PUA.Win32.Softcnapp.ABE

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application creates the following folders:

• %AppDataLocal%Low\WanNengWBIME\Config
• %AppDataLocal%Low\WanNengWBIME\AllSkin
• %AppDataLocal%Low\WanNengWBIME
• %AppDataLocal%Low\WanNengWBIME.users\BackMB
• %AppDataLocal%Low\WanNengWBIME.users\MB
• %Program Files%\WanNengWBInput\10.0.2.10108
• %Program Files%\WanNengWBInput\10.0.2.10108\Dict
• %AppDataLocal%Low\WanNengWBIME\Skin
• %AppDataLocal%Low\WanNengWBIME.users
• %Program Files%\WanNengWBInput
• %AppDataLocal%Low\WanNengWBIME\UseData

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• %AppDataLocal%Low\WanNengWBIME.users\MB\UserData.db-journal
• %AppDataLocal%Low\WanNengWBIME.users\MB\UserFreqData.db-journal

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %AppDataLocal%Low\WanNengWBIME.users\MB\UserFreqData.db
• %AppDataLocal%Low\WanNengWBIME.users\MB\UserData.db
• %AppDataLocal%Low\WanNengWBIME\Config\Related.ini

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Potentially Unwanted Application renames encrypted files using the following names:

• {encrypted file}.db-journal

This report is generated via an automated analysis system.