Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Actual Window Rollup' = '"%ProgramFiles%\Actual Window Rollup\ActualWindowRollupCenter.exe"'
Malicious functions:
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\Actual Window Rollup\Skins\is-DGV26.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-OIEMU.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-EVTEI.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-DLIB6.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-KS1OD.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-URR0M.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-BDS04.tmp
- %ProgramFiles%\Actual Window Rollup\Languages\is-S8889.tmp
- %ProgramFiles%\Actual Window Rollup\Languages\is-3LVT2.tmp
- %ProgramFiles%\Actual Window Rollup\Languages\is-IRVFF.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-KQP7G.tmp
- %APPDATA%\Microsoft\Windows\libcurl.dll
- %ProgramFiles%\Actual Window Rollup\Languages\is-F3P4K.tmp
- %ProgramFiles%\Actual Window Rollup\Skins\is-EJNMC.tmp
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\Products Catalog.lnk
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\Uninstall Actual Window Rollup.lnk
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\End User License Agreement.lnk
- %ProgramFiles%\Actual Window Rollup\unins000.dat
- %ProgramFiles%\Actual Window Rollup\unins000.msg
- %ProgramFiles%\Actual Window Rollup\ActualWindowRollupConfig.url
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\View readme.txt.lnk
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\Actual Window Rollup.lnk
- %ProgramFiles%\Actual Window Rollup\is-U2CUI.tmp
- %ProgramFiles%\Actual Window Rollup\is-VOMGH.tmp
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\Actual Window Rollup on the Web.lnk
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\User Manual.lnk
- %HOMEPATH%\Start Menu\Programs\Actual Window Rollup\Configuration.lnk
- %ProgramFiles%\Actual Window Rollup\is-821SD.tmp
- %TEMP%\is-UBB00.tmp\utils.dll
- %TEMP%\is-UBB00.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UBB00.tmp\_isetup\_RegDLL.tmp
- %ProgramFiles%\Actual Window Rollup\is-VBHF5.tmp
- %TEMP%\is-UBB00.tmp\affiliate.dll
- %TEMP%\is-UBB00.tmp\innocallback.dll
- %TEMP%\is-72SHU.tmp\qweew.tmp
- %TEMP%\aut2.tmp
- %TEMP%\qweew.exe
- %TEMP%\aut1.tmp
- %TEMP%\winhostapp.exe
- %TEMP%\aut3.tmp
- %TEMP%\qweewq.exe
- %ProgramFiles%\Actual Window Rollup\is-1F805.tmp
- %ProgramFiles%\Actual Window Rollup\is-B5QAJ.tmp
- %ProgramFiles%\Actual Window Rollup\is-A057F.tmp
- %APPDATA%\Microsoft\Windows\1.exe
- %ProgramFiles%\Actual Window Rollup\is-PVN0R.tmp
- %ProgramFiles%\Actual Window Rollup\is-2499P.tmp
- %ProgramFiles%\Actual Window Rollup\is-G3GND.tmp
- %APPDATA%\Microsoft\Windows\sqlite3.dll
- %ProgramFiles%\Actual Window Rollup\is-V6EVE.tmp
- %APPDATA%\Microsoft\Windows\msvcr100.dll
- %ProgramFiles%\Actual Window Rollup\is-CSFFG.tmp
- %ProgramFiles%\Actual Window Rollup\is-4U8SG.tmp
- %ProgramFiles%\Actual Window Rollup\is-EJRGI.tmp
- %ProgramFiles%\Actual Window Rollup\is-AAMVE.tmp
Sets the 'hidden' attribute to the following files:
- %ProgramFiles%\Actual Window Rollup\ConsoleHelper.dll
- %ProgramFiles%\Actual Window Rollup\ActualToolsConsoleHelper.exe
- %ProgramFiles%\Actual Window Rollup\awremb.dll
Deletes the following files:
- %TEMP%\is-UBB00.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-UBB00.tmp\utils.dll
- %TEMP%\is-72SHU.tmp\qweew.tmp
- %TEMP%\is-UBB00.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UBB00.tmp\innocallback.dll
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\is-UBB00.tmp\affiliate.dll
- %TEMP%\aut3.tmp
Moves the following files:
- from %ProgramFiles%\Actual Window Rollup\Skins\is-BDS04.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_1_GlassB1D.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-EVTEI.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_1_GlassB1DT.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-OIEMU.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_2.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-KQP7G.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_1.zip
