Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\127e8e48-1660-471b-b756-cf68ad790db2-4.job
- %WINDIR%\Tasks\127e8e48-1660-471b-b756-cf68ad790db2-3.job
- %WINDIR%\Tasks\127e8e48-1660-471b-b756-cf68ad790db2-11.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-11.exe' /rawdata=TSe78+KHQyZTpph3Q2wrFNXSZPZjs/oRiWsvCBBLgbYn7KEvI/O70mCzdrxvd+v/ObZcM/YrBFe+sPodybYEkfl+qCc2JM7TaCHT3FWELqWpNA6VZvVAWYD5B0vWhv9080Dn/+K7Mauprx7tCCC1sZvdFu7pywgYgIpVldRoDwWtm8hC11TF27TUPKhw1PE1KTZgbktP/G2cibfWeGuC4Dv4Faf5eSkX2ieygdQdK7Ezh00yN954lw8tYIXlwUGTvOVSpMBrmIGdpguGLkMCLarniCyzKMoiIMMyyXNKqWv7CzzzsfCd4HDDXGrb92RdR2vgkurgj8KBCC4VmmO0krrcU11qxTUk4qy8A+TlBeFzKfMxqr7HDpeztWEzmbBQpeVy2/soXDRmOyuftsqQMDCOh/WEtiFF46Arlh/z+4XGeAxCP5RBnBK2OXgu4Paf4dS+KZSa+9uq/L+Qc2Vs3Qqr0CJUaXqeZ8BQ4Sjj2PzoOOG7Z5gEX+c/L/UPRZxGmXa68tyu4gSo76VKQd0r1mvSbzwXFl4pfKsQdIlYS2EB5kCikdQpfPnWeuaCsab9SIcSxcLb5YuKVqhJKl3Zyu7jrbZdLVlJMqSoPx2r1ePIvy17FKXO5zN4Bxn2ZSG+RrZLktD9VmVDRynY1YD/UVZKC4C/UR6srIAJ6KZO/zaSjBTW3o3d7TzaDDz3pY5T1XQV53cgEZHPNL/36hwZcHESq0XtJZd/nTS5WkzU469JFjF+pxhzdPlN4bihDKXzvwD2opGKhpjzr5LHDIDXSsR+rJkayrKpQHOQGooE+yu5OhzSXCRZPKLAKq2Ukyhl5yOVqjDaaqcjMkGltkx5WJFkEBoefbhnRB1xe2xFLW6sDh41E7rpHnNd+yFmH/21TnLuJxnNGDl4IkT8OjbYp71RRfpV7dh0tbC1JEAtxJybEP2it/DtEhWJXQOnx6c8uC2mSAAPosWaHUR/D2Wja636QQpLE7pX1P/uOC3Oy8dElz0VW/J/frRvTelCbT6Eff8bpfk+FsQAmbd5Viz09d6Bh7vp86/6QpIYRQuWhilyTEtBD5iCMo3Qm+sdfJCOR/aUo3NwpSZW3nt2/vd4xCJIbgm0XCmKm26kVHg7exI5/wjDEJJgT+ta0e3P1D7Cw6Z9EGC52YVH4gUYFG0Ferz7h/hR2Iss5kkWD9sF7L4uEnyUUVgJeGFLRUVFEQ8beIw4WcUube1YkuTm0IAABMR+GvEZmG1hNMbhiVpzDGpa1UYsyTZthrlqZYi9eUI19NGcGGLhLgCmnStHx6HclQfasxxrdAvCsY2bTIRh7mskSJGhuGDyb5BjTN8CiEWjuaAHqmnBgH12Ad1R5H8igqHxhkr1SbqnYBQQ8ZBX/KO6qOa3oQUjXNh68ORI7mc+HtH/sJQYca77PvwXB5/EZ+VfFhT0cJOvs2igS2NtQgKVhxY9BaI1CQ9sqwDu3SrbepGIlWsAsf5VLNuUdvKWlDrPtIUaLlTzNrzW/JHxX8cekdA39jznkrZlcRVpupH7HvoGS+t/6oc+nUnvZTbwzplqA/urUmTpFywwoiyLMdxCqr/yxr1erRhabi5lgfV9sQwiQ9xuLDGfzttcvOaZVWQBvW3HNKZAlqexXuCGa3+0/F2hs2duPZGq8RiLPkGNkajBbWgSFJIXpmwjMZHSVVF4E2v64uGipxKX+kR6rOsLAHZUgKmg91MvWbCT96Cd3p5pyLR9m4KGWTaQK3yRo0d4DmGqHnB+GJqcsEivRjORmKJhkJW6p69ENvLi83Br9KyG3d6JJof5sXsjjSnemfMtfH/NmEIBzB9MG0SILE9h9R1hRxBDbxTQLa+II+pOMhqTH/XnvksI6FbgF/SKVLOcy2YKIPdlxfi/yQ5HYvcWtodhkP8Cg0NxsBWEft0XAjCMWHwUBc+o6PPyctMIjNwJhFeg7ux9XijiMAtQjq8Eyj3Me4GJlbQ/Jmjm9aWw1n/y893tg39yCt1VJbLcLLzKb/0baTYHagW4UlPHfruxhAImUl92AAdbAbOb/2Dv
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-4.exe' /installxpi /agentregpath='Information' /extensionfilepath='%PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2.xpi' /appid=50368 /srcid='000972' /subid='0' /zdata='0' /bic=24B69CA6401A451489A6511ADFD388DFIE /verifier=ec0d1ebff60d08c9dcfcee97ab9c75c3 /installerversion=1_34_08_12 /installerfullversion=1.34.8.12 /installationtime=1408552916 /statsdomain=http://st###.##putdatacloud.com /errorsdomain=http://er####.#nputdatacloud.com /waitforbrowser=300 /extensionid=ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com /extensionversion=0.95 /prefsbranch=ace85a36c113a4928aa8688a31bd595e7aa144f8ac1f6481f991c18bf0472c970com50368 /updateurl=https://w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/50368.rdf /extensionname='Information' /extensiondesc='Information Helper' /publishername='VisualBee' /defbro=ie /sid=S-1-5-21-2052111302-484763869-725345543-1003 /addinfojson='{"asw":[0, 0, 0],"browser_name":"__BROWSER_NAME__"}' /allusers /allprofiles /checkfflist /autoupdateulr='http://up####.#nputdatacloud.com/ff_agent_updates/{CAMP_ID}/update.json' /showthankyoupage /runfrom='installer' /externallog='%TEMP%\InformationInstaller_1408552916.log'
- '%TEMP%\nsn3.tmp\Ecnzgk.exe'
- '%TEMP%\comh.315978\GoogleUpdate.exe' /silent /install "appguid={396c4c99-88d9-400a-80ed-abc196317a08}&appname=09c77474-482c-4364-8c30-382a9afb2466&needsadmin=True&lang=en"
- '%PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-3.exe' /rawdata=j2o3pOzJ3KpfwCzkGIqqhnOMdKm1Urs1R/dyVvWtkx44jwFc0+ZPkLaiqYRrQMwfJlC6jwNEsznyJYdNpmBMeJ5kK8KQIZRy/mei7//jBPlzUfScZK6/eBoT1FWVBAm6e0kDuU1i2oeKYu0CtScy137kI8G/DHyM+RqAykJvBKMHVNohf/OWB4EH15oGekT+E4iypCL5bxP8i80pWoywdTm5kg6dCGmXAxYdvFV/na8nqGCMN7zngWUh6ZHHieUnEZ/oTW0nFgnOo1/zQ8G37iv6UcTOEBfGdN64Y604ZUnUxdc7CuK8Ygoppjsqb3f4A/JSc7wRKmoQVYcjVJrOh4FWm//ZNUoogLiZk1oO/W//hgixCtheIf7040iRDkGDxVNSc9vW07nbp20hEyej7URNi64m+1iRu99HdzA9ToH7JnZ09g37l3+2yOZriknwuY31lwBkSc6a7llL8+94yUZ13AGCETiCuot8hqjK7Zt06yB7QuNrbBx5w3ljAISCO8H1mCtAKPhIOFoKv4RfLn3rBG1mzQ4zdOlHfdhlydeZkQpverOxeVTvk9tQGc06kI5NyvaX3p8De/e40dztKN8X4rNPvdrlZNkGdEoqY+d19GGK9xTrjnOPU5aecDljbJFoPo33wbnSwOEcIt/8hKH2aW+Gm+It/CwTwMX94AhKuQM1O4io0VMWuW8Gn2kfpGIKjGC/ECqyY4s4sIjJTxiJqeCUw154wL0UIQu2mqC7aL21huvM2xu0i5wqNi8MlHNBfOnQM2sgXLLw3ofWUD7ETc/PyQCFy+gNjjTZLZdlx3WjfvzD8cJqF6KPhywFuwKh/ZgyZYhCtxMsbzEXO2Uy0m4Iwh2JSz83fIr+bPWI6iWnbWznC1e+dZJkp8qZBISyUBqdm7sFEI1TnVRZzPWQEHmB9pDPCzoKgxtEvjqhFvRtDC7dGVIdLtZOUiZ+JTAtpVoDChfYq9ztiEY8D03RNSZmBIr5sEuA0JFo+LIioxm+ktwhQxsTx90HVFTaJmDWx0N4X0KVJ999FDjZtjF3mZNvK0N4kfeWcdwQ/5AKcgwOh2NJLEhY0f48lrZH2SH1fqtmOXi2fqHj7zcE00YM70QKamYBWc0y5mj3GDGBkn/1+232UukvdzC8QOV9mw6UDQginKESTsGOBUlYwtHmwdteDlpTADdjwGrFSWIO4NATIBnx3ZnmdHq50QPeq83Xuhx2apDfPepfnfaCwfv4uH6DGshcZo5blIuc0dX/xgoH3res1g32OQAQ2BlFRFyZhOpsaaIz/2w6Qllfh4R6sHlAPqNPdT7pIZX5OAgxvwwpMNG2HuGZPaX/AcfuiCJGMlpbgZnkx0MAqgLgmEMHyNhETdJKldFqBLKj5dJxpGIqZS1Atj8ORcDZrS36xx2g/js7kn1WDstfo/H2roZiGorJWcJxY4mCE+H8fi4PuulTiYGRKUc4Lbrp1X4I86K4/FpnwT33/6VBFMs6yoNMFRyp3wt5KCW2t2JDydhLUZSoloFclIIhmo8l/VTYQjEgfzZbqdsI0z023Tx9shkwif4nuzXJuYVzKsW6TWsAfVNhAMM6NDhuhGRiKbJDf2T8GCIAX/glY9d+si1XLunjoxuWhsbISHGEXXWBLXqv6S20rvb63Pi0gkcs+uK/bEwGBbKZuFvEzHoCjVJrCxnAB5Hd58WMqezwVKf8ruc=
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %TEMP%\Cab9.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-11.exe
- %TEMP%\CabB.tmp
- %PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2.crx
- %TEMP%\Cab7.tmp
- %TEMP%\nsk6.tmp\ExecDos.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Information\1293297481.mxaddon
- %PROGRAM_FILES%\Information\7bc1d1c1-c72f-4846-a615-975622ee8e0a.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\chrome.manifest
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\extensionData\plugins.json
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\locale\en-US\translations.dtd
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\defaults\preferences\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\extensionData\plugins\268.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\extensionData\plugins\275.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\extensionData\manifest.xml
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\extensionData\plugins\180.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ce85a36c-113a-4928-aa86-88a31bd595e7@aa144f8a-c1f6-481f-991c-18bf0472c970.com\install.rdf
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-4.exe
- %WINDIR%\Installer\487ab.msi
- %PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\Information\127e8e48-1660-471b-b756-cf68ad790db2-3.exe
- %TEMP%\nsk6.tmp\UserInfo.dll
- %TEMP%\nsk6.tmp\nsisos.dll
- %TEMP%\nsk6.tmp\InstallerUtils.dll
- %TEMP%\nsk6.tmp\InstallerUtils2.dll
- %TEMP%\nsk6.tmp\update.json
- %PROGRAM_FILES%\Information\utils.exe
- %TEMP%\nsk6.tmp\md5dll.dll
- %TEMP%\nsk6.tmp\inetc.dll
- %TEMP%\nsk6.tmp\System.dll
- %TEMP%\nsn3.tmp\Rgdgwsgf.tmp
- %TEMP%\nsn3.tmp\WrapperUtils.dll
- %TEMP%\nss2.tmp
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\nsz5.tmp
- %TEMP%\nsk6.tmp\StdUtils.dll
- %TEMP%\nsn3.tmp\Ecnzgk.exe
- %TEMP%\nsn3.tmp\StdUtils.dll
- %TEMP%\nsk6.tmp\6735
- %TEMP%\comh.315978\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.315978\npGoogleUpdate4.dll
- %TEMP%\comh.315978\psmachine.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\Information\d9ee7eb4-90f9-4c58-b916-628f4d73b1a2.crx
- %TEMP%\comh.315978\goopdateres_en.dll
- %TEMP%\comh.315978\GoogleCrashHandler.exe
- %TEMP%\comh.315978\GoogleUpdate.exe
- %TEMP%\nsk6.tmp\385033
- %PROGRAM_FILES%\Information\Uninstall.exe
- %TEMP%\comh.315978\GoogleUpdateOnDemand.exe
- %TEMP%\comh.315978\goopdate.dll
- %TEMP%\comh.315978\GoogleUpdateBroker.exe
- %TEMP%\comh.315978\GoogleUpdateHelper.msi
Deletes the following files:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsk6.tmp\385033
- %TEMP%\Cab7.tmp
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##putdatacloud.com':80
- 'up####.#nputdatacloud.com':80
- 'er####.#nputdatacloud.com':80
- 'st###.##putdatacloud.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nputdatacloud.com/installer_updates/000972/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##putdatacloud.com
- DNS ASK up####.#nputdatacloud.com
- DNS ASK er####.#nputdatacloud.com
- DNS ASK st###.##putdatacloud.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
