Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updaterv4.1.4.4PVNQP' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\google<File name>
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Network activity
TCP
HTTP GET requests
- http://la#######.###website-us-east-1.amazonaws.com/update6.txt?FV###
- http://my####.#####bsite-us-east-1.amazonaws.com/UpdateDriverV47.exe
- http://wh##.amung.us/pingjs/?k=#########
UDP
- DNS ASK la#######.###website-us-east-1.amazonaws.com
- DNS ASK my####.#####bsite-us-east-1.amazonaws.com
- DNS ASK s3.###zonaws.com
- DNS ASK wh##.amung.us
Miscellaneous
Creates and executes the following
- '<Full path to file>' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /create /f /tn "Google<File name>" /ru user /sc minute /mo 1 /tr "\"<Full path to file>"\" /st 00:00:00
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV44
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV44
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV43
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV43
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV42
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV42
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV41
- '%WINDIR%\syswow64\cmd.exe' /k REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v updaterv4.1.4.4PVNQP /t REG_SZ /d "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV41
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV40
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV39
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV39
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV38
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV38
- '<SYSTEM32>\taskeng.exe' {4FC0057E-FC69-4A35-8AFC-8ABDCF8EB31E} S-1-5-21-1960123792-2022915161-3775307078-1001:htxcnobhi\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "Google<File name>" /ru user /sc minute /mo 1 /tr "\"<Full path to file>"\" /st 00:00:00
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV40
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v updaterv4.1.4.4PVNQP /t REG_SZ /d "<Full path to file>"
