Trojan.BAT.WANNAREN.YPDAP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%Public%\PulseSecure\nclauncher.exe" /t REG_SZ /d "RunAsInvoker" /f
• reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%Public%\PulseSecure\nclauncher.exe" /t REG_SZ /d "RunAsInvoker" /f
• reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
• reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
• msiexec /I \{Path where the msi file is located}\PulseSecure.msi /qn

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%Public%\PulseSecure\nclauncher.exe = RunAsInvoker

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%Public%\PulseSecure\nclauncher.exe = RunAsInvoker

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
LocalAccountTokenFilterPolicy = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

Other Details

This Trojan does the following:

• It checks the machine's computer name, if match with the specified computer name the script will proceed to exit.
• It checks the following directory if it exists on the user machine.
• "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client\PccNTMon.exe"
• If it exists, it will add a firewall rule to block the following program:
• {rule name}= XGNtrtscan {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client\Ntrtscan.exe"
• {rule name}= XGTmCCSF {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client\TmCCSF.exe"
• {rule name}= XGTmListen {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client\TmListen.exe"
• {rule name}= XGTmProxy {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client\TmProxy.exe"
• "%ProgramFiles(x86)%\Trend Micro\Security Agent\PccNTMon.exe"
• If it exists, it will add a firewall rule to block the following program:
• {rule name}= OneTmListen {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\Security Agent\TmListen.exe"
• {rule name}= OneTmCCSF {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\Security Agent\TmCCSF.exe"
• {rule name}= OneNtrtscan {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\Security Agent\Ntrtscan.exe"
• {rule name}= OneTmProxy {program to be blocked}= "%ProgramFiles(x86)%\Trend Micro\Security Agent\TmProxy.exe"
• "%ProgramFiles%\Trend Micro\AMSP\"
• If it exists, it will terminate the following processes and any child processes which started by it.
• dsa.exe
• ds_monitor.exe
• ds_nuagent.exe
• Notifier.exe
• coreServiceShell.exe
• coreFrameworkHost.exe
• If it exists, it will add a firewall rule to block the following program:
• {rule name}= coreFrameworkHost {program to be blocked}= "%ProgramFiles%\Trend Micro\AMSP\coreFrameworkHost.exe"
• {rule name}= coreServiceShell {program to be blocked}= "%ProgramFiles%\Trend Micro\AMSP\coreServiceShell.exe"
• "%ProgramFiles%\Trend Micro\Deep Security Agent\"
• If it exists, it will add a firewall rule to blocked the following program:
• {rule name}= dsa {program to be blocked}= "%ProgramFiles%\Trend Micro\Deep Security Agent\dsa.exe"
• {rule name}= dsa-connect {program to be blocked}= "%ProgramFiles%\Trend Micro\Deep Security Agent\dsa-connect.exe"
• {rule name}= Notifier {program to be blocked}= "%ProgramFiles%\Trend Micro\Deep Security Agent\Notifier.exe"
• {rule name}= dsvp {program to be blocked}= "%ProgramFiles%\Trend Micro\Deep Security Agent\dsvp.exe"
• {rule name}= nginx {program to be blocked}= "%ProgramFiles%\Trend Micro\Deep Security Agent\nginx.exe"
• "%ProgramFiles%\Morphisec\bin\"
• If it exists, it will add a firewall rule to blocked the following program:
• {rule name}= MorphisecAgent {program to be blocked}= "%ProgramFiles%\Morphisec\bin\MorphisecAgent.exe"
• {rule name}= MPetpTray {program to be blocked}= "%ProgramFiles%\Morphisec\bin\MPetpTray.exe"
• It executes the following application if it exists:
• %Public%\PulseSecure\nclauncher.exe
• %Public%\PulseSecure\dsNcDiag.dll
• %Public%\PulseSecure\version.man
• %Public%\PulseSecure\event.man
• If the files does not exists, it will proceed to a function callled "install" to execute a file named "PulseSecure.msi"

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)