Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\d67d418e-846b-42a2-8d24-1bddd940cde7-4.job
- %WINDIR%\Tasks\d67d418e-846b-42a2-8d24-1bddd940cde7-11.job
- %WINDIR%\Tasks\d67d418e-846b-42a2-8d24-1bddd940cde7-3.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7-11.exe' /mSNfCQ=qaaip30bgRP10Wr5f+JDPtepVKXdbCFMo8EhC4ryO/ycpAPfTXXLx386PvBkmHMTglQWzOL06oV4HIrhxXd20HI5H7zD4iSvqBm2npHpCOIPle5zmuVSF1KfJMr+zjqrh74l57++i3+Poupg953THck6zzGcfzxviJwWTGY1MDlx1jTNmw2LqiWdpDDccLjj2ihysvvmZ7t3drT137bVpV/yM4foTnbzGYQl9OoFjii0HGzTjXrN0rUdyzmSUhnlVJU7xxf5O81yWjtveOB6bZr/Eji2ckxh7MG4D6VMmCalD3E6evlGjeS7AFX/UYccNLEyMk/tlWRHmDnO+6ySgSRTS6+lUQVRCi63x/EtKjg9c7WI/BDjf8/OaD9XGJr5wlCqBKf9j0I3sBmpVv+qoCiYjYJ4P6fY9zff15uTWnHQQMbBF347J9q0TPIQQq8H1A1kmmIiv0s8qZ5CWxhIB7+e7bVx987goGzqNXNL/JMQe/b/fgt8jfBOlYlo/2Iyv6CbRqvQvRyE/gdmoYYiTKJRHwKH3qEHRMdbazhVOxNQTqNsnKGnED1Ygu6fQB1goa1gJwkTyk8gqtJIll6ZlB4deJleFs8ZePuVkXyPxO+PAMF1NNNxpw/7xsPJ7PSBL1Arc9luBZ7ElYvA4BGsv2QdV9Wb9Ei/EziVk6KAG5eVbuw/Ow7Gi5lBlNdZ2v51UOcvHs0CPLs+5ZdhrYOptswUBDTxWj5zdkKKV+NuVYZeKiaREtCu+jeN2AEX0X/mjOpiRlqhnhzTlfuKAmomH9lAvUJjBV/h2goCzBe2tH5z3axcaIqM/OG4ylWG1FLeCPZ4BEnJaacCtvnubIQ2prf4dEpPBPI/JPkonuJi4+5t4+lmBIOTEDG2ZpvAmmHXGWUIh/+/pfzbhvb2APv+CO8QHO9tZl/SZHyAl+f4QeyNNgEGjonP2heAlu1KvjDQvn9jPUXRRjbRS5k3UO9U/z/qKD5mHhI9mt3MO6PWdCkbfqeEKeEi/EQfY0T3AzYJaRKV7cXolJfwIHps7j3aYxP5UcW5kliD5q947wCPDXzaUUvFSKkA6huTlSCXhL+fEojWuVXm77iphYcjriNltQkh+lAO0RjpFFVBidoiVH6hj4+YmYGDRXhuyfkfsjyGCSyuOxD1GpHaPymyZz5Za9k6SdxNXLN+y6gVlXTzy1KktcDXgFAgJbZhKJ1WSWobBr9xY2yHRQ52lM1v11y6TrEso0u/Crs+hoqwnqxs2PWxGDZbRgNt6HJvvLp88herII0er0zmiTUswjZWkBTw1jYw8TOU95vdmhlRGSZ0afRtRvIdA1O1HLCzEsy7PA/aHnLVYBD83DFrpPXLs0IXXbqFl/JCDbxLMsdJedrh8tYbnsVwfKwqgfQT7WNcmaimR7Y+UUUhvzjZsNBb2a7TUQqruFOXznxdQa1Af0b75aCrfy3WVqO/d8ek+SLXQDlggjL3VxEFLo4PYlntqQTFeL8yb0slxI6PW5Pj7L7tGesNsnLg1xLvBYYtb7Px6BWxqaPOHYEweyj9BhL0kueeu+Ra8PkdaOhzWQaQh/EKT59uOH4fy8yjl2uUBcvCv6G/K5zNxSt6MZX7rP7i0uLSkKEf2EktPamdAb4sOdh8r3IzhHRAvbC13C60W6e9RYW1D0ShpBbyUZlDyrdc6GpkPpuytM3VhfokjV8jV3W2mPdjMgqvOiIf0TVY7LSLMeC/R8zbofa7XJ6DyfmY/PhGOQ4bDTHCAW/zMEWO9ZiEQKAdsxdTvwC2ZzSjNisCnE06CMBrrHu9efAG2mKDNbfSY6T7f9oAgX03i6lbw9M97a2A891yDz2qj4snTC9Q0kFewqfuRrpAGbTUZfCE8vPD1g==
