PUA.Win32.QiwMonk.AB

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application creates the following folders:

• %User Profile%\UIDowner
• %User Temp%\eOno6BqeIrbWnbLk

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\RFC1156Agent\CurrentVersion\
Parameters
TrapPollTimeMilliSecs = "15000"

HKEY_CURRENT_USER\Software\UIDowner
usestime = "1"

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\3UYAQU1F\static.downerapi[1].xml
• %AppDataLocal%\Microsoft\Internet Explorer\DOMStore\PDYB5D8B\pos.baidu[1].xml
• %Application Data%\Microsoft\Internet Explorer\UserData\3ODNK4RO\oXMLStore[1].xml

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://api.{BLOCKED}api.com/newerror?{random characters}
• http://api.{BLOCKED}api.com/newxml/34?{random characters}
• http://static.{BLOCKED}api.com/upload/xml/360.xml?{random characters}
• http://static.{BLOCKED}api.com/upload/20190902/1567428435.png
• http://static.{BLOCKED}api.com/upload/20150331/1427778759.png
• http://static.{BLOCKED}api.com/upload/20190905/1567666689.png
• http://static.{BLOCKED}api.com/upload/ad/ad4.html?test=100
• http://static.{BLOCKED}api.com/upload/ad/os.js
• http://api.{BLOCKED}api.com/next?{random characters}
• http://pos.{BLOCKED}u.com/nckm?{random characters}
• http://ubmcmm.{BLOCKED}tatic.com/media/v1/0f000ZolOekD21Zo9XSP40.swf
• http://sccdn.{BLOCKED}a.com/swfs/d2/4311443078xcvxc/sp1.mp4
• http://pos.{BLOCKED}u.com/wh/o.htm?ltr=
• http://dup.{BLOCKED}tatic.com/tpl/wh.js
• http://dup.{BLOCKED}tatic.com/tpl/fb.js
• http://pos.{BLOCKED}u.com/wh/o.swf?v=1
• http://pos.{BLOCKED}u.com/wh/c.swf?v=3
• http://eclick.{BLOCKED}u.com/fp.htm?{random characters}

This report is generated via an automated analysis system.