Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\5503b911-49c0-43d6-9681-d9c293b9d54e-4.job
- %WINDIR%\Tasks\1aac4bdf-cda0-480b-aed5-b2e4130236c0.job
- %WINDIR%\Tasks\5503b911-49c0-43d6-9681-d9c293b9d54e-3.job
- %WINDIR%\Tasks\5503b911-49c0-43d6-9681-d9c293b9d54e-11.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e-11.exe' /kFlyeZDW=fX91OrbgZJZnZDwRBINACB2MHWnsoJeS3+G/GMRMgwPTjyJ6CHEG6+c+69c9QvRV7Rv26ZVYoAui6j2ZnwUkC00Ba7QOQkPvukfRFdt4ZDhNoYpzOMfFcEuyBX+QXNjmCQYIgtu+28ddwvjfUubHgaNweNWw0ESz+55sdElntVma0ZOTV7bgC6XTJMTV/Z+Su6B9Qb3oe8SoIDfl7eRCD53Wm3KbLmG60kJNAPYl9jOQj30Y5HDWY1Lj+188D/cOZOHtB71Uyi01kcy4rrwyzfDyQfV/xdbFSmoRfFJepzRK5nY3V48TzaAHVfQ5EDU0jlIrf89jRGrBKKEvUHEzaEPK/NhwHIipICLyrVbZQMJtW+MdqEpOYBdVaiCiiCWGd/K1J9oBisoHF0VzrjwFVX4vtDBxGRdjy9A7cHuuhfF+sge0PpG1sMDqsEyZMiCx+a7X64hIl+rPKAVvbP/Nz6djkMe433q14ht6MyJSURqaI3V/0iKytAZAorDbvkcwMOvxKEXhMaUBNo7V2PBbdKSxfYG9hXe5qHzqbS30jC8zOwYhRUhczUE5L7fnuHWNEaan3vIz5Rwo+tXgJkDOo7w/49Xj5zkI9YfHLHkuW7RtVNVt1JJf/kNBflrR0FioRjQA08xM4bdVIf1wtedw5RW3Jfuta+7gpJFGZ9AtEVaC0iFesGYYC53WLD7rSD9n7tGICf/mdahfHxRIhf1+5Df+z8eX3LdnpYO74aQqEO821EQLhyBIR6gyMxeNN7Ujq2gqU45/Tpf6SO3YZg0lzOaOXOStnpJaAfA/e6PDWEE+qbLepAfMPAn4MFiT/AlCsnvI5wt20h0XyQTG3HBDErKkzP1WUY6euegWbqIo+mi/PTmJLzIJ8JwXRwtx7QGH5wzpB7/cZ/fEOTctrhCHiS2c8iqJYJkLxAsPAdy+lIJma6UNEaUFkRK4vEnPJ3QWI+YowpwuaVVpAq4karPsDHmkkq2PkkuLPp+f8vu68oRFm5PSWqmuNvU6jB7rwNq4kolAPGLcq0sYteYqZ3fxj4CyyJ1sN0kfGAxBnGnRQdDhBQh6pE7fp8ijYDfHzje6eWG6alKIhoVzzxu+JG6+a2pZQRsoW0PNCY+YMBR/C8UIllODJBtsBgmMl1jp68xcoz4oT8lMlTSMoC+uVsJ1cpYtrnfOkKZrle0zWXRwwtu+oLzRq45F9EvppjS7i4JkCJiba/Riz5rcEZ+WQC6v/tsNWRsLFZTZzNC8mcZApBRsoY6LffcOw9G2YgqF1Y+vkYVY3q0kCwDlbt2X/jdx51GNFL/eT74EPoqXDL3c+jliMPHHUVnNVLi5xfh8bBopmG7bjwPYmQvxxkAgI/6+hYSCKOvUzjCtJ1nltaydJtkrAG+AD7E0Fd682ArT8HBhHFeqdq9eDSgtVnYCO3Y3ZeFa4r31Pb5PG6bwAkJIUInbJXew0Rqw2vOdJ61Bt7/pCELclcsUkkmJ5BuormQcM/Ea/qLbREn+FeaHaqjbUhhTc/nLqMKkFUm5RbyRdZJnLTAUzBeoIj4sJz59fo6fRfcufB0zbeCKAs2+pQEO8dUWCGMsZQrAYYg57Mlc6xKyzKjQ9K+sd8j792sgC9aA7CMmxRKn/fdKoNJvZL3dBk8L9I2LAUccpXRti/4SKC+klEn6LgrY2DMGYray788hGabk1Uj4NZYVlkP1g1ol4Xg=
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regserver
