Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order] 'ProviderOrder' = 'RDPNP,LanmanWorkstation,webclient,ancred'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ClearPass Agent Controller] 'ImagePath' = '"%ProgramFiles(x86)%\Aruba Networks\ClearPassOnGuard\ClearPassAgentController.exe"'
- [<HKLM>\System\CurrentControlSet\Services\ClearPass Agent Controller] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ClearPass OnGuard Agent Service] 'ImagePath' = '"%ProgramFiles%\Aruba Networks\ClearPassOnGuard\ClearPassOnGuardAgentService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\ClearPass OnGuard Agent Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ClearPass VPN Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ClearPass VPN Service] 'ImagePath' = '"%ProgramFiles%\Aruba Networks\ClearPassOnGuard\arubanetsvc.exe"'
- [<HKLM>\System\CurrentControlSet\Services\dot3svc] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Enable ClearPass OnGuard" dir=in action=allow description="Enable ClearPass OnGuard" program="%ProgramFiles%\Aruba Networks\ClearPassOnGuard\ClearPassOnGuard...
Modifies file system
Creates the following files
- %TEMP%\aute100.tmp
- %WINDIR%\inf\oem1.pnf
- %WINDIR%\inf\oem0.pnf
- %PROGRAMDATA%\aruba networks\clearpassonguard\aninstutil.txt
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\agent-backup.conf
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\agent.conf
- %TEMP%\nsm3d69.tmp\nsisfile.dll
- %PROGRAMDATA%\aruba networks\clearpassonguard\winagent_installer_helper_0.log
- %TEMP%\nsm3d69.tmp\nsexec.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winagent_installer_helper_log.xml
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winagent_helper_log.xml
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winagent_onguard_service_log.xml
- %PROGRAMDATA%\aruba networks\clearpassonguard\winagent_0.log
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winonguardplugin_log.xml
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winagent_log.xml
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winagent_64bit_proxy_log.xml
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\license.cfg
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\wadiagnose.exe
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwacollector.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwalocal.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwaheap.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwautils.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwaresource.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwadeviceinfo.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\libwaapi.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\etc\winsha_remediate_log.xml
- %PROGRAMDATA%\aruba networks\clearpassonguard\winagent_onguard_service_0.log
- %PROGRAMDATA%\aruba networks\clearpassonguard\viaservice.txt
- %PROGRAMDATA%\aruba networks\clearpassonguard\winagent_remediate_0.log
- %WINDIR%\temp\tar2827.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_322952f2bf45f3de4c5e03571d9402fa
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_322952f2bf45f3de4c5e03571d9402fa
- %WINDIR%\temp\cab2826.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\baebe581fcb73249406fc21094ea252e_bc0ce803ef41a748738619ed7838eefc
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\ecf3006d44da211141391220ee5049f4
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\ecf3006d44da211141391220ee5049f4
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\ea618097e393409afa316f0f87e2c202_e8baac5851d57afeaf58a839dc3e5868
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\ea618097e393409afa316f0f87e2c202_e8baac5851d57afeaf58a839dc3e5868
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\40c68d5626484a90937f0752c8b950ab
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\40c68d5626484a90937f0752c8b950ab
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\3130b1871a126520a8c47861efe3ed4d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\3130b1871a126520a8c47861efe3ed4d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce
- %PROGRAMDATA%\aruba networks\clearpassonguard\anuacui-user.txt
- %PROGRAMDATA%\aruba networks\clearpassonguard\install-ok.txt
- <SYSTEM32>\clearpassonguardeventmsgs.dll
