ADW_DLOADWARE

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following copies of itself into the affected system:

• %User Profile%\mediadownloader\{malware file name}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Application Data\DownloadManager
• %User Temp%\104156

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This adware deletes the following files:

• %Windows%\Tasks\Temp{f3f2eb65-0e0b-47aa-8a93-48cbaeeb9eb5}.job
• %Windows%\Tasks\Temp{bf956ced-ce44-4068-86cc-bde62af599a5}.job
• %Windows%\Tasks\Temp{47af6a65-07ae-4870-955e-718014957d26}.job
• %User Temp%\E9D303A1BD7907154244326ECE7E1D90.ini
• %User Temp%\setup.exe
• %User Temp%\0B0C4F5CF945B8EF303B82C797C6EA85.ini
• %User Temp%\setup__1546.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\LADY'S WOOD 2013 LIMITED

It adds the following registry entries:

HKEY_CURRENT_USER\Software\LADY'S WOOD 2013 LIMITED
GUID = "46a393c754b04af98c1274c826db368e"

Dropping Routine

This adware drops the following files:

• %User Temp%\config.xml
• %User Temp%\DownloadManager.exe
• %User Profile%\DownloadManager\config.xml
• %Desktop%\Continue Sheryl Crow - Oh Marie.mp3 download.lnk
• %Windows%\Tasks\DownloadManagerBoot.job
• %Windows%\Tasks\DownloadManagerDaily.job
• %Windows%\Tasks\UpdaterDaily.job
• %Desktop%\Sheryl Crow - Oh Marie.mp3.mp3
• %User Temp%\awhF.tmp
• %User Temp%\awh12.tmp
• %User Temp%\104156\104156.zipDir\mainlog\mp3_qone8_2014-05-25[23-33-00-781].log
• %User Temp%\awh20.tmp
• %User Temp%\awh23.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

Other Details

This adware connects to the following possibly malicious URL:

• {BLOCKED}1.11.88
• {BLOCKED}204.61
• {BLOCKED}0.1
• {BLOCKED}209.45
• {BLOCKED}.195.109

This report is generated via an automated analysis system.