- '%TEMP%\nsh3.tmp\Nkvqzpkznvr.exe'
- '%TEMP%\comh.273883\GoogleUpdate.exe' /silent /install "appguid={e3cf8fb0-2b10-426c-bf71-f20dfffed183}&appname=6df7d776-23b6-481d-98c2-2ed86cae605d&needsadmin=True&lang=en"
- '%PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e-3.exe' /kFlyeZDW=WF4SbXovC9yRlmIZL4ues+se/suvxj9tWRlY/LybE29braR6XtN8e4+2WQwiwaDCmDSgyCE93W9Yn7ifF51yR8DbXoYKw+8yEUs2z5n3FmFEQBl7dE/XfeMuI3wpY4JGPlzYFaS39Q73BTmxIfYiHgI+JFg7kb78Zswpj/Vi6Ewfqu+AIsuMhQHIN4MrQNTy2Is2mHHWXkISZ8Kw5/14ElNvZ/WRDuvDhmsz2Z/NdoShsNCAJphmPQPv/hGZxL596T5CkvseCXFQFxUSv37ftEI+GCY5d0TJnUx2xJuziLQ4fl5AEQB9B4l3BHme/OEQEEzktUYqP387rTf2z7z4P6tj2g6wLxfAzuJwlDDOcFvfUZ6hMQkRmhmeXJV4aR2AtybOZx1nbuEWHJIvZKof6aeAgYUBNDsS7ZfN4gv7YEkstZuZ3tYVhIVn/kLY012Em+B8FlHJe6V6oWC23T46MfusfFJwYxBDFsCOQrS1KwBWs19K6prJrwa7hIH1yOukhgBG0WeY0hlBJ/0L1wFCAaKSQEYflBryOQ2sQtp6+4vLiD9YIDabj+s+qzpk4igACFHzoMSnqJd8G1lU2Rg+9vmBjLJmYivkzzAZ3xY/5TkL9F5f1srW8lFpVC5nOidYf9T5xjF4oEOUJ0R1lgb6u2JOqvyFyGwnxYiMXaxz8ZaaoDKhrVSV4zxh++xw5XAwLgDH6ZCp+J0mCeob+9yThC+8MKwpI2uzCpQxC3Ic83IM0eqK4rY0P6jHcMkMzTd5DsT5kL718WSB26jxOay9SQbFhKly+tbi2LABLPSDy2NZCOKd7Q9CSJd46ImdVkssQfMbcHdN7HTcnaxoppwzjDbNSSEPTplA5hNph0r7s+ausX5TlZ2CbyghAWy6hGIG8vH2MtAhYbU3eYsgGSN3Fe0cSWslfOQipzWe6O8O1mG1G1mwVgwUoGdIN/grbjTuLp6xiQeJsmK4cDceOIaFvA41R0Jem3HOYSOzNZ/ddThMPiMPQy0DHuf3mCFe1H38AbFRaxPaBkuHGgzNoeb3fssTt/oy6bahJfLQNXjnGyrqMEidFlhOW+oHiR2lzwP/KZPqT77824a/707TP95VjlEZhndRwyaJDQfFnB2xzvQcRAXbOobeEwkJq3bxpOtbioGGplU+emCfnS2kX3AzUk2B53+EXTlJvyTtSPJ/wgQLPX+SZFxZG50FDsbxNXTnsKjAG6O7xavk+vBEqY+UzFk7Wk/boF0HG5o7muicc/fio1tEth1iJ3zJ/IGV+7csesT9lcu07isqhw4OZJvHMOAmfigRoLB8huWRmWOLNYMf2cmKQxIO5wyoTyLVbhBdjT/A28K4U1mi5CEJTPlN/g==
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\HD-V1.4\1293297481.mxaddon
- %PROGRAM_FILES%\HD-V1.4\c7a2d841-7973-4c78-ba2b-0e43c60cfe91.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %TEMP%\Cab9.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e-3.exe
- %PROGRAM_FILES%\HD-V1.4\f12e9850-7a42-4292-864b-8fb61ef71d51.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab7.tmp
- %TEMP%\nsx6.tmp\ExecDos.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e.crx
