PUA.Win32.Soft32Downloader.B

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• .\installer.exe
• "%User Temp%\7zS0D0A0BD6\GenericSetup.exe" %User Temp%\7zS0D0A0BD6\GenericSetup.exe
• %User Temp%\7zS0D0A0BD6\GenericSetup.exe %User Temp%\7zS0D0A0BD6\GenericSetup.exe
• %System%\svchost.exe -k netsvcs
• %Windows%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
• %System%\svchost.exe -k LocalServiceAndNoImpersonation
• %Windows%\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
• %System%\sppsvc.exe
• "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
• %System%\svchost.exe -k WerSvcGroup

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It creates the following folders:

• %User Temp%\7zS0D0A0BD6
• %User Temp%\7zS0D0A0BD6\Resources\tis
• %User Temp%\7zS0D0A0BD6\Resources\images
• %User Temp%\7zS0D0A0BD6\Resources

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• %User Temp%\7zS0D0A0BD6

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %User Temp%\7zS0D0A0BD6\Resources\tis\ViewStateLoader.tis
• %User Temp%\7zS0D0A0BD6\BundleConfig.json
• %User Temp%\7zS0D0A0BD6\Resources\LaunchCarrierPage.html
• %User Temp%\7zS0D0A0BD6\app.ico
• %User Temp%\7zS0D0A0BD6\Resources\WelcomePage.html
• %User Temp%\7zS0D0A0BD6\Resources\images\loader.gif
• %User Temp%\7zS0D0A0BD6\H2OSciter.dll
• %User Temp%\7zS0D0A0BD6\Resources\tis\EventHandler.tis
• %User Temp%\7zS0D0A0BD6\Resources\images\warning48x48.png
• %User Temp%\7zS0D0A0BD6\Resources\images
• %User Temp%\7zS0D0A0BD6\Carrier.ZIP
• %User Temp%\7zS0D0A0BD6\Newtonsoft.Json.dll
• %User Temp%\7zS0D0A0BD6\ExternalResource.XML
• %User Temp%\7zS0D0A0BD6\Resources\tis\Log.tis
• %User Temp%\7zS0D0A0BD6\Resources\tis\Config.tis
• %User Temp%\7zS0D0A0BD6\Resources\tis
• %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
• %User Temp%\7zS0D0A0BD6\GenericSetup.exe
• %User Temp%\7zS0D0A0BD6\DevLib.dll
• %User Temp%\7zS0D0A0BD6\installer.exe
• %User Temp%\7zS0D0A0BD6\GenericSetup.dll
• %User Temp%\7zS0D0A0BD6\Resources
• %User Temp%\7zS0D0A0BD6\DevLib.Services.dll
• %User Temp%\7zS0D0A0BD6\2019.12.30_06.29.41.090067_installer_pid=816.txt
• %User Temp%\7zS0D0A0BD6\Resources\OfferPage.html
• %User Temp%\7zS0D0A0BD6\HtmlAgilityPack.dll
• %User Temp%\7zS0D0A0BD6\OfferServiceSDK.dll
• %User Temp%\7zS0D0A0BD6\Resources\style.css
• %User Temp%\7zS0D0A0BD6\Resources\InstallingPage.html
• %User Temp%\7zS0D0A0BD6\GenericSetup.exe.config
• %User Temp%\7zS0D0A0BD6\sciter32.dll
• %User Temp%\7zS0D0A0BD6\Microsoft.Win32.TaskScheduler.dll
• %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
• %User Temp%\7zS0D0A0BD6\Resources\ScanningPage.html
• %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://www.{BLOCKED}oft.com/pki/certs/MicRooCerAut_2010-06-23.crt
• http://flow.{BLOCKED}ft.com/v1/event-stat?ProductID=IS&Type=BundleInfo
• http://flow.{BLOCKED}ft.com/v1/event-stat?ProductID=IS&Type=StubStart
• http://flow.{BLOCKED}ft.com/v1/event-stat?{random characters}
• http://h2oapi.{BLOCKED}e.com

This report is generated via an automated analysis system.