PUA.Win32.AppCrack.AG

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It uses a user interface (UI).

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %User Temp%\ir_ext_temp_0\AutoPlay\Audio\ ARASH - Broken Angel Feat Helena From the upcoming 2011 album_2.mp3
• %User Temp%\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg
• %User Temp%\ir_ext_temp_0\AutoPlay\Audio\High1.ogg
• %User Temp%\ir_ext_temp_0\AutoPlay\autorun.cdd
• %User Temp%\ir_ext_temp_0\AutoPlay\Buttons\1041_0041.btn
• %User Temp%\ir_ext_temp_0\AutoPlay\Buttons\charcoal_parallelegram.btn
• %User Temp%\ir_ext_temp_0\AutoPlay\Docs\crack\USBGuard.exe
• %User Temp%\ir_ext_temp_0\AutoPlay\Docs\setup.exe
• %User Temp%\ir_ext_temp_0\AutoPlay\Icons\Pirate Icon 59.ico
• %User Temp%\ir_ext_temp_0\AutoPlay\Images\77.jpg
• %User Temp%\ir_ext_temp_0\autorun.exe
• %User Temp%\ir_ext_temp_0\lua5.1.dll
• %User Temp%\ir_ext_temp_0\lua51.dll
• %User Temp%\ir_ext_temp_0\Pirate Icon 59.ico
• %User Temp%\_ir_tmpfnt_1\Symbol.TFT

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %User Temp%\ir_ext_temp_0\autorun.exe" "SFXSOURCE:{Malware File Path}"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Potentially Unwanted Application does not have any propagation routine.

Backdoor Routine

This Potentially Unwanted Application does not have any backdoor routine.

Rootkit Capabilities

This Potentially Unwanted Application does not have rootkit capabilities.

Information Theft

This Potentially Unwanted Application does not have any information-stealing capability.

Other Details

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\DirectSound

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\DirectSound\
Speaker Configuration

It uses the following user interface:

It does the following:

• It cracks a specific version of USB Disk Security.
  • Version 6.0.0.126
• It has the following requirements for it to continue to its cracking routine.
  • Install USB Disk Security (Target application)

NOTES:

It does not exploit any vulnerability.