Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{7474cd6e-76cc-4257-837e-5b9261e526af}' = '"%ALLUSERSPROFILE%\Package Cache\{7474cd6e-76cc-4257-837e-5b9261e526af}\VC_red...
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %TEMP%\b164.tmp\b174.tmp\b175.bat
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\logo.png
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1028\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1029\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1031\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1036\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1040\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1041\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1042\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1045\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1046\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1049\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1055\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\2052\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\3082\thm.wxl
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_amd64_20220806111206.log
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.be\vc_redist.x64.exe
- %ALLUSERSPROFILE%\package cache\{7474cd6e-76cc-4257-837e-5b9261e526af}\vc_redist.x64.exe
- %ALLUSERSPROFILE%\package cache\{7474cd6e-76cc-4257-837e-5b9261e526af}\state.rsm
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\windows7_msu_x64
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\vcruntimeminimum_x64
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\vcruntimeadditional_x64
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\cab5046a8ab272bf37297bb7928664c9503
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\cab2c04ddc374bd96eb5c8eb8208f2c7c92
- C:\8948891e074cacce77a6\$dpx$.tmp\175a6ff19050704d8810f44495fd7bf1.tmp
- C:\8948891e074cacce77a6\$dpx$.tmp\90e6db9092e7a44bb78d1efc9279406c.tmp
- C:\8948891e074cacce77a6\$dpx$.tmp\10b6ede903fc2a48b8125a59f8299841.tmp
- C:\8948891e074cacce77a6\$dpx$.tmp\b9748cbad953cb4e97ff4746b149517f.tmp
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\855be4df-7d72-4448-bcda-0de050c9067f\source.cab
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\thm.xml
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\2052\license.rtf
- %TEMP%\b164.tmp\7z.dll
- %TEMP%\b164.tmp\7z.exe
- %TEMP%\b164.tmp\setup.zip
- %TEMP%\adobesetup\dotnetzip.dll
- %TEMP%\adobesetup\googleinstaller.exe
- %TEMP%\adobesetup\googleinstaller.exe.config
- %WINDIR%\content.zip
- %WINDIR%\dotnetzip-qdvk40v2.tmp
- %WINDIR%\dotnetzip-x2vfezws.tmp
- %WINDIR%\dotnetzip-mzj4pijp.tmp
- %WINDIR%\dotnetzip-jtl0q5my.tmp
- %WINDIR%\dotnetzip-ftm1kz1o.tmp
- %WINDIR%\dotnetzip-5r1ahm5t.tmp
- %WINDIR%\dotnetzip-hi1y5kcz.tmp
- %WINDIR%\dotnetzip-yxsqsujf.tmp
- %WINDIR%\dotnetzip-4yao1xoc.tmp
- %WINDIR%\dotnetzip-4iwmqaea.tmp
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\wixstdba.dll
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1028\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1029\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1031\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1036\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1040\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1041\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1042\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1045\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1046\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1049\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\1055\license.rtf
- %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\.ba1\3082\license.rtf
- %WINDIR%\softwaredistribution\scanfile\855be4df-7d72-4448-bcda-0de050c9067f\package.cab
Sets the 'hidden' attribute to the following files
- %WINDIR%\searchindexer.exe
- %WINDIR%\libcurl.dll
- %WINDIR%\libeay32.dll
- %WINDIR%\ssleay32.dll
- %WINDIR%\zlib1.dll
- %WINDIR%\googleupdate.exe
- %WINDIR%\googleupdate.exe.config
Deletes the following files
