ThreatExpert Report: Adware-ISM

Submission Summary:

Submission details:

Submission received: 16 May 2008, 18:14:30
Processing time: 3 min 31 sec
Submitted sample:

File MD5: 0xE0C2AFDE5B351A39B28133F4A057E5A3
File SHA-1: 0x6CCA282054EE02ABE4F755E9FC9592384BAA0EAC
Filesize: 278,793 bytes
Alias: Adware-ISM [McAfee]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Adsponsor	Adsponsor is a Browser Helper Object which was installed by other malware. It contacts remote servers and display pop up advertisements. Adsponsor is a potential unwanted software.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\Internet Speed Monitor\Check Now.lnk	622 bytes	MD5: 0x6BE9151C36C9CB30FB27F75833FE6299 SHA-1: 0x165E667EC7804175CB00C536A68D190B89428921	(not available)
2	%Programs%\Internet Speed Monitor\Uninstall.lnk	658 bytes	MD5: 0x62DF90DDA53B7E3EF5B03C23342E65B3 SHA-1: 0xDEF9015CEDEA7114976CA3DF17952BEDBE50AA0B	(not available)
3	%ProgramFiles%\ISM\ism.exe	233,472 bytes	MD5: 0xD868F12C41A37BCE1B547410E99ECC5A SHA-1: 0x39764B6E0AACD3C381C05920BEFD57EC47111C59	Adware-ISM [McAfee]
4	%ProgramFiles%\ISM\Uninstall.exe	32,761 bytes	MD5: 0x6F092186EC7B8418497CE2AE7FCA3A53 SHA-1: 0xB40E920A0A92075667521C4B5237A0385D052B54	(not available)
5	%ProgramFiles%\QdrDrive\QdrDrive11.dll	172,032 bytes	MD5: 0x94CE36792F1640A9FE32DBD449E4B6F9 SHA-1: 0xAB6C68CC337C0C6C16ACD2968892F1701B66175A	Adware-ISM [McAfee]
6	%ProgramFiles%\QdrDrive\qdrloader.exe	40,960 bytes	MD5: 0x2C57AE66F42E515C9B6E5C730007E44E SHA-1: 0x00021DA291019C0602470BB551214F8F2C3C6FB1	(not available)
7	%ProgramFiles%\QdrModule\QdrModule13.exe	372,736 bytes	MD5: 0x07963A2C43800BB5399E0629AAA89648 SHA-1: 0x862B7AF10CF69408CD34ED56DD1E13E1E8E6890F	(not available)
8	[file and pathname of the sample #1]	278,793 bytes	MD5: 0xE0C2AFDE5B351A39B28133F4A057E5A3 SHA-1: 0x6CCA282054EE02ABE4F755E9FC9592384BAA0EAC	Adware-ISM [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\Internet Speed Monitor
%ProgramFiles%\ISM
%ProgramFiles%\QdrDrive
%ProgramFiles%\QdrModule

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
QdrModule13.exe	%ProgramFiles%\qdrmodule\qdrmodule13.exe	389,120 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	184,320 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
QdrDrive11.dll	%ProgramFiles%\QdrDrive\QdrDrive11.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xF70000 - 0xF9C000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BndAero6.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5C9DA244-A571-4fe7-AB8C-CA47703C686B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\Implemented Categories
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{15F56B17-A0F8-4288-A24C-0F913B34D67B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM
HKEY_CURRENT_USER\Software\QdrDrive
HKEY_CURRENT_USER\Software\QdrModule

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BndAero6.DLL]

AppID = "{5C9DA244-A571-4fe7-AB8C-CA47703C686B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5C9DA244-A571-4fe7-AB8C-CA47703C686B}]

(Default) = "BndAero6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\Implemented Categories\{00021493-0000-0000-C000-000000000046}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\VersionIndependentProgID]

(Default) = "BndAero6.Band"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\TypeLib]

(Default) = "{DDBC293E-52E4-45e8-A684-2C3C96EFC069}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\ProgID]

(Default) = "BndAero6.Band.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}\InprocServer32]

(Default) = "%ProgramFiles%\QdrDrive\QdrDrive11.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15F56B17-A0F8-4288-A24C-0F913B34D67B}]

(Default) = "Internet Speed Monitor"
AppID = "{5C9DA244-A571-4fe7-AB8C-CA47703C686B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\VersionIndependentProgID]

(Default) = "BndAero6.BHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\TypeLib]

(Default) = "{DDBC293E-52E4-45e8-A684-2C3C96EFC069}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\ProgID]

(Default) = "BndAero6.BHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}\InprocServer32]

(Default) = "%ProgramFiles%\QdrDrive\QdrDrive11.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}]

(Default) = "BndAero6 IE Helper"
AppID = "{5C9DA244-A571-4fe7-AB8C-CA47703C686B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\0\win32]

(Default) = "%ProgramFiles%\QdrDrive\QdrDrive11.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\QdrDrive\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DDBC293E-52E4-45E8-A684-2C3C96EFC069}\1.0]

(Default) = "BndShell Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band\CurVer]

(Default) = "BndAero6.Band.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band\CLSID]

(Default) = "{15F56B17-A0F8-4288-A24C-0F913B34D67B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band]

(Default) = "BndAero6 IE Band"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band.1\CLSID]

(Default) = "{15F56B17-A0F8-4288-A24C-0F913B34D67B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.Band.1]

(Default) = "BndAero6 IE Band"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO\CurVer]

(Default) = "BndAero6.BHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO\CLSID]

(Default) = "{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO]

(Default) = "BndAero6 IE Helper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO.1\CLSID]

(Default) = "{82E5E2FF-9260-4d88-B0C6-7CC358C5D418}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BndAero6.BHO.1]

(Default) = "BndAero6 IE Helper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM]

DisplayName = "Internet Speed Monitor"
UninstallString = "%ProgramFiles%\ISM\Uninstall.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

QdrModule13 = ""%ProgramFiles%\QdrModule\QdrModule13.exe""

so that QdrModule13.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\QdrDrive]

BandInstalled = 0x00000001
BrowserUa = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

[HKEY_CURRENT_USER\Software\QdrModule]

Installed = 0x00000001
aid = "28"
Version = 0x0000000D
InstallDt = 0x0000363D

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

The data identified by the following URLs was then requested from the remote web server:

http://popads123.com/venora/we-connect.php
http://zredirector.com/ism/config.php?uid=57731232405913600&aid=1&report=install

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.