- %PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e_.xpi
- %WINDIR%\Installer\39720.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e-11.exe
- C:\Config.Msi\39723.rbs
- %TEMP%\MSI3a4cc.LOG
- %WINDIR%\Installer\MSID.tmp
- %PROGRAM_FILES%\HD-V1.4\5503b911-49c0-43d6-9681-d9c293b9d54e.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %TEMP%\CabB.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %TEMP%\nsx6.tmp\InstallerUtils2.dll
- %TEMP%\nsx6.tmp\nsisos.dll
- %TEMP%\nsx6.tmp\System.dll
- %TEMP%\nsx6.tmp\InstallerUtils.dll
- %TEMP%\nsx6.tmp\inetc.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsx6.tmp\md5dll.dll
- %TEMP%\nsx6.tmp\UserInfo.dll
- %TEMP%\nsh3.tmp\Ecuzsvqwdrfr.tmp
- %TEMP%\nsh3.tmp\WrapperUtils.dll
- %TEMP%\nsh2.tmp
- %TEMP%\nsh3.tmp\System.dll
- %TEMP%\nsc5.tmp
- %TEMP%\nsx6.tmp\StdUtils.dll
- %TEMP%\nsh3.tmp\Nkvqzpkznvr.exe
- %TEMP%\nsh3.tmp\StdUtils.dll
- %TEMP%\nsx6.tmp\update.json
- %TEMP%\comh.273883\goopdateres_en.dll
- %TEMP%\comh.273883\npGoogleUpdate4.dll
- %TEMP%\comh.273883\GoogleUpdateOnDemand.exe
- %TEMP%\comh.273883\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %TEMP%\comh.273883\psmachine.dll
- %TEMP%\comh.273883\psuser.dll
- %TEMP%\nsx6.tmp\40713
- %PROGRAM_FILES%\HD-V1.4\Uninstall.exe
- %PROGRAM_FILES%\HD-V1.4\utils.exe
- %TEMP%\nsx6.tmp\459846
- %TEMP%\comh.273883\GoogleUpdateBroker.exe
- %TEMP%\comh.273883\GoogleUpdateHelper.msi
- %TEMP%\comh.273883\GoogleCrashHandler.exe
- %TEMP%\comh.273883\GoogleUpdate.exe
Deletes the following files:
- %WINDIR%\Installer\MSID.tmp
- C:\Config.Msi\39723.rbs
- %WINDIR%\Installer\39720.msi
- %TEMP%\CabB.tmp
- %TEMP%\nsx6.tmp\40713
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##fostatsserv.com':80
- 'up####.#nfostatsserv.com':80
- 'er####.#nfostatsserv.com':80
- 'st###.#nfostatsserv.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nfostatsserv.com/installer_updates/001713/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##fostatsserv.com
- DNS ASK up####.#nfostatsserv.com
- DNS ASK er####.#nfostatsserv.com
- DNS ASK st###.#nfostatsserv.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
