Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\securityhealthsystray
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthSystray] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthSystray] 'ImagePath' = '"%LOCALAPPDATA%\Google\SecurityHealthSystray.exe"'
Creates the following services
- 'SecurityHealthSystray' "%LOCALAPPDATA%\Google\SecurityHealthSystray.exe"
- 'SecurityHealthSystray' %LOCALAPPDATA%\Google\SecurityHealthSystray.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\securityhealthsystray.exe
- %LOCALAPPDATA%\microsoft\securityhealthservice.exe
- %TEMP%\inv_3652_b01573f1da310cb3_login data
- %TEMP%\inv_3652_9b48b5101d544886_web data
- %TEMP%\inv_3652_93e9f0f2d4eba89f_login data
- %TEMP%\inv_3652_93a6a587819b12b2_web data
- %TEMP%\inv_3652_30fc4c0e5ac5a710_login data
- %TEMP%\inv_3652_ad9452141ef8cea9_web data
- %TEMP%\inv_3652_e8987ad63c4070f7_key4.db
- %TEMP%\inv_3652_15b0d33b7ae53343_cookies.sqlite
- %TEMP%\inv_3652_5054b306a5e786_key4.db
- %TEMP%\inv_3652_c5318932c4ac8328_cookies.sqlite
- %WINDIR%\temp\inv_2452_30fc4c0e5ac5a710_login data
- %WINDIR%\temp\inv_2452_ad9452141ef8cea9_web data
- %WINDIR%\temp\inv_2452_b01573f1da310cb3_login data
- %WINDIR%\temp\inv_2452_9b48b5101d544886_web data
- %WINDIR%\temp\inv_2452_93e9f0f2d4eba89f_login data
- %WINDIR%\temp\inv_2452_93a6a587819b12b2_web data
- %WINDIR%\temp\inv_2452_e8987ad63c4070f7_key4.db
- %WINDIR%\temp\inv_2452_15b0d33b7ae53343_cookies.sqlite
- %WINDIR%\temp\inv_2452_5054b306a5e786_key4.db
- %WINDIR%\temp\inv_2452_c5318932c4ac8328_cookies.sqlite
- %WINDIR%\temp\__psscriptpolicytest_hdjq1uyf.un3.ps1
- %WINDIR%\temp\__psscriptpolicytest_rqpi2asw.eoe.psm1
- %WINDIR%\temp\__psscriptpolicytest_hzrzdnd4.j1y.ps1
- %WINDIR%\temp\__psscriptpolicytest_xogubql2.0j2.psm1
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-interactive
Deletes following files that it created itself
- %TEMP%\inv_3652_15b0d33b7ae53343_cookies.sqlite
- %TEMP%\inv_3652_5054b306a5e786_key4.db
- %TEMP%\inv_3652_9b48b5101d544886_web data
- %TEMP%\inv_3652_c5318932c4ac8328_cookies.sqlite
- %TEMP%\inv_3652_b01573f1da310cb3_login data
- %TEMP%\inv_3652_93a6a587819b12b2_web data
- %TEMP%\inv_3652_93e9f0f2d4eba89f_login data
- %TEMP%\inv_3652_e8987ad63c4070f7_key4.db
- %TEMP%\inv_3652_30fc4c0e5ac5a710_login data
- %TEMP%\inv_3652_ad9452141ef8cea9_web data
- %WINDIR%\temp\inv_2452_ad9452141ef8cea9_web data
- %WINDIR%\temp\inv_2452_b01573f1da310cb3_login data
- %WINDIR%\temp\inv_2452_93e9f0f2d4eba89f_login data
- %WINDIR%\temp\inv_2452_5054b306a5e786_key4.db
- %WINDIR%\temp\inv_2452_9b48b5101d544886_web data
- %WINDIR%\temp\inv_2452_93a6a587819b12b2_web data
- %WINDIR%\temp\inv_2452_15b0d33b7ae53343_cookies.sqlite
- %WINDIR%\temp\inv_2452_30fc4c0e5ac5a710_login data
- %WINDIR%\temp\inv_2452_e8987ad63c4070f7_key4.db
- %WINDIR%\temp\inv_2452_c5318932c4ac8328_cookies.sqlite
- %WINDIR%\temp\__psscriptpolicytest_hdjq1uyf.un3.ps1
- %WINDIR%\temp\__psscriptpolicytest_rqpi2asw.eoe.psm1
- %WINDIR%\temp\__psscriptpolicytest_hzrzdnd4.j1y.ps1
- %WINDIR%\temp\__psscriptpolicytest_xogubql2.0j2.psm1
Network activity
Connects to
- '1.#.1.1':443
- '13#.#6.152.26':443
- 'localhost':52853
- '17#.#7.165.44':443
- 'dn#.google':443
- 'localhost':44814
- '18#.#14.96.0':443
- 'localhost':42236
- 'to###nter.com':443
- 'localhost':64405
- 'localhost':40483
- '19#.#08.21.65':443
TCP
Other
- '1.#.1.1':443
- 'fs##f.org':443
- 'ca##r.cc':443
- 'dn#.google':443
- 'mo##ovka.cn':443
- 'to###nter.com':443
- 'localhost':49708
- 'localhost':40483
UDP
- DNS ASK dn#.google
- DNS ASK to###nter.com
- DNS ASK sa##tik.cn
- '13#.#6.152.26':443
- '17#.#7.165.44':443
- '18#.#14.96.0':443
- '19#.#08.21.65':443
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\google\securityhealthsystray.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe'
