Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '97d5603eab72902f670a9e0429a5327f' = '"%APPDATA%\GoogleCrashHandlers.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '97d5603eab72902f670a9e0429a5327f' = '"%APPDATA%\GoogleCrashHandlers.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\97d5603eab72902f670a9e0429a5327f.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\GoogleCrashHandlers.exe" "GoogleCrashHandlers.exe" ENABLE
Injects code into
the following user processes:
- googlecrashhandlers.exe
Modifies file system
Creates the following files
- %TEMP%\ccleaner 5.63.7540 for windows.exe
- %TEMP%\nsk4450.tmp\ui\res\lang-1059.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1058.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1057.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1055.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1054.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1053.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1052.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1051.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1050.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1049.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1048.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1030.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1046.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1044.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1043.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1042.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1041.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1040.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1038.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1037.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1036.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1035.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1034.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1032.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1045.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1031.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1060.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1092.dll
- %TEMP%\nsk4450.tmp\nsdialogs.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-9999.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-5146.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-3098.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-2074.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-2070.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-2052.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1155.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1110.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1109.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1104.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1062.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1061.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1090.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1087.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1086.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1081.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1071.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1079.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1068.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1067.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1066.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1065.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1063.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1102.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1029.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1028.dll
- %TEMP%\nsk4450.tmp\ui\res\lang-1027.dll
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1042.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1041.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1040.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1038.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1037.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1036.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1035.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1034.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1033.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1032.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1044.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1031.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1029.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1028.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1027.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1026.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1025.html
- %TEMP%\nsk4450.tmp\g\gcapi_dll.dll
- %TEMP%\nsk4450.tmp\p\pfbl.dll
- %TEMP%\nsk4450.tmp\userinfo.dll
- %TEMP%\nsk4450.tmp\system.dll
- %TEMP%\nsp4420.tmp
- %TEMP%\testing.exe
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1030.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1045.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1043.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1046.html
- %TEMP%\nsk4450.tmp\ui\res\lang-1026.dll
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1102.html
- %TEMP%\nsk4450.tmp\ui\res\lang-1025.dll
- %TEMP%\nsk4450.tmp\ui\res\montserrat-regular.otf
- %TEMP%\nsk4450.tmp\ui\res\pf_computer.png
- %TEMP%\nsk4450.tmp\ui\res\cc_logo_72x66.png
- %TEMP%\nsk4450.tmp\ui\res\pf_logo.png
- %TEMP%\nsk4450.tmp\ui\pfui.dll
- %TEMP%\nsk4450.tmp\g\pfwww.dll
- %TEMP%\nsk4450.tmp\g\gcombo\combo-offer.png
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_3098.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_2070.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_2052.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1066.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1048.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1062.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1061.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1060.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1058.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1057.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1055.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1054.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1053.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1051.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1050.html
- %TEMP%\nsk4450.tmp\g\gcombo\combooffer_1049.html
- %APPDATA%\googlecrashhandlers.exe
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020053020200531\index.dat
Network activity
TCP
- 'an#####cs.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK 7c####2020.ddns.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\ccleaner 5.63.7540 for windows.exe'
- '%TEMP%\testing.exe'
- '%APPDATA%\googlecrashhandlers.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\GoogleCrashHandlers.exe" "GoogleCrashHandlers.exe" ENABLE' (with hidden window)