- <SYSTEM32>\ancred.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\aruba clearpass onguard.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\aruba networks\clearpass onguard.lnk
- C:\users\public\desktop\clearpass onguard.lnk
- %APPDATA%\aruba networks\clearpassonguard\clearpassonguardhelper_0.log
- %PROGRAMDATA%\aruba networks\clearpassonguard\via status.txt
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\wa_3rd_party_host_64.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\wa_3rd_party_host_32.exe
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\msvcr100.dll
- %WINDIR%\msvcr100.dll
- %WINDIR%\msvcp100.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\resman.dll
- %ProgramFiles%\aruba networks\clearpassonguard\lang\resource_fr-fr.dll
- %ProgramFiles%\aruba networks\clearpassonguard\lang\resource_ko-kr.dll
- %ProgramFiles%\aruba networks\clearpassonguard\lang\resource_ja-jp.dll
- %ProgramFiles%\aruba networks\clearpassonguard\resman.dll
- %ProgramFiles%\aruba networks\clearpassonguard\clearpassonguard.exe
- %ProgramFiles%\aruba networks\clearpassonguard\install.log
- %TEMP%\nsm3d69.tmp\findprocdll.dll
- %TEMP%\nsm3d69.tmp\userinfo.dll
- %WINDIR%\atl100.dll
- %TEMP%\nsm3d69.tmp\system.dll
- %TEMP%\aut110e.tmp
- <Current directory>\djwzskazbi_user.log
- %TEMP%\wiredauthdomain.xml
- %TEMP%\aute5e6.tmp
- %TEMP%\wiredauthbyod.xml
- %TEMP%\aute46e.tmp
- %TEMP%\rowansecure_domain.xml
- %TEMP%\aute315.tmp
- %TEMP%\rowansecure_byod.xml
- %TEMP%\aute21a.tmp
- %TEMP%\changenla.ps1
- %TEMP%\clearpassonguardinstall.exe
- %ProgramFiles%\aruba networks\clearpassonguard\uninst.exe
- %ProgramFiles%\aruba networks\clearpassonguard\anadptr.exe
- %ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\msvcp100.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassusharemediateps.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassusharemediate.exe
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassonguardeventmsgs.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassagenthelper.exe
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassagentcontroller.exe
- %ProgramFiles%\aruba networks\clearpassonguard\clearpassinstallerhelper.exe
- %ProgramFiles%\aruba networks\clearpassonguard\clearpassonguardagentservice.exe
- %ProgramFiles%\aruba networks\clearpassonguard\clearpassagent64bitproxy.exe
- %ProgramFiles%\aruba networks\clearpassonguard\clearpassonguardplugin.dll
- %ProgramFiles%\aruba networks\clearpassonguard\arubavnic.cat
- %ProgramFiles%\aruba networks\clearpassonguard\arubavnic.inf
- %ProgramFiles%\aruba networks\clearpassonguard\arubavnic.sys
- %ProgramFiles%\aruba networks\clearpassonguard\anfirewall.dll
- %ProgramFiles%\aruba networks\clearpassonguard\anwpa.dll
- %ProgramFiles%\aruba networks\clearpassonguard\andrivermanagerplugin.dll
- %ProgramFiles%\aruba networks\clearpassonguard\ancertmgr.dll
- %ProgramFiles%\aruba networks\clearpassonguard\anrachelper.dll
- %ProgramFiles%\aruba networks\clearpassonguard\anrac.dll
- %ProgramFiles%\aruba networks\clearpassonguard\ancred.dll
- %ProgramFiles%\aruba networks\clearpassonguard\arubanetsvc.exe
- %ProgramFiles%\aruba networks\clearpassonguard\libeay32.dll
- %ProgramFiles%\aruba networks\clearpassonguard\ssleay32.dll
- %ProgramFiles%\aruba networks\clearpassonguard\ancrypto.sig
- %ProgramFiles%\aruba networks\clearpassonguard\ancrypto.dll
- %ProgramFiles(x86)%\aruba networks\clearpassonguard\atl100.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\d84e548583be1ee7db5a935821009d26_5b98b6cd6e69202676965cf5b0e2a7a7
Deletes the following files
- %TEMP%\aute100.tmp
- %TEMP%\wiredauthdomain.xml
- %TEMP%\wiredauthbyod.xml
- %TEMP%\rowansecure_domain.xml
- %TEMP%\rowansecure_byod.xml
- %TEMP%\changenla.ps1
- %TEMP%\clearpassonguardinstall.exe
- C:\users\public\desktop\clearpass onguard.lnk
- %TEMP%\nsm3d69.tmp\userinfo.dll
- %TEMP%\nsm3d69.tmp\system.dll
- %TEMP%\nsm3d69.tmp\nsisfile.dll
- %TEMP%\nsm3d69.tmp\nsexec.dll
- %TEMP%\nsm3d69.tmp\findprocdll.dll
- %TEMP%\aut110e.tmp
- %TEMP%\aute5e6.tmp
- %TEMP%\aute46e.tmp
- %TEMP%\aute315.tmp
- %TEMP%\aute21a.tmp
- %WINDIR%\temp\cab2826.tmp
- %WINDIR%\temp\tar2827.tmp
Network activity
Connects to
- 'localhost':25427
- '15#.#50.32.149':443
- '15#.#50.32.155':443
- '15#.#50.32.148':443
TCP
HTTP GET requests
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQJ1TBLBrQ9OnPHXPVaWb87MxkNlgQUwu79F9f%2Btw%2FGciJ7fvbA4gIz7D4CEH6T6%2Ft8xk5Z6kuad9QG%2FDs%3D
