Adware.Wajam.1199

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\62c4adc256c91b91974afdce7fae6145] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\62c4adc256c91b91974afdce7fae6145] 'ImagePath' = 'rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main'
[<HKLM>\System\CurrentControlSet\Services\6c23af60d634372a613371f583c960f8] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\6c23af60d634372a613371f583c960f8] 'ImagePath' = 'rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main'
[<HKLM>\System\CurrentControlSet\Services\385534695ba4401292896a6425cd9014] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\385534695ba4401292896a6425cd9014] 'ImagePath' = 'rundll32.exe "%WINDIR%\vebgir.dll" ZMgTPDhXDb'

Creates the following services

'62c4adc256c91b91974afdce7fae6145' rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main
'6c23af60d634372a613371f583c960f8' rundll32.exe "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main
'385534695ba4401292896a6425cd9014' rundll32.exe "%WINDIR%\vebgir.dll" ZMgTPDhXDb

Malicious functions

Executes the following

Installs hooks to intercept notifications

on window messages:

Handler for all processes: %ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll
Handler for all processes: %ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll

Terminates or attempts to terminate

the following system processes:

Modifies file system

Creates the following files

%TEMP%\nsmba2b.tmp\ushgyyvxsl.map
%ProgramFiles(x86)%\chrome extension manager\uninstall.tar
%ProgramFiles(x86)%\chrome extension manager\infile.cab
%ProgramFiles(x86)%\chrome extension manager\chrome_manager.dll
%WINDIR%\vebgir.dll
%ProgramFiles(x86)%\chrome extension manager\infile_x64.cab
%ProgramFiles(x86)%\chrome extension manager\chrome_manager_x64.dll
%TEMP%\nsrbda6.tmp\execdos.dll
<SYSTEM32>\grouppolicy\adm\chrome.adm
<SYSTEM32>\grouppolicy\machine\template.pol
%WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\fd81251d653f60adf1e8706c2a6a890f
%WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\1268cbc3fb3f239903d30433e47d25ce
%WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\43cffaa17edf9459c35bdbab8e2f1447
%WINDIR%\installer\{f2c67197-10d8-2cfc-7579-409aff4bd947}\d5c11b966ce62d89fa0df42a2ec98d76
%TEMP%\nsrbda6.tmp\nsexec.dll
%TEMP%\nsrbda6.tmp\simplesc.dll
%TEMP%\nsrbda6.tmp\inetc.dll
%TEMP%\nsrbda6.tmp\ipconfig.dll
%TEMP%\nsrbda6.tmp\md5dll.dll
%TEMP%\nsrbda6.tmp\moreinfo.dll
%TEMP%\nsrbda6.tmp\system.dll
%TEMP%\nsmba2b.tmp\bfgboxzpok.dll
%ProgramFiles(x86)%\chrome extension manager\msg.inf
%ProgramFiles(x86)%\chrome extension manager\msg.exe

Deletes the following files

Substitutes the following files

Network activity

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d kocbepmfamjimgdjfobnecfcdmlooncl;file:///C:/Windows/Installer/{f2c67197-10d8-2cfc-7579-409aff4...' (with hidden window)
'%WINDIR%\syswow64\gpupdate.exe' /force' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main --install-run' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /IM firefox.exe /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d kocbepmfamjimgdjfobnecfcdmlooncl;file:///C:/Windows/Installer/{f2c67197-10d8-2cfc-7579-409aff4...
'%WINDIR%\syswow64\gpupdate.exe' /force
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run
'<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main --install-no-updater-run
'<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main --install-run
'<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main
'<SYSTEM32>\rundll32.exe' "%WINDIR%\vebgir.dll" ZMgTPDhXDb
'<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager_x64.dll" main a4Nft0A2a Wb5UwVFib
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Chrome Extension Manager\chrome_manager.dll" main Q0QXqyD3D YELXthBzC
'<SYSTEM32>\raserver.exe' /offerraupdate