Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}' = '"%PROGRAMDATA%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{01db25f3-1b76-4d97-88c8-1c90634d88fb}' = '"%PROGRAMDATA%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x...
Creates or modifies the following files
- <SYSTEM32>\tasks\google update
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe
Modifies file system
Creates the following files
- %TEMP%\updinstaller.exe
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\license.rtf
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\logo.png
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.wxl
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\thm.xml
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\wixstdba.dll
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.be\vcredist_x86.exe
- %TEMP%\dd_vcredist_x86_20190930030146.log
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\license.rtf
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
- %TEMP%\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
- %TEMP%\vcredist2012.exe
- %WINDIR%\upr.exe
- %TEMP%\upr.zip
- %ProgramFiles(x86)%\softwareupdater\upd4tersrv.exe
- %ProgramFiles(x86)%\softwareupdater\appsupd4ter.exe
- %TEMP%\nsxd8b4.tmp\nsisunz.dll
- %TEMP%\update.zip
- %ProgramFiles(x86)%\softwareupdater\translations.xml
- %ProgramFiles(x86)%\softwareupdater\interop.shell32.dll
- %ProgramFiles(x86)%\softwareupdater\appsupd4ter.exe.config
- %ProgramFiles(x86)%\softwareupdater\config.xml
- %TEMP%\nsxd8b4.tmp\nsurl.dll
- %TEMP%\nsxd8b4.tmp\system.dll
- %TEMP%\nsxd8b4.tmp\nsexec.dll
- %TEMP%\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20190930030153.log
Network activity
TCP
HTTP GET requests
- http://up#.#pd4ter.com/update/version
- http://cd##.upsa1a.com/tgtudp.exe
- http://cd##.upsa1a.com/tdtjpd.exe
- http://up#.#pd4ter.com/software_stats/?ac########################################################################################################################################################...
- http://up#.#pd4ter.com/installer_stats/?ac#######################################################################################################################################################...
- http://up#.#pd4ter.com/update/update.zip
- http://up#.#pd4ter.com/update/upr.zip
- http://download.microsoft.com/download/1/6/B/16B06F60-3B20-4FF2-B699-5E9B7962F9AE/VSU_4/vcredist_x86.exe
UDP
- DNS ASK up#.#pd4ter.com
- DNS ASK cd##.upsa1a.com
- DNS ASK download.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\updinstaller.exe' /partner=UPDATER /prot=1
- '%TEMP%\vcredist2012.exe' /quiet
- '%TEMP%\vcredist2012.exe' /quiet -burn.unelevated BurnPipe.{B738BD0A-29E7-4BF6-94F0-7319AD194C70} {A87CA293-4338-43D5-90C2-B6C174B26094} 1684
- '%TEMP%\updinstaller.exe' /partner=UPDATER /prot=1' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_BIOS Get Version, SerialNumber /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_ComputerSystem Get Model, Manufacturer /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "Google Update" /F' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct Get displayName /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONSTART /DELAY 0030:00 /TR "%WINDIR%\upr.exe" /tn "Google Update" /rl HIGHEST' (with hidden window)
- '%TEMP%\vcredist2012.exe' /quiet' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_BIOS Get Version, SerialNumber /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\cimv2 PATH Win32_ComputerSystem Get Model, Manufacturer /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "Google Update" /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct Get displayName /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONSTART /DELAY 0030:00 /TR "%WINDIR%\upr.exe" /tn "Google Update" /rl HIGHEST
