Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\c37af138-5101-4b3d-b0a8-9f637d3b9ced-4.job
- %WINDIR%\Tasks\39381781-7e82-4c51-83f5-b2813a353b5d.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\c37af138-5101-4b3d-b0a8-9f637d3b9ced-11.job
- %WINDIR%\Tasks\c37af138-5101-4b3d-b0a8-9f637d3b9ced-3.job
- %WINDIR%\Tasks\temp_35da60c9-db5e-452e-b272-e92559d886a1.job
- %WINDIR%\Tasks\35da60c9-db5e-452e-b272-e92559d886a1.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\HD-V1.9\35da60c9-db5e-452e-b272-e92559d886a1.exe' 001859 3D4150E477FE4227881020BBACC8206EIE 61792 1408673903 93-0,102-0,104-0,178-288,179-288,180-288,223-288,263-24 HD-V1.9
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regserver
- '%TEMP%\comh.470620\GoogleUpdate.exe' /silent /install "appguid={9d03e39d-d46c-4393-bace-ade4a8f2bcb2}&appname=1e707313-2d77-40d1-abb1-571075ba3c31&needsadmin=True&lang=en"
- '%PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced-3.exe' /rawdata=RMKWyZjLBzKVuMqJ/MkK4mcr8l2bfZv/x3hFI03d76m1xsqx9s7HkoglISoZL0z7WYrJq7Vh4uLVJVh4opMRYMpJVeZRnnf9WADgdjlyTOSbjNCenyZTJOJRt0NhgtdtlI5K895y0151bHeAWAmp/nM0aBx5UfjcYs5XjILpKAE05PZeyjYaq6vymlicsp887tdILlP0reeyCQHqdO1p5iM7653Xx+IpcwIzGkrlZPaU010i8EZPr4WONfLDQ9dxiaYDSxihktl83sDR8ACEJCAr2iCOVtOdFZmmSRkTkv/pdQNPGubn8G9jHNcU0nivPsRtTiNQakCzxMNRWnxLiTpdsp3chcquxXn9ucuU5REQJpUmNpuJk+xDsoP95B2pvuAS6ZHjo8n3bMrA38NLFOx3frYcEk7fnaqp2jCWuVRdWhvEO/pxpDEahGeWW/J9vb8iOlPU3nOKHPyTiu7iG+JdOJTdXroBQkTj2/s/uDi9vnXTwXyyOMyfIlyd+WrCBB2oITIUUAU0TZOYFo0JOileVJC2Jd17i9gB49s2RBTvqqBuU2DJrSWJWyJX43fwy91sOFUqH3RnMfxA/6yPWMCtQ4Ecy9/T415b9oEYwsGqzBmaMkig0ntnG1nwtQqubAOKpnpdLbQk3KZTxVNiyOkBcpQ+nbH8J+aNNPdafVkjmLAHFV1JMgzA3oTHse9AI9WFyjizBTChOeZkwAjh35UMyNQyLW+bj06ZNLWnRnJGA1CJh4tETZ1TBmfR6UHLzyHPvDHkUxw+2Xa8VH+O6iFqcyRuQLL1tTREY25z712+FttLNmxZtPEdcY1YH5TfBCTxZxuCJlDNiwN9YHu07YHAPmSAk+iy2c/BvW2fYdE7NWUXTQNFRJeZOfXfbQcgdx7n94DRea0T9+cvhcPqS+O/d1SgBzf6WSpPw4KAcNHbdsg27ZxIi+lyre7ir/LSh6wsG6kN6pbVW5XEf9Gfog+g7YKAzAlhsYZZ4k15Cf1wjZEv616Qoo1Oid2SV2E8ttlJjVLnU7rKZkj/3hp5fqi42KuOOBPNZegywWXpDlHv8WtgOLZXBM0dK2UhTDYlXqIzaW+PwcBC7EWqutlBK0G98wvQl8ODEkruf0grscugycnI5QKT86bFyiuD5UNVmb4hgXv77xO8sdn2PHRz7fE4jSguBjlEuJ6hLxSjcAh/EWzGWR+/br4IC7KVldJVuLKrJYo+IxhuRWYs2gQYBsNZB4XdXxn2df58YoD6/dmwpSQs89JE5g0jgs9R0yzT7t1NMIs2NKFlUCy7eJbW+yiacYc/skl6D/CU3Mz7vvlrM2gvNQ53yyRg7ZPch1aojIXPfdauF3igMpAa75yNbYBccx0M/T6/EsOUH6k+uM/6FbgV3YPIsB41vRstIINdaknn9otLbpmbKlOiCly7CHs71KKlrC3+WtBSF77qUDfIT9l+vCL00AEFmW7uvEdnq97KNoa6R1gUs/OPoubyrzR+bxMFLjl6WPOMyBrwG9efClMpFXBgdiKNyGca6FNepw8KRMFlTS7un2UW1ZJY5mVn3fkib6/f9bfCfRi7zKRqWbUZujJ448+rSF0wNNDPNrippkQatBTL7GYsfxj2o9jOTAOIa/VPWNUNyHp+5jPHDGoy/guEJq/gS4yAXug1VT1rrCLLBI1Zang6vBpdH62OMvgcARhDh5X42ZA8ZG4=
- '%PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced-11.exe' /rawdata=CAMhHIqd/U/J3iLcPOax1Gk70zrRWPnXfW2r4CWkQxEgpApLy2LANPqUwucplMhAdeQO3XOMJzV/z1CQcDNYkvTzf0b5LX42vhNukHdYDLcR4lkE3bMY1mLwwPXMcVhbIozRc294fVXiw8/JJVHy8/iw7NBHoy2O9cKdO5Tzphk1iKLHoKYkj3tQgxD3es7otUp7EnvwkWmQSYFqbGB4NGHkDrjl0zqES8+MK2fP1Bj4FRa+QX5tQJUpRAi2Kqc1QJ033I60PXwKyiYHQ2j4LZpWWVtbQwgAZH32JPxFbOvzikOFKlJErvhu3juzMjJPQ9ub7cWDHUTOzIiuUpYu6ZTUxEY9wQ4rr4sPDKHWyl+bai5ZOws/i9FakE0Wo9rpkj0uW3akhqM49dBjZk8G/7mC4P1LaW6E7s1I/Zjloj71IF3sUJrLdDfaN1C4RKY3LKsbUY+tJ/5/GTBFXm0YlJ1FusE3AdjVbczPTi42IYh9+/obwFYkqGoT4lMtyW79v7oAdAg8XY7foe5hWVcCUKjOV+n3wbhk7Vu546lPg+Mi/YZ3+tchCuRJKwkh7afO3ztYy0/SDpH/UMCeCr30RISx+eh9nnaOtbnL4Irk0qBXn6chpf7xFmwKGPKKVNzk5JFxAN2IOJVrVK1i3S9Sf+Iy6KMgvbs70jVcOgv/2jdurnyHFS8az4wzRrAV5Wcvb9zKhxs23/1WIXDYmZppOxQ5yJ/m8xg0aNyDd1fQi/t8CiPBSf8jiWZGZvWJPHxrSEwaTGrQcKyUWMAw+MTg+Iwqesv6RUGWZopvRKzDcuyboxPzeYpch3EdiD1kjdr5wUhuX3vexX9nlWVLoqL33zzbHYOF2Pde+GGtQmm04cMFWaqkK7z9KlAJan/VAclrkFbYjuy+zmr0s/r4QpbtBMmJmm3bl9vTvm2DNZDMLUVaht7f2QCUGNT98P6pNzfA0mlbOJnJdEOlxazyIiUAFbzK4sM/tCmDau2GlpIKSfGF5fQc/d0rHbqUgiG+h/JJJUByx6leiiTb4UxD8f/Es3PtiDJgYn8Y9eqGFFJz2nxxNiW0x+V5kOif1q1MZDzfAAODUzHrcx7J7zUUrBiEgDtOIR4UJTECJPT8hvI8Lfg7PcCHAoT8S07MCuc4DvIdeL3uHDsQ9uNM5P7Pesooiu/5T+Fl9xZKB/TvDGX1w+8tKyod5gKDbzZpFHJDQiJZBv6sijZ2vxpHa0zYgU9pajZOY5sWyXYi9/ELVQGrY9mPAz02Hxbi0BtrszxthBdK3zRTLofmVXcPwKBvvnsR8oc+cZBnxncw3cUkBnhrrXXAGW2WuHno3daHvdHUiM9567gYWKJ8TWlYNneSoLBhEXXv+l8CnglgzPK7afMh2CbpJ7N+aicL0BivhJhKgm0VQcHNhB+pWJyQQc+Nsou3x/TEeF0RNWzjfDX/TqXs/8q7Lxnh3r+FWJYFM1CXJkH0EsDOz/XrJxOaDlpdIaDS5RotmSZpsc4xO6zSrhoCTxNJlmaVvU9vjWC4KAyK6ayWQCjsA3juSYXZhTtK8AFmyTJL0OZw8oAqNhO6rkNTiWQEdGRiAVd89PmQg5KCX8dw9N7qq3kIlXMqTo8nQACZQBM4Jrs8SOQhvFEVe4Tf3uRa1XeFmNHxgM7fz8wGDcMysStrTFZGgdP4rNLRorY63YSDm6K3P3XAYvP9vcEMSVZFEwMjoWfAT85jO9rQPG9eybTDLe8PaaNMrzrzqYDeFUqA8PUJol24sidQkkYTJB/ajgWnEqRo/zyvmRv4pvMkRRho5KdYoQe85P2UQPftClxw0qn1RY7zPq5zbEWU3XtX7An1YYz9P8JE2CKQlZIh9jwSebcZ5LENyRI1KvCyYVGGv9ao3m+yquow7nmXmsUOKFClTSAacJQLKjjeU+X7OAemCnlIFYTilITFvQUJY9meuGD6Haak77PrzJqCNkEhq/tDY2IIKU98pVekCxZfZtjt1HmfZJzWzVZDXlbgQEcjadLcb8PROvGfhSPZY4Shh3j4FDMSTsp4DiZnWPDb
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\HD-V1.9\35da60c9-db5e-452e-b272-e92559d886a1.exe
- %PROGRAM_FILES%\HD-V1.9\Interop.IWshRuntimeLibrary.dll
- %PROGRAM_FILES%\HD-V1.9\SuperSocket.ClientEngine.Core.dll
- %PROGRAM_FILES%\HD-V1.9\SuperSocket.ClientEngine.Protocol.dll
- %PROGRAM_FILES%\HD-V1.9\Newtonsoft.Json.dll
- %PROGRAM_FILES%\HD-V1.9\SuperSocket.ClientEngine.Common.dll
- %TEMP%\Cab6.tmp
- %PROGRAM_FILES%\HD-V1.9\b717b029-9c07-40b6-8475-f45f031b0d8e.crx
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\HD-V1.9\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced-11.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced.xpi
- %WINDIR%\Installer\48866.msi
- C:\Config.Msi\48869.rbs
- %TEMP%\MSI4a0e0.LOG
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced-4.exe
- %WINDIR%\Installer\MSIA.tmp
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced_.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\HD-V1.9\WebSocket4Net.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsh3.tmp\237840
- %TEMP%\nsh3.tmp\121082
- %TEMP%\nsh3.tmp\update.json
- %PROGRAM_FILES%\HD-V1.9\utils.exe
- %TEMP%\comh.470620\GoogleUpdate.exe
- %TEMP%\comh.470620\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\HD-V1.9\Uninstall.exe
- %TEMP%\comh.470620\GoogleCrashHandler.exe
- %TEMP%\nsh3.tmp\inetc.dll
- %TEMP%\nsh3.tmp\System.dll
- %TEMP%\nsh3.tmp\InstallerUtils.dll
- %TEMP%\nsr2.tmp
- %TEMP%\nsh3.tmp\StdUtils.dll
- %TEMP%\nsh3.tmp\nsisos.dll
- %TEMP%\nsh3.tmp\md5dll.dll
- %TEMP%\nsh3.tmp\InstallerUtils2.dll
- %TEMP%\nsh3.tmp\UserInfo.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\HD-V1.9\331f608e-a353-406b-9602-02d4bed85e4a.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\HD-V1.9\c37af138-5101-4b3d-b0a8-9f637d3b9ced-3.exe
- %TEMP%\nsh3.tmp\ExecDos.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab4.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %TEMP%\comh.470620\goopdate.dll
- %TEMP%\comh.470620\goopdateres_en.dll
- %TEMP%\comh.470620\GoogleUpdateHelper.msi
- %TEMP%\comh.470620\GoogleUpdateOnDemand.exe
- %TEMP%\comh.470620\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.470620\npGoogleUpdate4.dll
- %TEMP%\comh.470620\psmachine.dll
Deletes the following files:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Tasks\temp_35da60c9-db5e-452e-b272-e92559d886a1.job
- %WINDIR%\Installer\48866.msi
- C:\Config.Msi\48869.rbs
- %TEMP%\Cab4.tmp
- %TEMP%\nsh3.tmp\121082
- %TEMP%\Cab8.tmp
- %TEMP%\Cab6.tmp
Network activity:
Connects to:
- 'cr#.#hawte.com':80
- 'www.download.windowsupdate.com':80
- 'cr#.##ertrust.com':80
- 'ts####.ws.symantec.com':80
- 'er####.inputgenserv.com':80
- 'up####.inputgenserv.com':80
- 'lo##.##putgenserv.com':80
- 'st###.#nputgenserv.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- cr#.##ertrust.com/UTN-USERFirst-Object.crl
- up####.inputgenserv.com/installer_updates/001859/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
UDP:
- DNS ASK ts####.ws.symantec.com
- DNS ASK cr#.#hawte.com
- DNS ASK cr#.##modoca.com
- DNS ASK cr#.##ertrust.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK er####.inputgenserv.com
- DNS ASK up####.inputgenserv.com
- DNS ASK lo##.##putgenserv.com
- DNS ASK st###.#nputgenserv.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
