TROJ_COINMINE.WIOJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Windows%\Prefetch\wuauser.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000\Control

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Enum

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
Type = "16"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
ClassGUID = {GUID}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
DeviceDesc = "Windows Event Log Management"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Enum
0 = "Root\LEGACY_WELM\0000"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Enum
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\ServiceCurrent
(Default) = "16"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000\Control
ActiveService = "WELM"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
ImagePath = "%Windows%\Prefetch\wuauser.exe --server"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
DisplayName = "Windows Event Log Management"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM\Security
Security = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
FailureActions = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WELM
Description = "Windows Provides Event Log to access management information."

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000\Control
*NewlyCreated* = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
Service = "WELM"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
ConfigFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_WELM\
0000
Class = "LegacyDriver"

Dropping Routine

This Trojan drops the following files:

• %Windows%\Prefetch\id.txt
• %Temp%\{random}_Miner_.log

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Download Routine

This Trojan saves the files it downloads using the following names:

• %Windows%\security\msiexev.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}7.{BLOCKED}566.com
• {BLOCKED}ip.com