ADW_BROXY

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following copies of itself into the affected system:

• %User Temp%\{malware file name}download_4\{malware file name}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Application Data\Oxy
• %User Temp%\{malware file name}download_4
• %User Temp%\tmpA
• %User Temp%\tmp16

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This adware deletes the following files:

• %User Temp%\EEB37C89B1F9EC550DE5700B379C2688.ini
• %User Temp%\setup.exe
• %User Temp%\E9D303A1BD7907154244326ECE7E1D90.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Escolade

HKEY_CURRENT_USER\Software\Ascensio System\
Task Scheduler

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Escolade
GUID = "71e1f1b0e64d11e3a6cf0050569f3b80"

HKEY_CURRENT_USER\Software\Ascensio System\
Task Scheduler
SchedulerState = "2"

Dropping Routine

This adware drops the following files:

• %User Temp%\{malware file name}_000132.log
• %User Temp%\htmlayout.dll
• %User Profile%\Oxy\config.xml
• %Windows%\Tasks\PileFile reminder.job
• %Windows%\Tasks\PileFile logon.job
• %User Temp%\tmpD.exe
• %User Temp%\tmp19.exe
• %User Temp%\awh10.tmp
• %User Temp%\awh13.tmp
• %User Temp%\awh1C.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

Other Details

This adware connects to the following possibly malicious URL:

• {BLOCKED}1.11.88
• {BLOCKED}0.1
• {BLOCKED}209.45
• {BLOCKED}.49.180

This report is generated via an automated analysis system.