PUA.Win32.SpeedUpMyPc.AG

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %User Temp%\Setup Log {YYYY-MM-DD} #{log#}.txt
• Temporary files (deleted afterwards):
  • %User Temp%\is-{5 random characters}.tmp\{malware name}.tmp
  • %User Temp%\is-{5 random characters}.tmp\_isetup\_shfoldr.dll
  • %User Temp%\is-{5 random characters}.tmp\InstallerExtensions.dll
  • %User Temp%\is-{5 random characters}.tmp\notcertified.bmp
  • %User Temp%\is-{5 random characters}.tmp\printer.bmp
  • %User Temp%\is-{5 random characters}.tmp\license.en.rtf
  • %User Temp%\is-{5 random characters}.tmp\banner_icon.bmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%User Temp%\is-{5 random characters}.tmp\{malware name}.tmp" /SL5="$B04E6,785468,542208,{malware path}\{malware name}.exe"
• If file is successfully downloaded:
  • "%User Temp%\is-{5 random characters}.tmp\SpeedUpMyPC-standalone-setup.exe" /VERYSILENT /NORESTART /LANG=en /DIR="{set installation folder}" /TASKS=desktopicon,quicklaunchicon,allowtracking /PurchaseURL=http://www.uniblue.com/cm/installcore-ppi/speedupmypc/sp_jp_01/purchase/ /CreateRestorePoint=no /Launch=yes /LaunchDelay=0 /RecommendedByIntegratedImagePath= /ShouldEnableAnalytics=yes /EcommercePlatform=cleverbridge /TrackEventRecipient= /

Download Routine

This Potentially Unwanted Application connects to the following URL(s) to download its component file(s):

• http://download.{BLOCKED}e.com/product/sp/6.0.2.0/SpeedUpMyPC-standalone-setup.exe

It saves the files it downloads using the following names:

• %User Temp%\is-{5 random characters}.tmp\SpeedUpMyPC-standalone-setup.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Potentially Unwanted Application displays the following images:

• 
• Presents the following options before installation:
  
• Message presented when download fails:
  

However, as of this writing, the said sites are inaccessible.