Adware.OpenCandy.146

Technical Information

Modifies file system

Creates the following files

%TEMP%\utt637.tmp.new
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\1f91d2d17ea675d4c2c3192e241743f9_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
%APPDATA%\microsoft\windows\cookies\user@localhost[1].txt
%APPDATA%\utorrent\settings.dat.new
%TEMP%\hyd1046.tmp.1754170467\hta\install.1754170467.zip
%TEMP%\hyd104~1.175\hta\index.hta
%TEMP%\hyd104~1.175\hta\uninstall.hta
%TEMP%\hyd104~1.175\hta\3rdparty\occomsdk.dll
%TEMP%\hyd104~1.175\hta\3rdparty\ocsetuphlp.dll
%TEMP%\hyd104~1.175\hta\i18n\en.json
%TEMP%\hyd104~1.175\hta\i18n\ru.json
%TEMP%\hyd104~1.175\hta\images\bt_icon_48px.png
%TEMP%\hyd104~1.175\hta\images\loading.gif
%TEMP%\hyd104~1.175\hta\images\main_bittorrent.ico
%TEMP%\hyd104~1.175\hta\images\main_icon.png
%TEMP%\hyd104~1.175\hta\images\main_utorrent.ico
%TEMP%\hyd104~1.175\hta\images\search_protect.png
%TEMP%\hyd104~1.175\hta\images\yandex_browser_setup.bmp
%TEMP%\hyd104~1.175\hta\images\yandex_horz.png
%TEMP%\hyd104~1.175\hta\images\yandex_horz_ru.png
%TEMP%\hyd104~1.175\hta\images\mediac~1\chrome.png
%TEMP%\hyd104~1.175\hta\images\mediac~1\firefox.png
%TEMP%\hyd104~1.175\hta\images\mediac~1\internetexplorer.png
%TEMP%\hyd104~1.175\hta\images\mediac~1\logo.png
%TEMP%\hyd104~1.175\hta\images\mediac~1\screenshot.png
%TEMP%\hyd104~1.175\hta\scripts\common.js
%TEMP%\hyd104~1.175\hta\scripts\es5-shim.js
%TEMP%\hyd104~1.175\hta\scripts\initialize.js
%TEMP%\hyd104~1.175\hta\scripts\install.js
%TEMP%\hyd104~1.175\hta\scripts\uninstall.js
%TEMP%\hyd104~1.175\hta\shell_~1\shell_install_offer.js
%TEMP%\hyd104~1.175\hta\shell_~1\shell_ping_after_close.js
%TEMP%\hyd104~1.175\hta\styles\common.css
%TEMP%\hyd104~1.175\hta\styles\installer.css
%TEMP%\hyd1046.tmp.1754170467\index.hta.log

Deletes the following files

%TEMP%\utt637.tmp

Moves the following files

from %TEMP%\utt637.tmp.new to %TEMP%\utt637.tmp
from %APPDATA%\utorrent\settings.dat.new to %APPDATA%\utorrent\settings.dat

Network activity

Connects to

'be###.utorrent.com':80
'ip##pi.com':80
'up####.#taging.utorrent.com':80

TCP

HTTP GET requests

http://ip##pi.com/json?ca################################################################

UDP

DNS ASK ro####.bittorrent.com
DNS ASK ro####.utorrent.com
DNS ASK be###.utorrent.com
DNS ASK ip##pi.com
DNS ASK up####.#taging.utorrent.com
DNS ASK ap#.##encandy.com
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: 'HTML Application Host Window Class' WindowName: ''
ClassName: '5EAD05870D954FCA8F681D8119CBC447' WindowName: ''
ClassName: '995D92B2-4ED9-43A7-9338-8CC7D1746F96' WindowName: ''

Executes the following

'%WINDIR%\syswow64\mshta.exe' "%TEMP%\HYD1046.tmp.1754170467\HTA\index.hta?utorrent" "<Full path to file>" /LOG "%TEMP%\HYD1046.tmp.1754170467\index.hta.log" /PID "2840" /CID "hImjTo-EPalPRIe0" /VERSION "109352810" /OS "6....
'%WINDIR%\syswow64\ping.exe' 8.#.8.8 -n 1 -w 500
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\HYD1046.tmp.1754170467\HTA\3rdparty\OCSetupHlp.dll",_RHPID71RHEng2@16 872,5EAD05870D954FCA8F681D8119CBC447,E2BC01229AC24394B7D16859DF7D9746,86143C44742F49329A45F1F485FAA02B
'%WINDIR%\syswow64\cscript.exe' shell_scripts/shell_ping_after_close.js "http://bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjI4NDAiLCJoIjoiaEltalRvLUVQYWxQUkllMCIsInYiOiIxMDkzN...
'%WINDIR%\syswow64\ping.exe' 8.#.8.8 -n 1 -w 500' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\HYD1046.tmp.1754170467\HTA\3rdparty\OCSetupHlp.dll",_RHPID71RHEng2@16 872,5EAD05870D954FCA8F681D8119CBC447,E2BC01229AC24394B7D16859DF7D9746,86143C44742F49329A45F1F485FAA02B' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' shell_scripts/shell_ping_after_close.js "http://bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjI4NDAiLCJoIjoiaEltalRvLUVQYWxQUkllMCIsInYiOiIxMDkzN...' (with hidden window)