Analysis by: Rhena Inocencio
 Modified by: Alvin Bacani

ALIASES:

Win32/Packed.ScrambleWrapper.F (ESET-NO32)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Adware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from P2P shares, Dropped by other malware

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware packages. It may be manually installed by a user.

It connects to a website to send and receive information.

  TECHNICAL DETAILS

File Size: 441,728 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 23 Jun 2012
Payload: Drops files

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It arrives as a component bundled with malware/grayware packages.

It may be manually installed by a user.

Installation

This adware drops the following files:

  • %Program Files%\Savings Sidekick\Savings Sidekick.dll
  • %Program Files%\Savings Sidekick.ico
  • %Program Files%\Savings SidekickGui.exe
  • %Application Data%\Savings Sidekick\Chrome\Savings Sidekick.crx
  • %Program Files%\WhoDidThat
  • %Program Files%\WhoDidThat\background.html
  • %Program Files%\WhoDidThat\Installer.log
  • %Program Files%\WhoDidThat\Uninstall.exe
  • %Program Files%\WhoDidThat\WhoDidThat-bg.exe
  • %Program Files%\WhoDidThat\WhoDidThat-bho.dll
  • %Program Files%\WhoDidThat\WhoDidThat-buttonutil.dll
  • %Program Files%\WhoDidThat\WhoDidThat-buttonutil.exe
  • %Program Files%\WhoDidThat\WhoDidThat-codedownloader.exe
  • %Program Files%\WhoDidThat\WhoDidThat-helper.exe
  • %Program Files%\WhoDidThat\WhoDidThat.ico

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

  • %Program Files%\Savings Sidekick
  • %Application Data%\Savings Sidekick
  • %Program Files%\WhoDidThat

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This adware adds the following registry keys to install itself as a Browser Helper Object (BHO):

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110011501160}

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220022502260}

HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440044504460}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CrossriderApp{random number}.BHO

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{11111111-1111-1111-1111-110011501160}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{22222222-2222-2222-2222-220022502260}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{44444444-4444-4444-4444-440044504460}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{11111111-1111-1111-1111-110011501160}

Other System Modifications

This adware adds the following registry keys:

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Crossrider

HKEY_CURRENT_USER\Software\AppDataLow\
Software\WhoDidThat

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}

HKEY_CLASSES_ROOT\Local Settings\Software\
Microsoft\Windows\CurrentVersion\
AppContainer\Storage\windows_ie_ac_001\
Software\WhoDidThat

It adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO
{Default} = "CrossriderApp{random number}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO\CLSID
{Default} = "{11111111-1111-1111-1111-110411561140}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO.1
{Default} = "CrossriderApp{random number}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.BHO.1\CLSID
{Default} = "{11111111-1111-1111-1111-110411561140}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox\CLSID
{Default} = "{22222222-2222-2222-2222-220422562240}"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox.1
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CrossriderApp{random number}.Sandbox.1\CLSID
{Default} = "{22222222-2222-2222-2222-220422562240}"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}
{Default} = "WhoDidThat"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}\
InprocServer32
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411561140}\
ProgID
{Default} = "CrossriderApp{random number}.BHO.1"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}
{Default} = "CrossriderApp{random number}.Sandbox"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}\
InprocServer32
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422562240}\
ProgID
{Default} = "CrossriderApp{random number}.Sandbox.1"

HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455565540}
{Default} = "ICrossriderBHO"

HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466566640}
{Default} = "ISandBox"

HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444564440}\
1.0
{Default} = "%Program Files%\WhoDidThat\WhoDidThat-bho.dll"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\WhoDidThat
IsBhoEnabled = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{547e35c2-8694-4313-b91e-051351920945}
AppName = WhoDidThat-codedownloader.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{547e35c2-8694-4313-b91e-051351920945}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
AppName = WhoDidThat-bg.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{59cd9ab4-e56e-4956-8e73-b37b2bb95950}
Policy = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f3353189-3395-4bde-bf07-34946999a9b3}
AppName = WhoDidThat-buttonutil.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f3353189-3395-4bde-bf07-34946999a9b3}
AppPath = %Program Files%\WhoDidThat

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{f638fbab-66e7-43b0-b161-ac1de3b25e61}
Policy = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}
path = "%Application Data%\Savings Sidekick\Chrome\Savings Sidekick.crx"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Chrome\Extensions\{random key name}
version = "1.18.9"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\LowRights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
AppName = "Savings Sidekick.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\LowRights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
AppPath = "%Program Files%\Savings Sidekick"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{11111111-1111-1111-1111-110011501160}
Policy = "3"

Backdoor Routine

This adware connects to the following websites to send and receive information:

  • http://{BLOCKED}atic.crossrider.com
  • http://{BLOCKED}s.{BLOCKED}yapp.com
  • http://{BLOCKED}ltrk.com
  • http://{BLOCKED}ider.{BLOCKED}l.net

NOTES:

It connects to a predefined URL to download plugins then save the plugin code on the following registry entry:

HKEY_CURRENT_USER\Software\AppDartLow\Software\WhoDidThat\Plugins\{Number}

  SOLUTION

Minimum Scan Engine: 9.700
SSAPI PATTERN File: 1.307.00
SSAPI PATTERN Date: 14 Jul 2012

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Remove ADW_CROSSID by using its own Uninstall option

[ Learn More ]
To uninstall the grayware process

Step 4

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %Program Files%\Savings Sidekick\Savings Sidekick.dll
  • %Program Files%\Savings Sidekick.ico
  • %Program Files%\Savings SidekickGui.exe
  • %Application Data%\Savings Sidekick\Chrome\Savings Sidekick.crx

Step 5

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.  
  • %Program Files%\Savings Sidekick
  • %Application Data%\Savings Sidekick

Step 6

Restart in normal mode and scan your computer with your Trend Micro product for files detected as ADW_CROSSID. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.