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7-3.exe' /mSNfCQ=HdV5ujEIWrzM1y9FJ+FC1C/n8sMwLKFUL6F6LhjmQV8pbkaszfNVeGmrC19TbMKvwJPVidO06KNHYlrDStnh9rqJXfrKrBT3pLGksnW897Oy37Pfg5Erg0/ZSm7AQmSBlX0TCcrk726jXo7xH3Bd4FOw/0HTMRRV/jlH+DG7s3wl9z7sNkJCVIUcqdSa51U5RlGgwK529eYXVj5dnzbeGXfSAJ40uin5MCjLXEWmG6+NpgTF4kY9jXxzAnOoeQ3uSa64U6gInwNYPISuOUukw4qkg8HHCs1Mab7J9U/zs8XXeyCMOjnkWHfaD69aNJ+Z4OfT8MNRiz9C/2cN3PKWqqahQYZZpuPnFvBX8ONPzYwyfu8RmLtYtk5IDDgn9L/TBjlqzUvNIsgzoSvEu9XQF9bp/unYJDZiWk1NNfUWpVbIf5bH22NrZB79CyCT9m3oNqTBaFsFw3E2+h9PD5VqYJJJazZSAweHmdDwKnRbFtoZgYMINoqYj6g/dnMfpe9rwweR9vzuIZceAcCU3qZoxoCt9E5nNsc2YRFHiJSdKUNL453jTp3YrkeZL1EN4eRkieFslAtHYL9B9zSGpE2wlfDzI957iddA9xCJjxZ6NW8gLO3BYZeAmB/VQi6Ea3w8nMkCVFKsFiBb58xWFWWpZSnh0wpKhwxkQHxJW1+HqnWwUqKZKGvBF1HldSCz24jvioLcjOd54SFwZLYIMe9lewn9MxQb/VqKf1WZgtfm6Gofb0eD9kpUukD8IZJZbVrkyLOA2fGOwPg9JmRUq2VJtXP9/RNx94NwY+nE4yalqWVaSM9HMBeb0QHOT9Oa7mv6L0FOWZocdUPRaoSDa3e2LzoGKAyP6swyy7xL+r8XWldRB4ZMh2JeQyfo5z1jEvfo+1LIxY131eFAdeJqCCwgKakCNHCygR85QXNI5FRxQJI0RMoH24oviSGaGV2EEi1OJ0pqK9P74v3Sjj+M9ZmWwPPZN+msgAx/WHYoIs7SpendZbUfJGtym+jC1YsqecR9Q8LnMuEY6SEtwvsW/iAmD+sEnbgxZPtLsSXiWe9KCM5PQpVKWv08uBosr0C/2TyhHllLxJpXq5k2vzYp8oZR+aGahBDz05tL+oQfJ1bcfVAHKxGrB44lxYtiVz5jluvECZ7N6z1VCyrelDv3zZHwAwBTKL46pg1F52hT4XCdY7eGA6OYj72hTOKGyDjAJbtqzoKpyBneHJXp511nLacLJTWQZdCGPcB+8unBdO2G5Lf/dZ6XXP6nuCmCnlBh+TtE5psEchbYBX19P1l6AK0hSVtBDmUn0v7QaCEqDFgQjl7ggQuKC5SYbJHiJNTvk5BwEdSUJayh3vx6bWFD9EGudIC7iWHHNb1WdIRzzTuwk7qa9QtjPRY7Seu5vRtWlkaZD1fTnuaqIZZtxaFZ7HpUNTAEvMnxALiE1oiWTxxnjtoyT08novKKXFtdA68kqXZmX+DqYnI0QRDjuFK3ptpClrb1px33KI8be1MpooC3UHogVDI58MePOEZ5m40A0NY5
- '%TEMP%\nsw3.tmp\Ldvhtlomqiujar.exe'
- '%TEMP%\comh.152728\GoogleUpdate.exe' /silent /install "appguid={cea32c95-119d-487a-a105-20a458c84c07}&appname=3e0a06c4-f4b8-4300-bd23-e8fa95a26e90&needsadmin=True&lang=en"
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsk6.tmp\ExecDos.dll
- %TEMP%\Cab7.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7.crx