- %WINDIR%\content.zip
- %WINDIR%\perms.txt
- %WINDIR%\wd.reg
- %WINDIR%\softwaredistribution\scanfile\855be4df-7d72-4448-bcda-0de050c9067f\source.cab
Moves the following files
- from %WINDIR%\dotnetzip-qdvk40v2.tmp to %WINDIR%\googleupdate.exe
- from C:\8948891e074cacce77a6\$dpx$.tmp\90e6db9092e7a44bb78d1efc9279406c.tmp to C:\8948891e074cacce77a6\windows6.1-kb2999226-x64.cab
- from C:\8948891e074cacce77a6\$dpx$.tmp\175a6ff19050704d8810f44495fd7bf1.tmp to C:\8948891e074cacce77a6\wsusscan.cab
- from %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\{c5ecdb9a-d9b0-3107-ba85-1269998a5b3e}v14.13.26020\packages\vcruntimeadditional_amd64\cab1.cab
- from %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\{c5ecdb9a-d9b0-3107-ba85-1269998a5b3e}v14.13.26020\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi
- from %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64
- from %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\{221d6db4-46e2-333c-b09b-5f49351d0980}v14.13.26020\packages\vcruntimeminimum_amd64\cab1.cab
- from %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\{221d6db4-46e2-333c-b09b-5f49351d0980}v14.13.26020\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi
- from %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64
- from %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- from %TEMP%\{7474cd6e-76cc-4257-837e-5b9261e526af}\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64
- from %WINDIR%\dotnetzip-4iwmqaea.tmp to %WINDIR%\zlib1.dll
- from %WINDIR%\dotnetzip-4yao1xoc.tmp to %WINDIR%\wd.reg
- from %WINDIR%\dotnetzip-yxsqsujf.tmp to %WINDIR%\vc_redist.x64.exe
- from %WINDIR%\dotnetzip-hi1y5kcz.tmp to %WINDIR%\ssleay32.dll
- from %WINDIR%\dotnetzip-5r1ahm5t.tmp to %WINDIR%\searchindexer.exe
- from %WINDIR%\dotnetzip-ftm1kz1o.tmp to %WINDIR%\perms.txt
- from %WINDIR%\dotnetzip-jtl0q5my.tmp to %WINDIR%\libeay32.dll
- from %WINDIR%\dotnetzip-mzj4pijp.tmp to %WINDIR%\libcurl.dll
- from %WINDIR%\dotnetzip-x2vfezws.tmp to %WINDIR%\googleupdate.exe.config
- from C:\8948891e074cacce77a6\$dpx$.tmp\10b6ede903fc2a48b8125a59f8299841.tmp to C:\8948891e074cacce77a6\windows6.1-kb2999226-x64-pkgproperties.txt
- from C:\8948891e074cacce77a6\$dpx$.tmp\b9748cbad953cb4e97ff4746b149517f.tmp to C:\8948891e074cacce77a6\windows6.1-kb2999226-x64.xml
Network activity
Connects to
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\b164.tmp\7z.exe' x -paR4BaUWkH29QgAtn -y -o"%TEMP%\AdobeSetup" setup.zip
- '%TEMP%\adobesetup\googleinstaller.exe'
- '%WINDIR%\vc_redist.x64.exe' /install /quiet /norestart
- '%WINDIR%\vc_redist.x64.exe' /install /quiet /norestart -burn.unelevated BurnPipe.{F6565B84-72AA-4C86-9B06-AA1C2276FADB} {0725799A-C093-44F7-B1A3-BD96DB469A66} 608
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B164.tmp\B174.tmp\B175.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B164.tmp\B174.tmp\B175.bat <Full path to file>"
- '<SYSTEM32>\icacls.exe' %WINDIR% /restore %WINDIR%\perms.txt
- '<SYSTEM32>\icacls.exe' %WINDIR%\GoogleUpdate.exe.config /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\GoogleUpdate.exe.config
- '<SYSTEM32>\icacls.exe' %WINDIR%\GoogleUpdate.exe /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\GoogleUpdate.exe
- '<SYSTEM32>\icacls.exe' %WINDIR%\zlib1.dll /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\zlib1.dll
- '<SYSTEM32>\icacls.exe' %WINDIR%\ssleay32.dll /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\ssleay32.dll
- '<SYSTEM32>\icacls.exe' %WINDIR%\libeay32.dll /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\libeay32.dll
- '<SYSTEM32>\icacls.exe' %WINDIR%\libcurl.dll /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\libcurl.dll
- '<SYSTEM32>\icacls.exe' %WINDIR%\SearchIndexer.exe /setowner "NT Service\TrustedInstaller"
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\SearchIndexer.exe
- '<SYSTEM32>\sc.exe' delete GoogleUpdate
- '<SYSTEM32>\sc.exe' stop GoogleUpdate
- '%WINDIR%\regedit.exe' /s "%WINDIR%\wd.reg"
- '<SYSTEM32>\wusa.exe' "%ALLUSERSPROFILE%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
