Ransom_SPORA.AX

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\548c0a76324aec7fbb.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Trojan deletes the following files:

• {malware path and file name}:zone.identifier

Dropping Routine

This Trojan drops the following files:

• %User Profile%\Application Data\USCDE-C1ETR-TZTZT-RRTRY.html
• A:\145559504
• %System Root%\145559504
• %System Root%\Documents and Settings.lnk
• %Program Files%.lnk
• %Windows%.lnk
• %Desktop%\145559504
• %System Root%\USCDE-C1ETR-TZTZT-RRTRY.html
• %User Profile%\USCDE-C1ETR-TZTZT-RRTRY.html
• %User Profile%\Templates\USCDE-C1ETR-TZTZT-RRTRY.html
• %Desktop%\USCDE-C1ETR-TZTZT-RRTRY.html
• %Favorites%\USCDE-C1ETR-TZTZT-RRTRY.html
• %User Profile%\Recent\USCDE-C1ETR-TZTZT-RRTRY.html
• %User Startup%\USCDE-C1ETR-TZTZT-RRTRY.html

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Favorites% is the Favorites folder, where it usually is C:\Documents and Settings\{user name}\Favorites on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Favorites on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

This report is generated via an automated analysis system.