ThreatExpert Report: Mal/Behav-010, Trojan.Win32.Sasfis, not-a-virus:AdWare.Win32.WinAgir

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 8 September 2012, 14:59:49
Processing time: 8 min 16 sec
Submitted sample:

File MD5: 0x2E4A7D7E8FDAC0197BE6B10C861212CA
File SHA-1: 0x039DA54E33DCE5DBBD031C54F05DEAC1F38321FB
Filesize: 641,448 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\nso2.tmp\nsProcess.dll	4,608 bytes	MD5: 0x8F4AC52CB2F7143F29F114ADD12452AD SHA-1: 0x29DC25F5D69BF129D608B83821C8EC8AB8C8EDB3	(not available)
2	%Temp%\nso2.tmp\nsProcEx.dll	24,576 bytes	MD5: 0x0216CAB025A4EA223141F66CBE14CCAF SHA-1: 0xB08B563D5FD794E17208912E8237C961BCA5516F	(not available)
3	%Temp%\nso2.tmp\SelfDel.dll	4,608 bytes	MD5: 0x7CFF7FE2CAEA5184D98C147E7E263132 SHA-1: 0x21F39D3D0DD5F7198D67EF30E95D10AE3460093E	packed with UPX [Kaspersky Lab]
4	%Temp%\nso2.tmp\winsps.dll %ProgramFiles%\WinsPop\winsps.dll	384,936 bytes	MD5: 0x3BFF8B470B752A4CCAC025207EF522E7 SHA-1: 0xD34A4B46CC259A414CB413D7E45DD06275DA346F	Mal/Behav-010 [Sophos] Trojan.Win32.Sasfis [Ikarus]
5	%ProgramFiles%\WinsPop\uninst.exe	273,369 bytes	MD5: 0xF7AFB22FABD565032E8890D55FBE778E SHA-1: 0x903C9C67CAAA33137D0D43D407D1FD11FF5A664C	(not available)
6	%ProgramFiles%\WinsPop\winspb.dll	81,832 bytes	MD5: 0x9451B8ADAAE1E9B16E9AC61A4F183B5A SHA-1: 0x0A8FFF9A687FF6DB0BEF96B2648C17183622F048	(not available)
7	[file and pathname of the sample #1]	641,448 bytes	MD5: 0x2E4A7D7E8FDAC0197BE6B10C861212CA SHA-1: 0x039DA54E33DCE5DBBD031C54F05DEAC1F38321FB	(not available)
8	%System%\svcspwin.exe	94,120 bytes	MD5: 0x4E1B6AC6EA4E0F49998801C106CCE2C5 SHA-1: 0x60C1688BB992EB064BF18089541BF88424467B39	not-a-virus:AdWare.Win32.WinAgir [Ikarus]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%AppData%\WinsPop
%Temp%\nso2.tmp
%ProgramFiles%\WinsPop

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svcspwin.exe	%System%\svcspwin.exe	102,400 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	241,664 bytes
svcspwin.da.exe	%System%\svcspwin.da.exe	102,400 bytes

Attention! The following processes were intentionally hidden from the user:

Process Name	Main Module Size
svcspwin.exeexe	102,400 bytes
svcspwin.exeexe	102,400 bytes

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
WinsPop Service	WinsPop Service	"Running"	%System%\svcspwin.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinsPop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinsPop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Apcd
HKEY_LOCAL_MACHINE\SOFTWARE\WinsPop
HKEY_LOCAL_MACHINE\SOFTWARE\WinsPop\Status
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service\Enum
HKEY_CURRENT_USER\Software\WinsPop

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\VersionIndependentProgID]

(Default) = "WinsPopBHO.WinsPopAPI"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\TypeLib]

(Default) = "{31C3FB97-CFD9-4745-BE40-1E5F5702635E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ProgID]

(Default) = "WinsPopBHO.WinsPopAPI.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\InprocServer32]

(Default) = "%ProgramFiles%\WinsPop\winspb.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}]

(Default) = "WinsPop Hlp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib]

(Default) = "{31C3FB97-CFD9-4745-BE40-1E5F5702635E}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}]

(Default) = "IWinsPopAPI"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0\win32]

(Default) = "%ProgramFiles%\WinsPop\winspb.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\WinsPop\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0]

(Default) = "WinsPopAPIClass 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CurVer]

(Default) = "WinsPopBHO.WinsPopAPI.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CLSID]

(Default) = "{66B39A8A-3134-47b7-85C6-3E7DF7D14586}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI]

(Default) = "WinsPopAPI Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1\CLSID]

(Default) = "{66B39A8A-3134-47b7-85C6-3E7DF7D14586}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1]

(Default) = "WinsPopAPI Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinsPop]

Changed = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}]

(Default) = "WinsPopAPI Helper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinsPop]

DisplayName = "WinsPop"
InstallLocation = "%ProgramFiles%\WinsPop"
UninstallString = "%ProgramFiles%\WinsPop\uninst.exe"
Publisher = "WinsPop"
HelpLink = "http://www.winspop.co.kr"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Apcd]

apcd3 = "8ea7b3bfa3c9d1"

[HKEY_LOCAL_MACHINE\SOFTWARE\WinsPop\Status]

last_patch = "2012/09/08 14:59:53"

[HKEY_LOCAL_MACHINE\SOFTWARE\WinsPop]

dist = ""
mid = "XX92CFE80546"
ts_shift2 = "18553"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinsPop Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE\0000]

Service = "WinsPop Service"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinsPop Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINSPOP_SERVICE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service\Enum]

0 = "Root\LEGACY_WINSPOP_SERVICE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinsPop Service]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svcspwin.exe"
DisplayName = "WinsPop Service"
ObjectName = "LocalSystem"
Description = "?"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinsPop Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE\0000]

Service = "WinsPop Service"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinsPop Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINSPOP_SERVICE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service\Enum]

0 = "Root\LEGACY_WINSPOP_SERVICE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinsPop Service]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svcspwin.exe"
DisplayName = "WinsPop Service"
ObjectName = "LocalSystem"
Description = "?"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

Enable Browser Extensions = "yes"

[HKEY_CURRENT_USER\Software\WinsPop]

bn = "2012/09/08 14:59:54"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies =
History =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	United Kingdom
	Republic of Korea

To mark the presence in the system, the following Mutex object was created:

adpt_8ea7b3bfa3c9d1

The following Host Names were requested from a host database:

192.5.5.241
wnp_svc.ddnswzplus.com

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
svc.winspop.co.kr	80	(null)	(null)
checkmen.co.kr?a=cb0a4a80bcedf17489c2dc0e5894ccf829679fda59467fb83d2f619d211493cc053e77659bd70d487fc0f9785ddc1c4c857b07ec6babdb140a	80	(null)	(null)

The data identified by the following URL was then requested from the remote web server:

http://svc.winspop.co.kr/apps/act.php?_pi=bdcae2e7112a2d0e5a7090abc5deeafc1b2f004b6d81&a=bec5ea03112f466c60787182abc6dde8f8152c46a47088a0

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.