ADW_CROSSID

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages. It may be manually installed by a user.

It connects to a website to send and receive information.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

It may be manually installed by a user.

Installation

This adware drops the following files:

• %Program Files%\Savings Sidekick\Savings Sidekick.dll
• %Program Files%\Savings Sidekick.ico
• %Program Files%\Savings SidekickGui.exe
• %Application Data%\Savings Sidekick\Chrome\Savings Sidekick.crx
• %Program Files%\WhoDidThat
• %Program Files%\WhoDidThat\background.html
• %Program Files%\WhoDidThat\Installer.log
• %Program Files%\WhoDidThat\Uninstall.exe
• %Program Files%\WhoDidThat\WhoDidThat-bg.exe
• %Program Files%\WhoDidThat\WhoDidThat-bho.dll
• %Program Files%\WhoDidThat\WhoDidThat-buttonutil.dll
• %Program Files%\WhoDidThat\WhoDidThat-buttonutil.exe
• %Program Files%\WhoDidThat\WhoDidThat-codedownloader.exe
• %Program Files%\WhoDidThat\WhoDidThat-helper.exe
• %Program Files%\WhoDidThat\WhoDidThat.ico

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Program Files%\Savings Sidekick
• %Application Data%\Savings Sidekick
• %Program Files%\WhoDidThat

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This adware adds the following registry keys to install itself as a Browser Helper Object (BHO):

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110011501160}

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220022502260}

HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440044504460}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp{random number}.BHO

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011501160}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022502260}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044504460}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{11111111-1111-1111-1111-110011501160}

Other System Modifications

This adware adds the following registry keys:

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Crossrider

HKEY_CURRENT_USER\Software\AppDataLow\
Software\WhoDidThat

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}

HKEY_CLASSES_ROOT\Local Settings\Software\
Microsoft\Windows\CurrentVersion\
AppContainer\Storage\windows_ie_ac_001\
Software\WhoDidThat

It adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO
{Default} = "CrossriderApp{random number}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO\CLSID
{Default} = "{11111111-1111-1111-1111-110411561140}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO.1
{Default} = "CrossriderApp{random number}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO.1\CLSID
{Default} = "{11111111-1111-1111-1111-110411561140}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox\CLSID
{Default} = "{22222222-2222-2222-2222-220422562240}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox.1
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox.1\CLSID
{Default} = "{22222222-2222-2222-2222-220422562240}"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}
{Default} = "WhoDidThat"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}\
InprocServer32
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}\
ProgID
{Default} = "CrossriderApp{random number}.BHO.1"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}\
InprocServer32
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}\
ProgID
{Default} = "CrossriderApp{random number}.Sandbox.1"

HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455565540}
{Default} = "ICrossriderBHO"

HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466566640}
{Default} = "ISandBox"

HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444564440}\
1.0
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\WhoDidThat
IsBhoEnabled = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{547e35c2-8694-4313-b91e-051351920945}
AppName = WhoDidThat-codedownloader.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{547e35c2-8694-4313-b91e-051351920945}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
AppName = WhoDidThat-bg.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
Policy = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f3353189-3395-4bde-bf07-34946999a9b3}
AppName = WhoDidThat-buttonutil.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f3353189-3395-4bde-bf07-34946999a9b3}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f638fbab-66e7-43b0-b161-ac1de3b25e61}
Policy = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}
path = "%Application Data%\Savings Sidekick\Chrome\Savings Sidekick.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}
version = "1.18.9"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\LowRights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
AppName = "Savings Sidekick.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\LowRights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
AppPath = "%Program Files%\Savings Sidekick"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
Policy = "3"

Backdoor Routine

This adware connects to the following websites to send and receive information:

• http://{BLOCKED}atic.crossrider.com
• http://{BLOCKED}s.{BLOCKED}yapp.com
• http://{BLOCKED}ltrk.com
• http://{BLOCKED}ider.{BLOCKED}l.net

NOTES:

It connects to a predefined URL to download plugins then save the plugin code on the following registry entry:

HKEY_CURRENT_USER\Software\AppDartLow\Software\WhoDidThat\Plugins\{Number}