- from %ProgramFiles%\Actual Window Rollup\Languages\is-3LVT2.tmp to %ProgramFiles%\Actual Window Rollup\Languages\polish.lng
- from %ProgramFiles%\Actual Window Rollup\Languages\is-S8889.tmp to %ProgramFiles%\Actual Window Rollup\Languages\russian.lng
- from %ProgramFiles%\Actual Window Rollup\Languages\is-F3P4K.tmp to %ProgramFiles%\Actual Window Rollup\Languages\ukrainian.lng
- from %ProgramFiles%\Actual Window Rollup\Skins\is-EJNMC.tmp to %ProgramFiles%\Actual Window Rollup\Skins\StyleXP.zip
- from %ProgramFiles%\Actual Window Rollup\is-VOMGH.tmp to %ProgramFiles%\Actual Window Rollup\pcre32.dll
- from %ProgramFiles%\Actual Window Rollup\is-U2CUI.tmp to %ProgramFiles%\Actual Window Rollup\Setup.ico
- from %ProgramFiles%\Actual Window Rollup\Skins\is-DLIB6.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Vista_Beta_2.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-DGV26.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_2_GlassB2D.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-URR0M.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Glass_Beta_2_GlassB2DN.zip
- from %ProgramFiles%\Actual Window Rollup\Skins\is-KS1OD.tmp to %ProgramFiles%\Actual Window Rollup\Skins\Aero_Style_Vista_Beta_1.zip
- from %ProgramFiles%\Actual Window Rollup\is-AAMVE.tmp to %ProgramFiles%\Actual Window Rollup\ActualToolsConsoleHelper.exe
- from %ProgramFiles%\Actual Window Rollup\is-EJRGI.tmp to %ProgramFiles%\Actual Window Rollup\ConsoleHelper.dll
- from %ProgramFiles%\Actual Window Rollup\is-4U8SG.tmp to %ProgramFiles%\Actual Window Rollup\ru.chm
- from %ProgramFiles%\Actual Window Rollup\is-V6EVE.tmp to %ProgramFiles%\Actual Window Rollup\awremb.dll
- from %ProgramFiles%\Actual Window Rollup\is-VBHF5.tmp to %ProgramFiles%\Actual Window Rollup\unins000.exe
- from %ProgramFiles%\Actual Window Rollup\is-1F805.tmp to %ProgramFiles%\Actual Window Rollup\ActualWindowRollupCenter.exe
- from %ProgramFiles%\Actual Window Rollup\is-CSFFG.tmp to %ProgramFiles%\Actual Window Rollup\ActualWindowRollupConfig.exe
- from %ProgramFiles%\Actual Window Rollup\is-PVN0R.tmp to %ProgramFiles%\Actual Window Rollup\Options.ini
- from %ProgramFiles%\Actual Window Rollup\is-821SD.tmp to %ProgramFiles%\Actual Window Rollup\WindowRules.ini
- from %ProgramFiles%\Actual Window Rollup\Languages\is-IRVFF.tmp to %ProgramFiles%\Actual Window Rollup\Languages\english.lng
- from %ProgramFiles%\Actual Window Rollup\is-2499P.tmp to %ProgramFiles%\Actual Window Rollup\WhatsNew.txt
- from %ProgramFiles%\Actual Window Rollup\is-A057F.tmp to %ProgramFiles%\Actual Window Rollup\file_id.diz
- from %ProgramFiles%\Actual Window Rollup\is-B5QAJ.tmp to %ProgramFiles%\Actual Window Rollup\Readme.txt
- from %ProgramFiles%\Actual Window Rollup\is-G3GND.tmp to %ProgramFiles%\Actual Window Rollup\license.txt
Network activity:
Connects to:
- 'ip###ger.com':443
- 'ac###ltools.ru':80
TCP:
HTTP GET requests:
- http://www.ac###ltools.ru/checkupdates2.php?pr################################################################################### via ac###ltools.ru
UDP:
- DNS ASK ip###ger.com
- DNS ASK www.ac###ltools.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ActualTools_ConfigBuilderHandlerWindow' WindowName: 'Actual Window Rollup'
- ClassName: 'ActualTools_ControlCenterHandlerWindow' WindowName: 'Actual Window Rollup'
Creates and executes the following:
- '%TEMP%\is-72SHU.tmp\qweew.tmp' /SL5="$100E4,7518724,74752,%TEMP%\qweew.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\Actual Window Rollup\ActualWindowRollupConfig.exe' -eval_time_install
- '%TEMP%\qweew.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\qweewq.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\winhostapp.exe
- '<SYSTEM32>\cmd.exe' /c %TEMP%\qweewq.exe
- '<SYSTEM32>\cmd.exe' /c %TEMP%\qweew.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
