Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Control Panel\Cpls] 'Pando' = '%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.cpl'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Pando Media Booster' = '%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM PMB.exe /T
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram program="%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe" name="Pando Media Booster" mode=ENABLE profile=all
- '%WINDIR%\syswow64\netsh.exe' firewall add portopening protocol=ALL port=56726 name="Pando Media Booster" profile=all
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Pando Media Booster" dir=in action=allow program="%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe" enable=yes profile=ANY protocol=ANY edge=yes
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe.log
- %LOCALAPPDATA%\pmb files\cert\cert8.db
- %LOCALAPPDATA%\pmb files\cert\secmod.db
- %ALLUSERSPROFILE%\pmb files\pando.ini
- %ProgramFiles(x86)%\pando networks\media booster\media booster faqs.url
- %ProgramFiles(x86)%\pando networks\media booster\pmb.exe.config
- %ProgramFiles(x86)%\pando networks\media booster\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- %ProgramFiles(x86)%\pando networks\media booster\ssl3.dll
- %ProgramFiles(x86)%\pando networks\media booster\softokn3.dll
- %ProgramFiles(x86)%\pando networks\media booster\nppandowebplugin.dll.2.config
- %ProgramFiles(x86)%\pando networks\media booster\nppandowebplugin.dll
- %ProgramFiles(x86)%\pando networks\media booster\smime3.dll
- %ProgramFiles(x86)%\pando networks\media booster\nssckbi.dll
- %ProgramFiles(x86)%\pando networks\media booster\pmb.exe
- %ProgramFiles(x86)%\pando networks\media booster\pmb.cpl
- %ProgramFiles(x86)%\pando networks\media booster\microsoft.vc90.crt\msvcr90.dll
- %ProgramFiles(x86)%\pando networks\media booster\microsoft.vc90.crt\msvcp90.dll
- %ProgramFiles(x86)%\pando networks\media booster\nss3.dll
- %ProgramFiles(x86)%\pando networks\media booster\plds4.dll
- %ProgramFiles(x86)%\pando networks\media booster\plc4.dll
- %ProgramFiles(x86)%\pando networks\media booster\nspr4.dll
- %ProgramFiles(x86)%\pando networks\media booster\uninst.exe
- %ProgramFiles(x86)%\pando networks\media booster\bugsplatrc.dll
- %ProgramFiles(x86)%\pando networks\media booster\freebl3.dll
- %ProgramFiles(x86)%\pando networks\media booster\bssndrpt.exe
- %ProgramFiles(x86)%\pando networks\media booster\bugsplat.dll
- %HOMEPATH%\.swt\lib\win32\x86\swt-win32-3740.dll
- %TEMP%\swt-win32-3740.dll
- %LOCALAPPDATA%\pmb files\cert\key3.db
- %LOCALAPPDATA%\pmb files\pando.log
Network activity
Connects to
- 'localhost':60524
- 'localhost':49187
- 'localhost':49189
- 'localhost':49191
- 'localhost':49193
- 'localhost':49195
- 'localhost':49197
- 'localhost':49199
TCP
Other
- 'localhost':49188
- 'localhost':49194
- 'localhost':49196
- 'localhost':49200
UDP
- DNS ASK co#######ces.pandonetworks.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\pando networks\media booster\pmb.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C set
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin /V Description /T REG_SZ /F /D "This plugin detects and launches Pando Media Booster"
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin /V Vendor /T REG_SZ /F /D "Pando Networks Inc."
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin /V Version /T REG_SZ /F /D
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Pando Networks\Media Booster\npPandoWebPlugin.dll"
- '%WINDIR%\syswow64\cmd.exe' /c "netsh firewall add allowedprogram program="%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe" name="Pando Media Booster" mode=ENABLE profile=all"
- '%WINDIR%\syswow64\cmd.exe' /c "netsh firewall add portopening protocol=ALL port=56726 name="Pando Media Booster" profile=all"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low RightsElevationPolicy\{3644F00E-747A-44aa-8DC3-139CCBEF5BFB}" /V AppName /T REG_SZ /F /D PMB.exe
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin /V Path /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster\npPandoWebPlugin.dll"
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin /V ProductName /T REG_SZ /F /D "Pando Web Plugin"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low RightsElevationPolicy\{3644F00E-747A-44aa-8DC3-139CCBEF5BFB}" /V AppPath /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster"
- '%WINDIR%\syswow64\cmd.exe' /c " cacls "%ALLUSERSPROFILE%\PMB Files\pando.ini" /C /P Everyone:F /e""
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\PMB Files\pando.ini" /C /P Everyone:F /e"
- '%WINDIR%\syswow64\cmd.exe' /c "netsh advfirewall firewall add rule name="Pando Media Booster" dir=in action=allow program="%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe" enable=yes profile=ANY protocol=ANY edg...
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V "Pando Media Booster" /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\Pando Networks\PandoShared\npPandoWebInst.dll"
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Mozilla\Mozilla Firefox" /v CurrentVersion
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Mozilla\Mozilla Firefox\\Main" /v "Install Directory"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low RightsElevationPolicy\{3644F00E-747A-44aa-8DC3-139CCBEF5BFB}" /V Policy /T REG_DWORD /F /D 3
- '%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common AppData"
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{31261F21-2B16-45EE-BEAB-07C4CFA18B65} /F
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V EstimatedSize /T REG_DWORD /F /D 5600
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V NoRepair /T REG_DWORD /F /D 1
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Pando Networks\PMB" /v "Version Number"
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /va /F
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Microsoft\Installer\Products\F281A0892A0E04A4491CEAC0215309E2 /va /F
- '%WINDIR%\syswow64\reg.exe' DELETE HKCU\Software\Microsoft\Installer\UpgradeCodes\868F06E7785EC6543949591BEAFF543B /va /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls" /V Pando /T REG_EXPAND_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.cpl"
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Pando Networks\PMB" /V "Program Directory" /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster"
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Pando Networks\PMB" /V "Version Number" /T REG_SZ /F /D
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Pando Networks\PMB" /V "Program Directory" /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster"
- '%WINDIR%\syswow64\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Pando Networks\PMB" /V "Version Number" /T REG_SZ /F /D
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V DisplayVersion /T REG_SZ /F /D
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V InstallLocation /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster"
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V UninstallString /T REG_EXPAND_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster\u...
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V URLInfoAbout /T REG_SZ /F /D http://www.pandonetworks.com/pando-media-booster-support-faq
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V WindowsInstaller /T REG_DWORD /F /D 0
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V Publisher /T REG_SZ /F /D "Pando Networks Inc."
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V DisplayIcon /T REG_SZ /F /D "%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.exe"
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V NoModify /T REG_DWORD /F /D 1
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{980A182F-E0A2-4A40-94C1-AE0C1235902E} /V DisplayName /T REG_SZ /F /D "Pando Media Booster"
- '%WINDIR%\syswow64\cmd.exe' /c "del /F /Q "%ProgramFiles(x86)%\Pando Networks\PandoShared\npPandoWebInst.*" "\Plugins\npPandoWebInst.*""
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2" /V "%ProgramFiles(x86)%\Pando Networks\Media Booster\PMB.cpl" /T ...
