arrow_back
search
close

Adware.Win32.WENHU.B

November 23, 2021
 Analysis by: Maria Emreen Viray
 ALIASES:

Win32/Adware.WhenU.SaveNow (NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Adware

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW


This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size:

862,611 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

11 Nov 2021

Arrival Details

This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Adware adds the following folders:

  • %User Temp%\is-{random characters}.tmp
  • %Program Files%\High Quality Photo Resizer
  • %Program Files%\VVSN

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following component file(s):

  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\Uninstall High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\Visit our website.lnk
  • %Desktop%\High Quality Photo Resizer.lnk
  • %Program Files%\High Quality Photo Resizer\Resizer.exe
  • %Program Files%\High Quality Photo Resizer\Resizer.exe.manifest
  • %Program Files%\High Quality Photo Resizer\TmpInstall.exe
  • %Program Files%\High Quality Photo Resizer\VVSNInst.exe
  • %Program Files%\High Quality Photo Resizer\is-{random characters}.tmp
  • %Program Files%\High Quality Photo Resizer\unins000.dat
  • %Program Files%\High Quality Photo Resizer\unins000.exe
  • %Program Files%\High Quality Photo Resizer\website.url
  • %Program Files%\VVSN\SET{random hex}.tmp
  • %Program Files%\VVSN\URL1\vsn.cfg
  • %Program Files%\VVSN\URL2\vsn.cfg
  • %Program Files%\VVSN\VVSN.exe
  • %Program Files%\VVSN\vvsn.cfg
  • %System%\is-{random characters}.tmp
  • %System%\xwpdlx20.ocx
  • %Temp%\OLD{random hex}.tmp
  • %User Temp%\is-{random characters}.tmp\Form1.bmp
  • %User Temp%\is-{random characters}.tmp\Form2.bmp
  • %User Temp%\is-{random characters}.tmp\WizModernSmallImage.bmp
  • %User Temp%\is-{random characters}.tmp\_shfoldr.dll
  • %User Temp%\is-{random characters}.tmp\aluria_seal.bmp
  • %User Temp%\is-{random characters}.tmp\is-{random characters}.tmp
  • %User Temp%\is-{random characters}.tmp\save_header.bmp
  • %User Temp%\is-{random characters}.tmp\searchbar_header.bmp
  • %User Temp%\{random hex}.WUT\vvsn.cab
  • %User Temp%\{random hex}.WUT\whenu.inf
  • %User Temp%\~{random characters}.TMP

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • %Program Files%\High Quality Photo Resizer\TmpInstall.exe
  • %Program Files%\High Quality Photo Resizer\VVSNInst.exe /cfg:NTPC070603 /d"High Quality Photo Resizer" /f"%Program Files%\High Quality Photo Resizer\Resizer.exe"
  • %Program Files%\VVSN\VVSN.exe /cfg:NTPC070603 /d"High Quality Photo Resizer" /f"%Program Files%\High Quality Photo Resizer\Resizer.exe"
  • %Program Files%\High Quality Photo Resizer\Resizer.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
VVSN = %Program Files%\VVSN\VVSN.exe

Download Routine

This Adware connects to the following URL(s) to download its configuration file:

  • http://spweb.{BLOCKED}u.com/vvsn/NTPC070603/vsn.cfg

It connects to the following URL(s) to download its component file(s):

  • http://app.{BLOCKED}u.com/AppInstall?app=VVSN&url=NTPC070603&id={Generated ID}&ui=JH
  • http://app.{BLOCKED}u.com/AppInstall?app=VVSN&url=NTPC070603&id={Generated ID}&ui=IT

As of this writing, the said sites are inaccessible.

Other Details

This Adware adds the following registry entries to add an uninstall option to the Control Panel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Inno Setup: Setup Version = 4.2.6

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Inno Setup: App Path = %Program Files%\High Quality Photo Resizer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
InstallLocation = %Program Files%\High Quality Photo Resizer\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Inno Setup: Icon Group = High Quality Photo Resizer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Inno Setup: User = {username}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Inno Setup: Selected Tasks = desktopicon,quicklaunchicon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
DisplayName = High Quality Photo Resizer 2.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
UninstallString = "%Program Files%\High Quality Photo Resizer\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
QuietUninstallString = "%Program Files%\High Quality Photo Resizer\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1
Publisher = Naturpic Software

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.key

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{44DE2FE5-C775-11D4-AAD4-DA7E8D958A70}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44DE2FE0-C775-11D4-AAD4-DA7E8D958A70}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{44DE2FE1-C775-11D4-AAD4-DA7E8D958A70}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
xwpdlx20.wpdlx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
High Quality Photo Resizer_is1

It does the following:

  • Installs main application while requiring the download of applications displayed as advertisements.