- %PROGRAM_FILES%\Cinema-Plus-1.2\307198e6-df3e-4a13-aa49-66cc09c36f53.crx
- %PROGRAM_FILES%\Cinema-Plus-1.2\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Cinema-Plus-1.2\44af1203-09e7-49bf-b043-5cd3d1fb272b.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %TEMP%\Cab9.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabB.tmp
- %PROGRAM_FILES%\Cinema-Plus-1.2\d67d418e-846b-42a2-8d24-1bddd940cde7-11.exe
- %TEMP%\comh.152728\psuser.dll
- %TEMP%\nsk6.tmp\InstallerUtils2.dll
- %TEMP%\nsk6.tmp\InstallerUtils.dll
- %TEMP%\nsk6.tmp\System.dll
- %TEMP%\nsk6.tmp\nsisos.dll
- %TEMP%\nsk6.tmp\inetc.dll
- %TEMP%\nsk6.tmp\UserInfo.dll
- %TEMP%\nsk6.tmp\md5dll.dll
- %TEMP%\nsk6.tmp\StdUtils.dll
- %TEMP%\nsw3.tmp\Puehysesguh.tmp
- %TEMP%\nsw3.tmp\System.dll
- %TEMP%\nsb2.tmp
- %TEMP%\nsw3.tmp\WrapperUtils.dll
- %TEMP%\nsp5.tmp
- %TEMP%\nsw3.tmp\StdUtils.dll
- %TEMP%\nsw3.tmp\Ldvhtlomqiujar.exe
- %TEMP%\comh.152728\GoogleUpdateOnDemand.exe
- %TEMP%\comh.152728\GoogleUpdateHelper.msi
- %TEMP%\comh.152728\GoogleUpdateBroker.exe
- %TEMP%\comh.152728\goopdate.dll
- %TEMP%\comh.152728\psmachine.dll
- %TEMP%\comh.152728\npGoogleUpdate4.dll
- %TEMP%\comh.152728\goopdateres_en.dll
- %TEMP%\comh.152728\GoogleUpdate.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2\utils.exe
- %TEMP%\nsk6.tmp\update.json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsk6.tmp\344974
- %TEMP%\comh.152728\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2\Uninstall.exe
- %TEMP%\nsk6.tmp\481525
Deletes the following files:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsk6.tmp\481525
- %TEMP%\Cab7.tmp
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##fodatacloud.com':80
- 'up####.#nfodatacloud.com':80
- 'er####.#nfodatacloud.com':80
- 'st###.#nfodatacloud.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nfodatacloud.com/installer_updates/001768/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##fodatacloud.com
- DNS ASK up####.#nfodatacloud.com
- DNS ASK er####.#nfodatacloud.com
- DNS ASK st###.#nfodatacloud.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
