Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\wingat.ini.lnk
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\Documents\WirarUpdat.exe" "WirarUpdat.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\aut6322.tmp
- %TEMP%\ai_extui_bin_3280\info
- %TEMP%\ai_extui_bin_3280\folderlogoicon
- %TEMP%\ai_extui_bin_3280\exclamic
- %TEMP%\ai_extui_bin_3280\background
- %TEMP%\ai_extui_bin_3280\custicon
- %TEMP%\ai_extui_bin_3280\completi
- %TEMP%\ai_extui_bin_3280\btnimg
- %TEMP%\ai_extui_bin_3280\banner
- %TEMP%\ai_extui_bin_3280\applogoicon
- %TEMP%\msi441e.tmp
- %TEMP%\msi43ea.tmp
- %TEMP%\msi43d5.tmp
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\welcome.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\verifyrepair.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\verifyremove.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\verifyready.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\varstyle.css
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\style.css
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\userexit.html
- %TEMP%\ai_extui_bin_3280\installlogoicon
- %TEMP%\ai_extui_bin_3280\insticon
- %TEMP%\ai_extui_bin_3280\lzmaextractor.dll
- %TEMP%\ai_extui_bin_3280\cmdlinkarrow
- %TEMP%\ai_extui_bin_3280\aicustact.dll
- %TEMP%\ai_extui_bin_3280\shortcutflags.dll
- %TEMP%\ai_extui_bin_3280\prereq.dll
- %TEMP%\ai_extui_bin_3280\whitebackground
- %TEMP%\ai_extui_bin_3280\waitlogoicon
- %TEMP%\ai_extui_bin_3280\up
- %TEMP%\ai_extui_bin_3280\repairic
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\next.png
- %TEMP%\ai_extui_bin_3280\removico
- %TEMP%\ai_extui_bin_3280\readmelogoicon
- %TEMP%\ai_extui_bin_3280\progress
- %TEMP%\ai_extui_bin_3280\progressbg
- %TEMP%\ai_extui_bin_3280\printico
- %TEMP%\ai_extui_bin_3280\optionslogoicon
- %TEMP%\ai_extui_bin_3280\new
- %TEMP%\ai_extui_bin_3280\minbackground
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\server.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\rmfiles.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\retry.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\check.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\cancel.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\button-large-bg.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\box-repair.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\box-remove.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\box-custom.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\box-add-remove.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\box.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\back.png
- %TEMP%\msi414a.tmp
- %HOMEPATH%\documents\wirarupdat.exe
- %APPDATA%\yamicsoft\windows 10 manager 1.0.2\install\windows10managersetup.x64.msi
- %APPDATA%\yamicsoft\windows 10 manager 1.0.2\install\windows10managersetup.msi
- %TEMP%\data\windows10manager.exe
- %TEMP%\aut63cd.tmp
- %TEMP%\data\windows32.exe
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\client_server.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\common.js
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\client.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\customize.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\resume.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\pngfix\dd_belatedpng_0.0.8a.js
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\readme.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\progress\progressbar.js
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\progress\progressbar.css
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\progress.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\print.png
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\prepare.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\outofrbdisk.html
- %TEMP%\ai_extui_bin_3280\tabback
- %TEMP%\ai_extui_bin_3280\tempfiles.dll
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\maintype.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\maintwelcome.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\jquery-1.3.2.js
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\folder.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\fileinuse.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\fatalerror.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\exit.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\diskcost.html
- %TEMP%\{914b9df1-be1c-430e-a606-3378c727cb55}\spring.742da8b7\outofdisk.html
- %TEMP%\msi14cf2.log
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\wirarupdat.exe
Deletes the following files
- %TEMP%\aut6322.tmp
- %TEMP%\aut63cd.tmp
- %TEMP%\msi414a.tmp
- %TEMP%\msi43d5.tmp
- %TEMP%\msi43ea.tmp
- %TEMP%\msi441e.tmp
Network activity
TCP
HTTP GET requests
- http://ai##.wosign.com/ca1-class3-code.cer
- http://ai##.wosign.com/ca1-tsa.cer
UDP
- DNS ASK ai##.wosign.com
- DNS ASK so#####a.blogdns.org
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\data\windows10manager.exe'
- '%TEMP%\data\windows32.exe'
- '%HOMEPATH%\documents\wirarupdat.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\Documents\WirarUpdat.exe" "WirarUpdat.exe" ENABLE' (with hidden window)
