PUA.Win32.Keygen.CRRJ

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following file(s)/component(s):

• %User Temp%\configure.dat
• %All Users Profile%\SystemAcCrux\fefe7b8f3862ba4dac.bin
• %User Temp%\EuCfg.bin
• %System%\wbem\repository\WRITABLE.TST
• %System%\wbem\Performance\WmiApRpl_new.h

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• %System%\wbem\wmiprvse.exe -secured -Embedding
• %System%\wbem\wmiprvse.exe -Embedding
• %System%\wbem\WMIADAP.EXE wmiadap.exe /F /T /R

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %All Users Profile%\SystemAcCrux

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Other System Modifications

This Potentially Unwanted Application adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\CIMOM
LastServiceStart = 2023/1/9 6:33:48'811

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\Transports\Decoupled\
Server
CreationTime = 20230109055344.455000+000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\Transports\Decoupled\
Server
MarshaledProxy = MEOW\{hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\Transports\Decoupled\
Server
ProcessIdentifier = 2040

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\CIMOM
ConfigValueEssNeedsLoading = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\CIMOM
List of event-active namespaces = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM\IDE\
DiskVBOX_HARDDISK___________________________1.0_____
5&33d1638a&0&0.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910} = LowDateTime:803713417,HighDateTime:0***Binary mof compiled successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM\IDE\
DiskVBOX_HARDDISK___________________________1.0_____
5&2117b2e5&0&1.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910} = LowDateTime:803713417,HighDateTime:0***Binary mof compiled successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM\%System%
advapi32.dll[MofResourceName] = LowDateTime:-262688356,HighDateTime:30116022***Binary mof compiled successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM\%System%\
en-US
advapi32.dll.mui[MofResourceName] = LowDateTime:-1764005162,HighDateTime:30116046***Binary mof compiled successfully