
- Bav.exe
- BavSvc.exe
- BavTray.exe
- BavUpdater.exe
- BavWebClient.exe
- BgScan.exe
- BullGuarScanner.exe
- BullGuard.exe
- BullGuardBhvScanner.exe
- BullGuardUpdate.exe
- CONSCTLX.EXE
- CertReg.exe
- CisTray.exe
- ClamTray.exe
- ClamWin.exe
- ConfigSecurityPolicy.exe
- EMLPROXY.EXE
- FCDBlog.exe
- FCHelper64.exe
- FPAVServer.exe
- FPWin.exe
- FProtTray.exe
- FSHDLL64.exe
- FSM32.EXE
- FSMA32.EXE
- FilMsg.exe
- FilUp.exe
- FortiClient.exe
- FortiClient_Diagnostic_Tool.exe
- FortiESNAC.exe
- FortiFW.exe
- FortiProxy.exe
- FortiSSLVPNdaemon.exe
- FortiTray.exe
- GDKBFltExe32.exe
- GDSC.exe
- GDScan.exe
- GdBgInx64.exe
- K7AVScan.exe
- K7CrvSvc.exe
- K7EmlPxy.EXE
- K7FWSrvc.exe
- K7PSSrvc.exe
- K7RTScan.exe
- K7SysMon.Exe
- K7TSMain.exe
- K7TSMngr.exe
- K7TSecurity.exe
- LittleHook.exe
- MCS-Uninstall.exe
- MCShieldCCC.exe
- MCShieldDS.exe
- MCShieldRTM.exe
- MSASCui.exe
- MWAGENT.EXE
- MWASER.EXE
- MpCmdRun.exe
- MpUXSrv.exe
- MsMpEng.exe
- NS.exe
- NisSrv.exe
- ONLINENT.EXE
- OPSSVC.EXE
- PSANHost.exe
- PSUAMain.exe
- PSUAService.exe
- ProcessHacker.exe
- PtSessionAgent.exe
- PtSvcHost.exe
- PtWatchDog.exe
- QUHLPSVC.EXE
- SAPISSVC.EXE
- SASCore64.exe
- SASTask.exe
- SBAMSvc.exe
- SBAMTray.exe
- SBPIMSvc.exe
- SCANNER.EXE
- SCANWSCS.EXE
- SDFSSvc.exe
- SDScan.exe
- SDTray.exe
- SDWelcome.exe
- SSUpdate64.exe
- SUPERAntiSpyware.exe
- SUPERDelete.exe
- ScSecSvc.exe
- TRAYICOS.EXE
- TRAYSSER.EXE
- UnThreat.exe
- UserReg.exe
- V3Main.exe
- V3Medic.exe
- V3Proxy.exe
- V3SP.exe
- V3Svc.exe
- V3Up.exe
- VIEWTCP.EXE
- VIPREUI.exe
- WebCompanion.exe
- Zanda.exe
- Zlh.exe
- acs.exe
- av_task.exe
- avpmapp.exe
- bavhm.exe
- capinfos.exe
- cavwp.exe
- cis.exe
- clamscan.exe
- cmdagent.exe
- coreFrameworkHost.exe
- coreServiceShell.exe
- dragon_updater.exe
- dumpcap.exe
- econceal.exe
- econser.exe
- editcap.exe
- escanmon.exe
- escanpro.exe
- fcappdb.exe
- filwscc.exe
- fmon.exe
- freshclam.exe
- freshclamwrap.exe
- fsgk32.exe
- fshoster32.exe
- fsorsp.exe
- fssm32.exe
- guardxkickoff_x64.exe
- guardxservice.exe
- iptray.exe
- mbam.exe
- mbamscheduler.exe
- mbamservice.exe
- mergecap.exe
- nanoav.exe
- nanosvc.exe
- nbrowser.exe
- nfservice.exe
- njeeves2.exe
- nnf.exe
- nprosec.exe
- nseupdatesvc.exe
- nvcod.exe
- nvcsvc.exe
- nvoy.exe
- nwscmon.exe
- op_mon.exe
- procexp.exe
- psview.exe
- quamgr.exe
- rawshark.exe
- schmgr.exe
- scproxysrv.exe
- text2pcap.exe
- trigger.exe
- tshark.exe
- twsscan.exe
- twssrv.exe
- uiSeAgnt.exe
- uiUpdateTray.exe
- uiWatchDog.exe
- uiWinMgr.exe
- utsvc.exe
- virusutilities.exe
- wireshark.exe
- Zlhh.exe

Minimum Scan Engine:

9.850

FIRST VSAPI PATTERN FILE:

14.488.03

FIRST VSAPI PATTERN DATE:

06 Sep 2018

VSAPI OPR PATTERN File:

14.489.00

VSAPI OPR PATTERN Date:

07 Sep 2018

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {Random Characters}= "%Application Data%\Oracle\bin\javaw.exe" -jar "%User Profile%\{Random Characters}\{Random Characters}.{Random Characters}"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
- SaveZoneInformation = 1
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- LowRiskFileTypes = .avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;
In HKEY_CURRENT_USER\Environment
- SEE_MASK_NOZONECHECKS = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- ConsentPromptBehaviorUser = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- EnableLUA = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System value
- PromptOnSecureDesktop = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application}
- debugger = "svchost.exe"

To delete the registry value this malware/grayware created:

Open Registry Editor.
» For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
» For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
{Random Characters} = "%Application Data%\Oracle\bin\javaw.exe" -jar "%User Profile%\{Random Characters}\{Random Characters}.{Random Characters}"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>Attachments
In the right panel, locate and delete the entry:
SaveZoneInformation = 1
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>Associations
In the right panel, locate and delete the entry:
LowRiskFileTypes = .avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;
In the left panel, double-click the following:
HKEY_CURRENT_USER>Environment
In the right panel, locate and delete the entry:
SEE_MASK_NOZONECHECKS = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>System
In the right panel, locate and delete the entry:
ConsentPromptBehaviorUser = 0
Again In the right panel, locate and delete the entry:
EnableLUA = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>System value
In the right panel, locate and delete the entry:
PromptOnSecureDesktop = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>{application}
In the right panel, locate and delete the entry:
debugger = "svchost.exe"
Close Registry Editor.

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator’s help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- From: ConsentPromptBehaviorAdmin = 0
  To: ConsentPromptBehaviorAdmin = 5
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- From: DisableTaskMgr = 2
  To: DisableTaskMgr = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
- From: DisableConfig = 1
  To: DisableConfig = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
- From: DisableSR = 1
  To: DisableSR = 0

Step 6

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden folders in the search result.

%User Profile%\TTHRemLiVBI
%User Profile%\fUTkALeaTxM
%Application Data%\Oracle

Step 7

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Application Data%\Oracle\{Copies of files under Java installation folder}
%User Profile%\TTHRemLiVBI\ID.txt
%User Profile%\fUTkALeaTxM\ID.txt
%User Temp%\_0.{random numbers}.class
%User Profile%\.oracle_jre_usage\{random filename}.timestamp
%User Profile%\{Random Characters}.{Random Characters}

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as JAVA_ADWIND.USMGBFBG. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

JAVA_ADWIND.USMGBFBG

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific