Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\TeamsCloudDataUpdaterServiceEx] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\TeamsCloudDataUpdaterServiceEx] 'ImagePath' = '%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe'
Creates the following services
- 'TeamsCloudDataUpdaterServiceEx' %ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\winver.exe
- <SYSTEM32>\computerdefaults.exe
Modifies file system
Creates the following files
- %HOMEPATH%\music\adwaremusic\index.html
- %HOMEPATH%\music\adwaremusic\info.db
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\content\2620-2616-regsvr32.exe-20-24-21-263.dump
- %ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\info.properties
- %ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\index.html
- %ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\nssm.exe
- %ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\info.db
- %LOCALAPPDATA%\microsoft\teams\previou\teams.zip
- %LOCALAPPDATA%\microsoft\teams\previou\chrome_100_percent.pak
- %LOCALAPPDATA%\microsoft\teams\previou\chrome_200_percent.pak
- %LOCALAPPDATA%\microsoft\teams\previou\ffmpeg.dll
- %LOCALAPPDATA%\microsoft\teams\previou\icudtl.dat
- %LOCALAPPDATA%\microsoft\teams\previou\libegl.dll
- %LOCALAPPDATA%\microsoft\teams\previou\libglesv2.dll
- %LOCALAPPDATA%\microsoft\teams\previou\license
- %LOCALAPPDATA%\microsoft\teams\previou\locales\en-us.pak
- %LOCALAPPDATA%\microsoft\teams\previou\manifest.json
- %LOCALAPPDATA%\microsoft\teams\previou\msvcp140.dll
- %LOCALAPPDATA%\microsoft\teams\previou\resources\app.asar
- %LOCALAPPDATA%\microsoft\teams\previou\resources\main.asar
- %LOCALAPPDATA%\microsoft\teams\previou\resources\upgrade.exe
- %LOCALAPPDATA%\microsoft\teams\previou\resources.pak
- %LOCALAPPDATA%\microsoft\teams\previou\snapshot_blob.bin
- %LOCALAPPDATA%\microsoft\teams\previou\swiftshader\libegl.dll
- %LOCALAPPDATA%\microsoft\teams\previou\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\microsoft\teams\previou\teams.exe
- %LOCALAPPDATA%\microsoft\teams\previou\thirdpartynotice.txt
- %LOCALAPPDATA%\microsoft\teams\previou\v8_context_snapshot.bin
- %LOCALAPPDATA%\microsoft\teams\previou\vccorlib140.dll
- %LOCALAPPDATA%\microsoft\teams\previou\vcomp140.dll
- %LOCALAPPDATA%\microsoft\teams\previou\vcruntime140_1.dll
- %LOCALAPPDATA%\microsoft\teams\previou\vulkan-1.dll
- %APPDATA%\app\partitions\main\local storage\leveldb\manifest-000001
- %APPDATA%\app\partitions\main\local storage\leveldb\000001.dbtmp
- %APPDATA%\app\partitions\main\code cache\js\index
- %APPDATA%\app\partitions\main\code cache\wasm\index
- %APPDATA%\app\partitions\main\local storage\leveldb\log
- %APPDATA%\app\partitions\main\code cache\js\index-dir\temp-index
- %APPDATA%\app\partitions\main\code cache\wasm\index-dir\temp-index
- %APPDATA%\app\partitions\main\cache\index
- %APPDATA%\app\partitions\main\cache\data_0
- %APPDATA%\app\partitions\main\cache\data_1
- %APPDATA%\app\partitions\main\cache\data_2
- %APPDATA%\app\partitions\main\cache\data_3
- %APPDATA%\app\partitions\main\cookies-journal
- %APPDATA%\app\partitions\main\cookies
- %APPDATA%\app\partitions\main\cache\f_000001
- %ALLUSERSPROFILE%\kingsoft\.msedge\.version
- %APPDATA%\app\partitions\main\code cache\js\ffcabf82d01c65e1_0
- %APPDATA%\app\partitions\main\cache\f_000002
- %ALLUSERSPROFILE%\microsoft\crypto\.templog_1775705091399
- nul
- %APPDATA%\app\partitions\main\db5428f0-9ac0-42b4-8d35-9970bce47b62.tmp
- %APPDATA%\app\partitions\main\7a7d93d9-94de-4da2-8d8a-0393925b66c0.tmp
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\local storage\leveldb\manifest-000001
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\local storage\leveldb\000001.dbtmp
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\wasm\index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\local storage\leveldb\log
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\wasm\index-dir\temp-index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\index-dir\temp-index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\data_0
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\data_1
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\data_2
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\data_3
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\dictionaries\en-us-9-0.bdic
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\f_000001
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cookies-journal
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cookies
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\f_000002
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\ffcabf82d01c65e1_0
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\cache\f_000003
- %ALLUSERSPROFILE%\microsoft\crypto\.templog_1775705103630
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\1589888f-8ab2-4904-a54d-c12cad664d16.tmp
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\13d9d54c-b8dd-4695-a23c-227f53ae86aa.tmp
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\teams\previou\resources\upgrade.exe
- %ALLUSERSPROFILE%\microsoft\crypto\.templog_1775705091399
- %ALLUSERSPROFILE%\microsoft\crypto\.templog_1775705103630
- %ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\index.html
Moves the following files
- from %APPDATA%\app\partitions\main\local storage\leveldb\000001.dbtmp to %APPDATA%\app\partitions\main\local storage\leveldb\current
- from %APPDATA%\app\partitions\main\code cache\js\index-dir\temp-index to %APPDATA%\app\partitions\main\code cache\js\index-dir\the-real-index
- from %APPDATA%\app\partitions\main\code cache\wasm\index-dir\temp-index to %APPDATA%\app\partitions\main\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\app\partitions\main\db5428f0-9ac0-42b4-8d35-9970bce47b62.tmp to %APPDATA%\app\partitions\main\preferences
- from %APPDATA%\app\partitions\main\7a7d93d9-94de-4da2-8d8a-0393925b66c0.tmp to %APPDATA%\app\partitions\main\network persistent state
- from <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\local storage\leveldb\000001.dbtmp to <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\local storage\leveldb\current
- from <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\wasm\index-dir\temp-index to <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\wasm\index-dir\the-real-index
- from <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\index-dir\temp-index to <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\index-dir\the-real-index
- from <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\1589888f-8ab2-4904-a54d-c12cad664d16.tmp to <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\preferences
- from <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\13d9d54c-b8dd-4695-a23c-227f53ae86aa.tmp to <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\network persistent state
Substitutes the following files
- %APPDATA%\app\partitions\main\code cache\js\index-dir\temp-index
- <SYSTEM32>\config\systemprofile\appdata\roaming\app\partitions\main\code cache\js\index-dir\temp-index
Network activity
Connects to
- 'if###fig.net':80
- 'rq######.##-accelerate.amazonaws.com':443
- '1.#.1.1':853
- '1.#.0.1':853
- '<DNS_SERVER>':853
- 're####ctor.gvt1.com':443
- 'd6#######979l.cloudfront.net':443
- 'pk#.goog':80
- 'up####.#indomsupdate.com':443
- 'r6########5onuxaxjvh-n8vs.gvt1.com':443
TCP
HTTP GET requests
- http://if###fig.net/json
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'rq######.##-accelerate.amazonaws.com':443
- '<DNS_SERVER>':853
- '1.#.0.1':853
- '1.#.1.1':853
- 're####ctor.gvt1.com':443
- 'd6#######979l.cloudfront.net':443
- 'up####.#indomsupdate.com':443
- 'r6########5onuxaxjvh-n8vs.gvt1.com':443
UDP
- DNS ASK if###fig.net
- DNS ASK rq######.##-accelerate.amazonaws.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK d6#######979l.cloudfront.net
- DNS ASK pk#.goog
- DNS ASK up####.#indomsupdate.com
- DNS ASK r6########5onuxaxjvh-n8vs.gvt1.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe'
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7975757240737332220,6033218075054180879,131072 --enable-features=WebComponentsV0Enabled --disable-featur...
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe' --type=renderer --no-sandbox --disable-accelerated-video-decode --disable-breakpad --field-trial-handle=1896,7975757240737332220,6033218075054180879,131072 --enable-features=WebComponentsV0Enab...
- '%ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\nssm.exe' install TeamsCloudDataUpdaterServiceEx "%LOCALAPPDATA%\Microsoft\Teams\previou\teams.exe"
- '%ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\nssm.exe' set TeamsCloudDataUpdaterServiceEx Start SERVICE_AUTO_START
- '%ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\nssm.exe' set TeamsCloudDataUpdaterServiceEx AppExit Default Ignore
- '%ALLUSERSPROFILE%\adwarepopwndtrackerlog\caches\nssm.exe'
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,10907807625834875315,3591205711969358818,131072 --enable-features=WebComponentsV0Enabled --disable-featu...
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe' --type=renderer --no-sandbox --disable-accelerated-video-decode --disable-breakpad --field-trial-handle=1896,10907807625834875315,3591205711969358818,131072 --enable-features=WebComponentsV0Ena...
Executes the following
- '<SYSTEM32>\regsvr32.exe' /u /s %HOMEPATH%\Music\AdwareMusic\index.html
- '<SYSTEM32>\regsvr32.exe' /u /s %ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\index.html
- '<SYSTEM32>\winver.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h "%ALLUSERSPROFILE%\kingsoft\.MSEdge""
- '<SYSTEM32>\attrib.exe' +h "%ALLUSERSPROFILE%\kingsoft\.MSEdge"
- '<SYSTEM32>\cmd.exe' /d /s /c "hostname"
- '<SYSTEM32>\hostname.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "route print"
- '<SYSTEM32>\route.exe' print
- '<SYSTEM32>\cmd.exe' /d /s /c "arp -a 10.#.94.1"
- '<SYSTEM32>\arp.exe' -a 10.#.94.1
- '<SYSTEM32>\cmd.exe' /d /s /c "fsutil dirty query %systemdrive% >nul 2>&1"
- '<SYSTEM32>\fsutil.exe' dirty query C
- '<SYSTEM32>\cmd.exe' /d /s /c "sc query TeamsCloudDataUpdaterServiceEx"
- '<SYSTEM32>\sc.exe' query TeamsCloudDataUpdaterServiceEx
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" install TeamsCloudDataUpdaterServiceEx "%LOCALAPPDATA%\Microsoft\Teams\previou\teams.exe""
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" set TeamsCloudDataUpdaterServiceEx Start SERVICE_AUTO_START"
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" set TeamsCloudDataUpdaterServiceEx AppExit Default Ignore"
- '<SYSTEM32>\cmd.exe' /d /s /c "sc start TeamsCloudDataUpdaterServiceEx"
- '<SYSTEM32>\sc.exe' start TeamsCloudDataUpdaterServiceEx
- '<SYSTEM32>\regsvr32.exe' /u /s %HOMEPATH%\Music\AdwareMusic\index.html' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /u /s %ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\index.html' (with hidden window)
- '<SYSTEM32>\winver.exe' ' (with hidden window)
- '%LOCALAPPDATA%\microsoft\teams\previou\teams.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h "%ALLUSERSPROFILE%\kingsoft\.MSEdge""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "hostname"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "route print"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "arp -a 10.#.94.1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "fsutil dirty query %systemdrive% >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "sc query TeamsCloudDataUpdaterServiceEx"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" install TeamsCloudDataUpdaterServiceEx "%LOCALAPPDATA%\Microsoft\Teams\previou\teams.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" set TeamsCloudDataUpdaterServiceEx Start SERVICE_AUTO_START"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ALLUSERSPROFILE%\AdwarePopWndTrackerLog\Caches\nssm.exe" set TeamsCloudDataUpdaterServiceEx AppExit Default Ignore"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "sc start TeamsCloudDataUpdaterServiceEx"' (with hidden window)
