MD5: 23f47d2560af5bc1f634060b6abacdf3
SHA1: e73bfcae173a38d348126ea65a0997d6cf7d8a5e
SHA256: 0e8d9d2d946bf5ab422174228b81fa6db0da0a0cf251e0e46f0a2754d6661b6a
SSDeep: 24576:krIj3qYmj/2eOXC6siFxtSoZfI4cluNaNf5Lut7hPcX3rpTaUeyIw7AAj2kAzV4C:ebSNswtSMOrpNeQxj2QprDlDZYWg
Size: 2335744 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2016-11-08 17:23:40
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2180

The Trojan injects its code into the following process(es):

J0H3QAI5QG.exe:2724

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2180 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\J0H3QAI5QG.exe (19528 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\V60LYP4YWI.exe (0 bytes)

The process J0H3QAI5QG.exe:2724 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cast.config (38 bytes)

Registry activity

The process %original file name%.exe:2180 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\otut]
"partner" = "idsc"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASMANCS]
"FileTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\otut]
"Product" = "unknown"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASMANCS]
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\otut]
"channel" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\23f47d2560af5bc1f634060b6abacdf3_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process J0H3QAI5QG.exe:2724 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASMANCS]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\J0H3QAI5QG_RASMANCS]
"EnableFileTracing" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"3OWZXRF45I" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\J0H3QAI5QG.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: HSUO
Product Name:
Product Version: 4.6.3.4
Legal Copyright: Copyright (c) 2016
Legal Trademarks: HSUO@3CK
Original Filename: Cendrillon.exe
Internal Name: Cendrillon.exe
File Version: 4.6.3.4
File Description: HS
Comments: HSUO@
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://weminternal.com/get/3/wizzcaster_v2.exe	46.105.121.115
hxxp://wizzcaster.com/api/v5/config	176.31.115.114
hxxp://wizzcaster.com/api/v5/link	176.31.115.114

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

GET /get/3/wizzcaster_v2.exe HTTP/1.1

Host: weminternal.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 22 Nov 2016 06:05:07 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

content-disposition: attachment; filename="wizzcaster_v2.exe"

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-msdownload
5a400..MZ......................@......................................
.........!..L.!This program cannot be run in DOS mode....$.......PE..L
...\..W.........."...0.................. ........@.. .................
...................@.................................p...O............
.......................8..............................................
.. ............... ..H............text........ ...................... 
..`.rsrc...............................@..@.reloc.....................
.........@..B........................H........%..............x@...v...
.......................................6.(.....(....*z.,..{....,..{...
.o......(....*z.s....}......(.....r...po....*V.(......}......}....*...
0...........{....(....t.....s.....{......o......r...po.....r...po.....
..ijo .....o!....o".........io#......,..o......o$...t1...o%...s&...o'.
..*......R.._.......0..........(.....s....o......&..*.................
..((...~....%-.&~..........s)...%.....o*...*..0..G.......s ....r[..p..
. 1..r]..p(,...o-.....r]..p.(........(/...(0......X...2..*..(....*..0.
..........(....r[..p.....,Q....(1.......(2......5...%...%....((...o3..
.r...p(4....(5....(.....^o6...(7...&.Q((...o3...r...p(4...(8........i.
2).........(9.....(1.....(:.......(;...i. .s<...z...(....}......(..
..}....*........N..V.......0..B.......~=...r...p.o>.....-.*...(....
r...p(?...o@...r...p(A...oB....oC...*...0../....... ....(D.....{....(E
...&..&.. `....{....Z(D... ...................~....-.r...p.....(F...oG
...sH........~....*.~....*.......*.~....*..(I...*Vs....(J...t.....
<<< skipped >>>

POST /api/v5/config HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: wizzcaster.com

Content-Length: 38

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue
....



uid=57a764d042bf8&days_after_install=0

HTTP/1.1 200 OK

Date: Tue, 22 Nov 2016 06:05:10 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

Set-Cookie: laravel_session=7eac9170c3a1cd4c679e670fc0f581113f5a8318; expires=Tue, 22-Nov-2016 08:05:10 GMT; Max-Age=7200; path=/; httponly

Content-Length: 28

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
{"time_between_prints":"20"}HTTP/1.1 200 OK..Date: Tue, 22 Nov 2016 06
:05:10 GMT..Server: Apache/2.4.10 (Debian)..Cache-Control: no-cache..S
et-Cookie: laravel_session=7eac9170c3a1cd4c679e670fc0f581113f5a8318; e
xpires=Tue, 22-Nov-2016 08:05:10 GMT; Max-Age=7200; path=/; httponly..
Content-Length: 28..Keep-Alive: timeout=10, max=100..Connection: Keep-
Alive..Content-Type: text/html; charset=UTF-8..{"time_between_prints":
"20"}....


POST /api/v5/link HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: wizzcaster.com

Content-Length: 17

Expect: 100-continue

HTTP/1.1 100 Continue
....



uid=57a764d042bf8

HTTP/1.1 200 OK

Date: Tue, 22 Nov 2016 06:05:10 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

Set-Cookie: laravel_session=a49d2783bfc869eb8cebe96db502ca978e78887d; expires=Tue, 22-Nov-2016 08:05:11 GMT; Max-Age=7200; path=/; httponly

Content-Length: 59

Content-Type: text/html; charset=UTF-8
{"link":"http:\/\/wizzcaster.com\/redirect\/57a764d042bf8"}HTTP/1.1 20
0 OK..Date: Tue, 22 Nov 2016 06:05:10 GMT..Server: Apache/2.4.10 (Debi
an)..Cache-Control: no-cache..Set-Cookie: laravel_session=a49d2783bfc8
69eb8cebe96db502ca978e788..

The Trojan connects to the servers at the folowing location(s):

mi^

i^

J0H3QAI5QG.exe_2724_rwx_00302000_00002000:

0141 1$1

J0H3QAI5QG.exe_2724_rwx_039F0000_00010000:

%8x[v

J0H3QAI5QG.exe_2724_rwx_69722000_00002000:

.ri3J

-yiq.yiw

-yiq.yi

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2180
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\J0H3QAI5QG.exe (19528 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cast.config (38 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "3OWZXRF45I" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\J0H3QAI5QG.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.