UDP
- DNS ASK oc##.thawte.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\aruba networks\clearpassonguard\wa_3rd_party_host_32.exe' --pid=1776
- '%ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassusharemediate.exe' /RegServer
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' changelanguageoption 0
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' restoreconfig "%TEMP%\Backup.txt"
- '%ProgramFiles%\aruba networks\clearpassonguard\arubanetsvc.exe'
- '%ProgramFiles%\aruba networks\clearpassonguard\clearpassinstallerhelper.exe' DeleteOnGuardTempFiles
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' changeappmode 2
- '%ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassagentcontroller.exe'
- '%TEMP%\clearpassonguardinstall.exe' /S
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' launchui -tracelog
- '%ProgramFiles(x86)%\aruba networks\clearpassonguard\clearpassagenthelper.exe' /RegServer
- '%ProgramFiles%\aruba networks\clearpassonguard\clearpassonguardagentservice.exe'
- '%ProgramFiles%\aruba networks\clearpassonguard\clearpassonguard.exe' -tracelog
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' restoreconfig "%TEMP%\Backup.txt"' (with hidden window)
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' launchui -tracelog' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' CONFIG dot3svc start= auto' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Enable ClearPass OnGuard" dir=in action=allow description="Enable ClearPass OnGuard" program="%ProgramFiles%\Aruba Networks\ClearPassOnGuard\ClearPassOnGuard...' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' lan add profile filename=WiredAuthBYOD.xml' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -file ChangeNLA.ps1' (with hidden window)
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' changeappmode 2' (with hidden window)
- '%ProgramFiles%\aruba networks\clearpassonguard\aninstutil.exe' changelanguageoption 0' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="RowanWPA" i=*' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan add profile filename=RowanSecure_BYOD.xml' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="RowanSecure" i=*' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="Rowan_Visitor_Wireless" i=*' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="SOMStudent" i=*' (with hidden window)
- '%ProgramFiles%\aruba networks\clearpassonguard\clearpassinstallerhelper.exe' DeleteOnGuardTempFiles' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' START dot3svc' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' wlan set profileorder name=RowanSecure interface=* priority=1' (with hidden window)
- '%TEMP%\clearpassonguardinstall.exe' /S' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' interface set interface "Wireless Network Connection" Enable' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' interface set interface "Wireless Network Connection" Enable
- '<SYSTEM32>\netsh.exe' advfirewall show currentprofile
- '<SYSTEM32>\cmd.exe' /S /C ""chcp" 437 & "netsh" advfirewall show currentprofile > "%TEMP%\OPS76B8.tmp" 2> "%TEMP%\OPS76B9.tmp""
- '<SYSTEM32>\netsh.exe' advfirewall show allprofiles
- '<SYSTEM32>\chcp.com' 437
- '<SYSTEM32>\cmd.exe' /S /C ""chcp" 437 & "netsh" advfirewall show allprofiles > "%TEMP%\OPS71C4.tmp" 2> "%TEMP%\OPS71C5.tmp""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -file ChangeNLA.ps1
- '%WINDIR%\syswow64\netsh.exe' lan add profile filename=WiredAuthBYOD.xml
- '<SYSTEM32>\cmd.exe' /S /C ""chcp" 437 & "netsh" advfirewall show global > "%TEMP%\OPS79E6.tmp" 2> "%TEMP%\OPS79E7.tmp""
- '%WINDIR%\syswow64\sc.exe' CONFIG dot3svc start= auto
- '%WINDIR%\syswow64\netsh.exe' wlan set profileorder name=RowanSecure interface=* priority=1
- '%WINDIR%\syswow64\netsh.exe' wlan add profile filename=RowanSecure_BYOD.xml
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="RowanSecure" i=*
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="Rowan_Visitor_Wireless" i=*
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="SOMStudent" i=*
- '%WINDIR%\syswow64\netsh.exe' wlan delete profile name="RowanWPA" i=*
- '%WINDIR%\syswow64\sc.exe' START dot3svc
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\Aruba Networks\ClearPassOnGuard\ClearPassUSHARemediatePS.dll" /s
- '<SYSTEM32>\netsh.exe' advfirewall show global
