PUA.Win32.OCCAMY.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\~{Random Characters}.inf
• {Malware Path}\~{Random Characters}.tmp
• %Desktop%\常用网址导航.lnk -> redirects to http://www.{BLOCKED}.com/?zm
• %User Temp%\{Random Characters}.bat -> checks for TCP connection, then deletes {Malware Path}\~{Random Characters}.tmp and itself
• %User Temp%\{Random Characters}.exe -> deleted afterwards

Agrega los procesos siguientes:

• {Malware Path}\{Malware Filename}.exe /nstart
• %User Temp%\{Random Characters}.exe /HomeRegAccess10
• Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %User Temp%\~{Random Characters}.inf
• cmd /c %User Temp%\{Random Characters}.bat

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\
safemon\userset
hp = http://www.{BLOCKED}.com/?{Random numbers}

HKEY_LOCAL_MACHINE\SOFTWARE\Baidu\
BaiduProtect\LockIEStartPage
Start Page = http://www.{BLOCKED}.com/?{Random numbers}

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
PromptOnSecureDesktop = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\MAIN
Start Page = http://www.{BLOCKED}.com/?{Random number}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\MAIN
Default_Page_URL = http://www.{BLOCKED}.com/?{Random number}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\MAIN
First Home Page = http://www.{BLOCKED}.com/?{Random number}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = http://www.{BLOCKED}.com/?{Random number}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Default_Page_URL = http://www.{BLOCKED}.com/?{Random number}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
First Home Page = http://www.{BLOCKED}.com/?{Random number}

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Main
Start Page = http://www.{BLOCKED}.com/?{Random number}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Main
Start Page = http://www.{BLOCKED}.com/?{Random number}

Otros detalles

Según el análisis de los códigos, tiene las siguientes capacidades:

• Connects to the following malicious URL:
  • http://yun.u{BLOCKED}g.com/ns
  • http://yun.u{BLOCKED}g.com/nys

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Baidu

HKEY_LOCAL_MACHINE\SOFTWARE\Baidu\
BaiduProtect

HKEY_LOCAL_MACHINE\SOFTWARE\Baidu\
BaiduProtect\LockIEStartPage

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\
safemon

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\
safemon\userset

Hace lo siguiente:

• It requires to be executed with administrative rights to proceed to its malicious routine
• It erases all the content of the %System%\drivers\etc\hosts file
• It deletes all the files found in the %Favorites% directory
• It adds the following possibly unwanted favorites on the IE Favorites bar:
  • %Favorites%\百度一下.url
  • %Favorites%\链接\百度一下.url
  • %Favorites%\links\百度一下.url
  • %Favorites%\网址导航.url
  • %Favorites%\链接\网址导航.url
  • %Favorites%\links\网址导航.url
  • %Favorites%\淘宝网.url
  • %Favorites%\链接\淘宝网.url
  • %Favorites%\links\淘宝网.url
  • %Favorites%\京东商城.url
  • %Favorites%\链接\京东商城.url
  • %Favorites%\links\京东商城.url
  • %Favorites%\天猫精选.url
  • %Favorites%\链接\天猫精选.url
  • %Favorites%\links\天猫精选.url
  • %Favorites%\拼多多.url
  • %Favorites%\链接\拼多多.url
  • %Favorites%\links\拼多多.url
  • %Favorites%\购物导航.url
  • %Favorites%\链接\购物导航.url
  • %Favorites%\links\购物导航.url
  • %Favorites%\携程网.url
  • %Favorites%\链接\携程网.url
  • %Favorites%\links\携程网.url
  • %Favorites%\网页游戏.url
  • %Favorites%\链接\网页游戏.url
  • %Favorites%\links\网页游戏.url
  • %Favorites%\游戏加速.url
  • %Favorites%\链接\游戏加速.url
  • %Favorites%\links\游戏加速.url

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).