Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\iso-file\Shell\Open\Command] '' = '"%ProgramFiles%\BurnAware Professional\unpackiso.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\BurnAwareOpen\shell\open\command] '' = '"%ProgramFiles%\BurnAware Professional\burnaware.exe"'
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- chrome.exe
- firefox.exe
- safari.exe
- opera.exe
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %ProgramFiles%\BurnAware Professional\is-0RK9J.tmp
- %ProgramFiles%\BurnAware Professional\is-6JV2N.tmp
- %ProgramFiles%\BurnAware Professional\is-5VNJF.tmp
- %ProgramFiles%\BurnAware Professional\is-PG77J.tmp
- %ProgramFiles%\BurnAware Professional\is-5N6DE.tmp
- %ProgramFiles%\BurnAware Professional\is-U9VGT.tmp
- %ProgramFiles%\BurnAware Professional\is-A5N1F.tmp
- %ProgramFiles%\BurnAware Professional\is-7CMGF.tmp
- %ProgramFiles%\BurnAware Professional\is-5N64C.tmp
- %TEMP%\aut2.tmp
- %ProgramFiles%\BurnAware Professional\is-SLDPO.tmp
- %ProgramFiles%\BurnAware Professional\is-3MKSV.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional on the Web.url
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Uninstall BurnAware Professional.lnk
- %ALLUSERSPROFILE%\Desktop\BurnAware Professional.lnk
- %ProgramFiles%\BurnAware Professional\unins000.dat
- %ProgramFiles%\BurnAware Professional\is-BQJ6K.tmp
- %ProgramFiles%\BurnAware Professional\is-D1D8O.tmp
- %ProgramFiles%\BurnAware Professional\is-COMN3.tmp
- %ProgramFiles%\BurnAware Professional\is-U1SVS.tmp
- %CommonProgramFiles%\~oqcpwbk.tmp
- %TEMP%\is-SSP0K.tmp\~oqcpwbk.tmp
- %ProgramFiles%\BurnAware Professional\is-C0HLV.tmp
- %ProgramFiles%\BurnAware Professional\is-HOM9F.tmp
- %ProgramFiles%\BurnAware Professional\is-RT129.tmp
- %ProgramFiles%\BurnAware Professional\is-GC1IL.tmp
- %ProgramFiles%\BurnAware Professional\is-2I19P.tmp
- %ProgramFiles%\BurnAware Professional\is-F3PNJ.tmp
- %ProgramFiles%\BurnAware Professional\is-PU2PI.tmp
- %ProgramFiles%\BurnAware Professional\is-EB76F.tmp
- %ProgramFiles%\BurnAware Professional\is-4VJBA.tmp
- %ProgramFiles%\BurnAware Professional\is-J7FQ7.tmp
- %ProgramFiles%\BurnAware Professional\is-HEMK1.tmp
- %ProgramFiles%\BurnAware Professional\is-N8R1C.tmp
- %ProgramFiles%\BurnAware Professional\is-GE519.tmp
- %ProgramFiles%\BurnAware Professional\is-VR2J4.tmp
- %ProgramFiles%\BurnAware Professional\is-6HO7H.tmp
- %ProgramFiles%\BurnAware Professional\is-PKLLQ.tmp
- %ProgramFiles%\BurnAware Professional\is-RKU81.tmp
- %ProgramFiles%\BurnAware Professional\BurnAware.exe
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~oqcpwbk.tmp
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\is-SSP0K.tmp\~oqcpwbk.tmp
- %TEMP%\aut2.tmp
- %ProgramFiles%\BurnAware Professional\ba11pro.dll
- %CommonProgramFiles%\~oqcpwbk.tmp
Moves the following files:
- from %ProgramFiles%\BurnAware Professional\is-C0HLV.tmp to %ProgramFiles%\BurnAware Professional\unins000.exe
- from %ProgramFiles%\BurnAware Professional\is-5N64C.tmp to %ProgramFiles%\BurnAware Professional\ba11pro.dll
- from %ProgramFiles%\BurnAware Professional\is-D1D8O.tmp to %ProgramFiles%\BurnAware Professional\Dos622.img
- from %ProgramFiles%\BurnAware Professional\is-7CMGF.tmp to %ProgramFiles%\BurnAware Professional\bawmalib.dll
- from %ProgramFiles%\BurnAware Professional\is-A5N1F.tmp to %ProgramFiles%\BurnAware Professional\tags.dll