  SOLUTION

Minimum Scan Engine:

9.800

SSAPI PATTERN File:

2.465.00

SSAPI PATTERN Date:

25 Nov 2021

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove Adware.Win32.WENHU.B by using its own Uninstall option

[ Learn More ]
To uninstall the grayware process

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Inno Setup: Setup Version = 4.2.6
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Inno Setup: App Path = %Program Files%\High Quality Photo Resizer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • InstallLocation = %Program Files%\High Quality Photo Resizer\
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Inno Setup: Icon Group = High Quality Photo Resizer
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Inno Setup: User = {username}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Inno Setup: Selected Tasks = desktopicon,quicklaunchicon
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • DisplayName = High Quality Photo Resizer 2.0
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • UninstallString = "%Program Files%\High Quality Photo Resizer\unins000.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • QuietUninstallString = "%Program Files%\High Quality Photo Resizer\unins000.exe" /SILENT
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
    • Publisher = Naturpic Software
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • VVSN = %Program Files%\VVSN\VVSN.exe

Step 5

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44DE2FE5-C775-11D4-AAD4-DA7E8D958A70}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44DE2FE0-C775-11D4-AAD4-DA7E8D958A70}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44DE2FE1-C775-11D4-AAD4-DA7E8D958A70}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xwpdlx20.wpdlx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\High Quality Photo Resizer_is1

Step 6

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %Application Data%\Microsoft\Internet Explorer\Quick Launch\High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\Uninstall High Quality Photo Resizer.lnk
  • %Common Programs%\High Quality Photo Resizer\Visit our website.lnk
  • %Desktop%\High Quality Photo Resizer.lnk
  • %Program Files%\High Quality Photo Resizer\Resizer.exe
  • %Program Files%\High Quality Photo Resizer\Resizer.exe.manifest
  • %Program Files%\High Quality Photo Resizer\TmpInstall.exe
  • %Program Files%\High Quality Photo Resizer\VVSNInst.exe
  • %Program Files%\High Quality Photo Resizer\is-{random characters}.tmp
  • %Program Files%\High Quality Photo Resizer\unins000.dat
  • %Program Files%\High Quality Photo Resizer\unins000.exe
  • %Program Files%\High Quality Photo Resizer\website.url
  • %Program Files%\VVSN\SET{random hex}.tmp
  • %Program Files%\VVSN\URL1\vsn.cfg
  • %Program Files%\VVSN\URL2\vsn.cfg
  • %Program Files%\VVSN\VVSN.exe
  • %Program Files%\VVSN\vvsn.cfg
  • %System%\is-{random characters}.tmp
  • %System%\xwpdlx20.ocx
  • %Temp%\OLD{random hex}.tmp
  • %User Temp%\is-{random characters}.tmp\Form1.bmp
  • %User Temp%\is-{random characters}.tmp\Form2.bmp
  • %User Temp%\is-{random characters}.tmp\WizModernSmallImage.bmp
  • %User Temp%\is-{random characters}.tmp\_shfoldr.dll
  • %User Temp%\is-{random characters}.tmp\aluria_seal.bmp
  • %User Temp%\is-{random characters}.tmp\is-{random characters}.tmp
  • %User Temp%\is-{random characters}.tmp\save_header.bmp
  • %User Temp%\is-{random characters}.tmp\searchbar_header.bmp
  • %User Temp%\{random hex}.WUT\vvsn.cab
  • %User Temp%\{random hex}.WUT\whenu.inf
  • %User Temp%\~{random characters}.TMP

Step 7

Search and delete this folder

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Temp%\is-{random characters}.tmp
  • %Program Files%\High Quality Photo Resizer
  • %Program Files%\VVSN

Step 8

Scan your computer with your Trend Micro product to delete files detected as Adware.Win32.WENHU.B. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.