Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Pragma6' = '%PROGRAM_FILES%\Trident Software\Pragma6\pkernel.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Pragma6Serv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\wodAppUpdateService2] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Trident Software\Pragma6\ptool.exe'
- '%PROGRAM_FILES%\Trident Software\Pragma6\pservice.exe' -i
- '%PROGRAM_FILES%\Trident Software\Pragma6\wodUpdS2.exe'
- '%PROGRAM_FILES%\Trident Software\Pragma6\pkernel.exe'
- '%PROGRAM_FILES%\Trident Software\Pragma6\pservice.exe'
- '%TEMP%\RarSFX0\SetACL32.exe' -on "hklm\SOFTWARE\Trident Software\Pragma\Options" -ot reg -actn ace -ace "n:System;p:set_val;m:deny"
- '%TEMP%\RarSFX0\pragma6.exe'
- '%TEMP%\RarSFX0\dict.exe'
- '%TEMP%\RarSFX0\setup.exe'
- '%PROGRAM_FILES%\Trident Software\Pragma6\wodUpdS2.exe' -i
- '%TEMP%\RarSFX0\pragma6fix.exe'
- '%TEMP%\RarSFX0\hidcon.exe' pragma6fix.exe
Executes the following:
- '<SYSTEM32>\net1.exe' stop WeOnlyDo wodAppUpdate Service 2
- '%WINDIR%\regedit.exe' /S 2.reg
- '<SYSTEM32>\net1.exe' start Pragma6Serv
- '<SYSTEM32>\net.exe' stop Pragma6Serv
- '<SYSTEM32>\net1.exe' stop Pragma6Serv
- '<SYSTEM32>\net.exe' stop WeOnlyDo wodAppUpdate Service 2
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Trident Software\Pragma6\pmoz35mgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\poomgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pmoz20mgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pmoz30mgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\poptions.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\prtfmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pservice.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\pregister.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\presource.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pmore.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pclip.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\Pcore6.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pbuy.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\pcheck.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\pdocmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pkernel.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\ploader.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\phtmmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\pindic.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\ptbar6.dll
- %TEMP%\RarSFX0\2.reg
- %TEMP%\RarSFX0\3.reg
- %WINDIR%\Pragma 6 Uninstaller.exe
- %TEMP%\RarSFX0\SetACL64.exe
- %TEMP%\RarSFX0\SetACL32.exe
- %APPDATA%\Trident Software\pragma\urus.prw
- %APPDATA%\Trident Software\pragma\uukr.prw
- %TEMP%\bt0417.bat
- %APPDATA%\Trident Software\pragma\ueng.prw
- %ALLUSERSPROFILE%\Start Menu\Programs\Pragma\Update.lnk
- %PROGRAM_FILES%\Trident Software\Pragma6\uninstall.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\wodAppUp.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\ptool.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\ptxtmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma6\wodUpdS2.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Pragma\Pragma 6 Uninstaller.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Pragma\Start Pragma.lnk
- %PROGRAM_FILES%\Trident Software\Pragma6\help\pragmae.chm
- %PROGRAM_FILES%\Trident Software\Pragma6\help\pragmar.chm
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\gwukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\meng.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\gweng.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\gwrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\mrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\prus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\pukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\mukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\peng.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\c.pr
- %TEMP%\RarSFX0\pragma6.exe
- %TEMP%\RarSFX0\pragma6fix.exe
- %TEMP%\RarSFX0\dict.exe
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\RarSFX0\setup.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\brus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\bukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\windows.kod
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\beng.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\seng.pr
- %TEMP%\aiw147109.bmp
- %TEMP%\aiw147140.bmp
- %TEMP%\aiw147062.bmp
- %TEMP%\aiw147078.bmp
- %TEMP%\aiw147156.DLL
- %PROGRAM_FILES%\Trident Software\Pragma6\p6upcheck.exe
- %PROGRAM_FILES%\Trident Software\Pragma6\p6update.exe
- %TEMP%\aiw147250.EXE
- %PROGRAM_FILES%\Trident Software\Pragma6\corrector.exe
- %TEMP%\aiw147031.bmp
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\tengrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\truseng.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\srus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\sukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\trusukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\vrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\vukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\tukrrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\veng.pr
Sets the 'hidden' attribute to the following files:
- %TEMP%\bt0417.bat
Deletes the following files:
- %TEMP%\RarSFX0\3.reg
- %TEMP%\RarSFX0\SetACL32.exe
- %TEMP%\RarSFX0\SetACL64.exe
- %TEMP%\RarSFX0\2.reg
- %TEMP%\RarSFX0\dict.exe
- %TEMP%\RarSFX0\pragma6fix.exe
- %TEMP%\RarSFX0\setup.exe
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\RarSFX0\pragma6.exe
- %TEMP%\bt0417.bat
- %TEMP%\aiw147250.EXE
- %TEMP%\aiw147031.bmp
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\c.pr.old0
- %PROGRAM_FILES%\Trident Software\Pragma6\Diction\windows.kod.old0
- %TEMP%\aiw147062.bmp
- %TEMP%\aiw147140.bmp
- %TEMP%\aiw147156.DLL
- %TEMP%\aiw147078.bmp
- %TEMP%\aiw147109.bmp
Moves the following files:
- from %PROGRAM_FILES%\Trident Software\Pragma6\Diction\windows.kod to %PROGRAM_FILES%\Trident Software\Pragma6\Diction\windows.kod.old0
- from %PROGRAM_FILES%\Trident Software\Pragma6\Diction\c.pr to %PROGRAM_FILES%\Trident Software\Pragma6\Diction\c.pr.old0
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'PragmaClass' WindowName: '(null)'
- ClassName: '#32770' WindowName: 'Progress'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MozillaWindowClass' WindowName: '(null)'
- ClassName: 'MozillaUIWindowClass' WindowName: '(null)'
