ADW_BRANTALL

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following copies of itself into the affected system:

• %User Temp%\PC Performer613879.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %All Users Profile%\IBUpdaterService
• %User Temp%\ibtmp90bb489 - deleted afterwards
• %User Temp%\ibtmp90bb489\config - deleted afterwards
• %User Temp%\ibtmp90bb489\config\events - deleted afterwards
• %User Temp%\ibtmp90bb489\config\conditions - deleted afterwards

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This adware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows Script\Settings

HKEY_CURRENT_USER\Software\Microsoft\
Windows Script

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows Script\Settings
JITDebug = "0"

Dropping Routine

This adware drops the following files:

• %User Temp%\ibtmp90bb489\config\conditions\conditions.js - deleted afterwards
• %User Temp%\ibtmp90bb489\config\events\events.js - deleted afterwards
• %User Temp%\ibtmp90bb489\intallLog - deleted afterwards
• %User Profile%\IBUpdaterService\repository.xml

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Download Routine

This adware saves the files it downloads using the following names:

• %User Temp%\ConduitChecker.exe - also detected as ADW_BRANTALL

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This adware connects to the following possibly malicious URL:

• http://api.{BLOCKED}o.com/utils/dns?cid={random}
• http://www.{BLOCKED}tech.com/
• http://{BLOCKED}-182385724-1591972470.us-east-1.elb.{BLOCKED}aws.com/service/country.php
• http://www.{BLOCKED}tech.com/service/country.php
• http://www.{BLOCKED}tech.com/files/components/conduit_checker.exe - download file also detected as ADW_BRANTALL

NOTES:

It notifies the following URLs for the installation:

• http://api.{BLOCKED}o.com/track/ib-start?cid={random}
• http://{BLOCKED}l.{BLOCKED}o.com/installer/{random characters}
• http://api.{BLOCKED}o.com/track/ib-install?cid={random}&componentid={random}
• http://api.{BLOCKED}o.com/track/ib-finish?cid={random}