Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%ProgramFiles%\Google\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %ProgramFiles%\Google\Libs\WR64.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ProgramFiles%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_zpocetuh.g3d.ps1
- %WINDIR%\temp\__psscriptpolicytest_g0r21jsr.opy.psm1
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-55-622.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-55-863.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-55-957.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-124.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-155.dump
- %WINDIR%\temp\__psscriptpolicytest_xrw452pc.joj.ps1
- %WINDIR%\temp\__psscriptpolicytest_egpmv2hj.zyg.psm1
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-359.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-400.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-465.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-559.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-683.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-777.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-938.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-56-972.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-57-040.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-57-108.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-57-158.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-57-261.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-57-347.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-158.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-214.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-245.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-255.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-257.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-289.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-323.dump
- %WINDIR%\temp\content\4860-4192-powershell.exe-17-17-58-384.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_e0fqeuaq.uso.ps1
- %WINDIR%\temp\__psscriptpolicytest_nv3mviy3.euc.psm1
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-02-002.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-02-333.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-02-433.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-02-767.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-02-820.dump
- %WINDIR%\temp\__psscriptpolicytest_v4v2xodb.spb.ps1
- %WINDIR%\temp\__psscriptpolicytest_e3ip3ncx.eac.psm1
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-098.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-169.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-222.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-338.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-539.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-766.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-807.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-943.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-03-990.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-04-130.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-04-644.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-04-727.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-04-948.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-05-067.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-05-120.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-05-183.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-05-838.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-133.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-254.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-308.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-897.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-908.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-06-916.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-07-079.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-07-094.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-07-211.dump
- %WINDIR%\temp\content\3632-3764-powershell.exe-17-18-07-265.dump
- %WINDIR%\temp\cnepcxcxivjj.tmp
- %ProgramFiles%\google\libs\wr64.sys
Deletes the following files
- %WINDIR%\temp\cnepcxcxivjj.tmp
Substitutes the following files
- %WINDIR%\temp\cnepcxcxivjj.tmp
Network activity
Connects to
- 'po##.#ashvault.pro':443
TCP
Other
- 'po##.#ashvault.pro':443
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\google\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#ejlfkh#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles%...
Executes the following
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#ejlfkh#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles%...
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '%WINDIR%\explorer.exe'