- from %ProgramFiles%\BurnAware Professional\is-U9VGT.tmp to %ProgramFiles%\BurnAware Professional\basswma.dll
- from %ProgramFiles%\BurnAware Professional\is-5N6DE.tmp to %ProgramFiles%\BurnAware Professional\bassflac.dll
- from %ProgramFiles%\BurnAware Professional\is-PG77J.tmp to %ProgramFiles%\BurnAware Professional\bassenc.dll
- from %ProgramFiles%\BurnAware Professional\is-5VNJF.tmp to %ProgramFiles%\BurnAware Professional\bass.dll
- from %ProgramFiles%\BurnAware Professional\is-6JV2N.tmp to %ProgramFiles%\BurnAware Professional\baplayer.dll
- from %ProgramFiles%\BurnAware Professional\is-0RK9J.tmp to %ProgramFiles%\BurnAware Professional\bamedenclib.dll
- from %ProgramFiles%\BurnAware Professional\is-BQJ6K.tmp to %ProgramFiles%\BurnAware Professional\bamainlib.dll
- from %ProgramFiles%\BurnAware Professional\is-COMN3.tmp to %ProgramFiles%\BurnAware Professional\badecx.dll
- from %ProgramFiles%\BurnAware Professional\is-RKU81.tmp to %ProgramFiles%\BurnAware Professional\burnaware.chm
- from %ProgramFiles%\BurnAware Professional\is-EB76F.tmp to %ProgramFiles%\BurnAware Professional\UnpackISO.exe
- from %ProgramFiles%\BurnAware Professional\is-PKLLQ.tmp to %ProgramFiles%\BurnAware Professional\AudioGrabber.exe
- from %ProgramFiles%\BurnAware Professional\is-6HO7H.tmp to %ProgramFiles%\BurnAware Professional\MultiBurn.exe
- from %ProgramFiles%\BurnAware Professional\is-VR2J4.tmp to %ProgramFiles%\BurnAware Professional\BurnAware.exe
- from %ProgramFiles%\BurnAware Professional\is-GE519.tmp to %ProgramFiles%\BurnAware Professional\VerifyDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-N8R1C.tmp to %ProgramFiles%\BurnAware Professional\DataRecovery.exe
- from %ProgramFiles%\BurnAware Professional\is-HEMK1.tmp to %ProgramFiles%\BurnAware Professional\CopyDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-J7FQ7.tmp to %ProgramFiles%\BurnAware Professional\MakeISO.exe
- from %ProgramFiles%\BurnAware Professional\is-4VJBA.tmp to %ProgramFiles%\BurnAware Professional\CopyImage.exe
- from %ProgramFiles%\BurnAware Professional\is-PU2PI.tmp to %ProgramFiles%\BurnAware Professional\EraseDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-U1SVS.tmp to %ProgramFiles%\BurnAware Professional\DiscInfo.exe
- from %ProgramFiles%\BurnAware Professional\is-F3PNJ.tmp to %ProgramFiles%\BurnAware Professional\DataDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-2I19P.tmp to %ProgramFiles%\BurnAware Professional\MediaDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-GC1IL.tmp to %ProgramFiles%\BurnAware Professional\BurnImage.exe
- from %ProgramFiles%\BurnAware Professional\is-RT129.tmp to %ProgramFiles%\BurnAware Professional\AudioCD.exe
- from %ProgramFiles%\BurnAware Professional\is-HOM9F.tmp to %ProgramFiles%\BurnAware Professional\SpanDisc.exe
- from %ProgramFiles%\BurnAware Professional\is-SLDPO.tmp to %ProgramFiles%\BurnAware Professional\isofile.ico
- from %ProgramFiles%\BurnAware Professional\is-3MKSV.tmp to %ProgramFiles%\BurnAware Professional\bashell32.dll
Network activity:
Connects to:
- 'localhost':1037
- 'bu###ware.com':80
TCP:
HTTP GET requests:
- http://www.bu###ware.com/after-install.html via bu###ware.com
UDP:
- DNS ASK www.bu###ware.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%CommonProgramFiles%\~oqcpwbk.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-SSP0K.tmp\~oqcpwbk.tmp' /SL5="$100E0,8559971,189952,%CommonProgramFiles%\~oqcpwbk.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
