Trojan.Inject4.63760

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoUpdateS.exe' = '%APPDATA%\AutoUpdateS.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\autoupdates

Malicious functions

Injects code into

the following user processes:

msinfo32.exe

Modifies file system

Creates the following files

%APPDATA%\autoupdates.exe
%TEMP%\enqvzoegxsigqzp.data
%TEMP%\oewsqjrjalapacw.data

Deletes the following files

%TEMP%\enqvzoegxsigqzp.data
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
%TEMP%\oewsqjrjalapacw.data
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
<SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows defender\mpidletask
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\opera scheduled autoupdate 1694565166
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask

Network activity

Connects to

'5.###.75.226':6257

TCP

Other

'5.###.75.226':6257

Miscellaneous

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "" "SCHTASKS.exe /Create /SC ONSTART /TN AutoUpdateS /TR %APPDATA%\AutoUpdateS.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "" "schtasks /delete /tn * /f"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "" "SCHTASKS.exe /Create /SC ONSTART /TN AutoUpdateS /TR %APPDATA%\AutoUpdateS.exe"' (with hidden window)

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "" "schtasks /delete /tn * /f"
'<SYSTEM32>\schtasks.exe' /delete /tn * /f
'<SYSTEM32>\schtasks.exe' /Create /SC ONSTART /TN AutoUpdateS /TR %APPDATA%\AutoUpdateS.exe
'%CommonProgramFiles%\microsoft shared\msinfo\msinfo32.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial