Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'gcupdaterv3.1.4.4ELLSD' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\google<File name>
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Network activity
Connects to
- 'up###########.s3-website-us-east-1.amazonaws.com':80
- 'my#####ast.blogspot.com':80
- 'localhost':80
TCP
HTTP GET requests
- http://up###########.s3-website-us-east-1.amazonaws.com/update.txt?BI###
- http://up###########.s3-website-us-east-1.amazonaws.com/update.txt?XU###
- http://my#####ast.blogspot.com/
UDP
- DNS ASK ve####alfly.info
- DNS ASK up###########.s3-website-us-east-1.amazonaws.com
- DNS ASK my#####ast.blogspot.com
Miscellaneous
Creates and executes the following
- '<Full path to file>' ' (with hidden window)
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /create /f /tn "Google<File name>" /ru user /sc minute /mo 1 /tr "\"<Full path to file>"\" /st 00:00:00
- '%WINDIR%\syswow64\cmd.exe' /k REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v gcupdaterv3.1.4.4ELLSD /t REG_SZ /d "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV4
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV4
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV3
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV3
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV2
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV2
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateDriverV1
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateDriverV1
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn DriverUpdaterV3
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn DriverUpdaterV3
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn updaterv10
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v gcupdaterv3.1.4.4ELLSD /t REG_SZ /d "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn updaterv10
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn updaterv9
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn updaterv8
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn updaterv8
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn updaterv7
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn updaterv7
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn updaterv6
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn updaterv6
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateTaskMachineUA
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateTaskMachineUA
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn GoogleUpdateTaskMachineCore
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\schtasks.exe /delete /f /tn GoogleUpdateTaskMachineCore
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "Google<File name>" /ru user /sc minute /mo 1 /tr "\"<Full path to file>"\" /st 00:00:00
- '%WINDIR%\syswow64\schtasks.exe' /delete /f /tn updaterv9
- '<SYSTEM32>\taskeng.exe' {9F12E17A-7705-449C-AF63-104A210DE9C3} S-1-5-21-3150914307-1777937420-491476919-1000:rphtqmpejiqh\user:Interactive:[1]
