Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-4.job
- %WINDIR%\Tasks\490c4e0d-043b-471b-8c8f-cbda710e75bb.job
- %WINDIR%\Tasks\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-3.job
- %WINDIR%\Tasks\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-11.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /handoff "appguid={06f9c542-63ca-47a4-a81f-3b5e3594d3a6}&appname=c54635d3-1723-49ce-9c2b-def1661c9a58&needsadmin=True&lang=en" /installsource otherinstallcmd /sessionid "{89D4C02E-E030-4C8C-9644-A2A0E4AE468B}" /silent
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4OUQ0QzAyRS1FMDMwLTRDOEMtOTY0NC1BMkEwRTRBRTQ2OEJ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezc0OUYxQTM5LTExMEEtNEMwOS05MDlCLURGMDgzODI4NTFGMH0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI1LjEiIHNwPSJTZXJ2aWNlIFBhY2sgMiIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4yNS4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
- '%PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-4.exe' /installxpi /agentregpath='Sense' /extensionfilepath='%PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450.xpi' /appid=48292 /srcid='001404' /subid='0' /zdata='0' /bic=4742DE9F83FF4C558F340A12359A5690IE /verifier=1bc8d8d90bf07bca8a503539204dedf2 /installerversion=1_34_08_12 /installerfullversion=1.34.8.12 /installationtime=1410106239 /statsdomain=http://st###.##putdatacloud.com /errorsdomain=http://er####.#nputdatacloud.com /waitforbrowser=300 /extensionid=143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com /extensionversion=0.95 /prefsbranch=a143f44cfd99c4e458cd9ef929de77aa8bdbf60380097480c8d8efc48e28131a8com48292 /updateurl=https://w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/48292.rdf /extensionname='Sense' /extensiondesc='.' /publishername='Object Browser' /defbro=ie /sid=S-1-5-21-2052111302-484763869-725345543-1003 /addinfojson='{"asw":[0, 0, 0],"browser_name":"__BROWSER_NAME__"}' /allusers /allprofiles /checkfflist /autoupdateulr='http://up####.#nputdatacloud.com/ff_agent_updates/{CAMP_ID}/update.json' /showthankyoupage /runfrom='installer' /externallog='%TEMP%\SenseInstaller_1410106239.log'
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /svc
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regserver
- '%TEMP%\comh.426900\GoogleUpdate.exe' /silent /install "appguid={06f9c542-63ca-47a4-a81f-3b5e3594d3a6}&appname=c54635d3-1723-49ce-9c2b-def1661c9a58&needsadmin=True&lang=en"
- '%TEMP%\nsz2.tmp\Nudof.exe'
- '%PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-11.exe' /rawdata=GcweW2tXwSZz9Xm686hlwVZWvWoShZ1NMfi18buPaaNKv19wRdZg+G5p3sgU0AM6htR05zf+3GZGHkka/N7823pbpb2g8fQhIC/Rn5XR8vlZbb9EuRkPFGQZy+I4h/Dd/XyGVERWOHbWAmNH3mA2R6VD94x0X6OL3mD8guhQqltHP1zvybTIKPkPotTH3cHdVlsBAqNfApMWqpGPlLYbL64MRCHZaSOiOsP5RAI9OIXyYjUjb7wLdssaI4va5zUPV2K83k/Coet/Bc3YzHcQvQp1oV9Kc7xTpf6idORlox3coX6pQn7pAz67TtLYR0ANGIBqA8npx7/Vy7XT2L+HhnwGhx6oHBAIrIhsh8L+aOHN33SFBvljHXzc4irvjGPfdmgPzzFt6WXbtCWbbgsIEC0AdldztdndvXXyaUVSYVlWIpXMNpSeorwDox+etq2qRsRcHv2kBirvk85QGwQpjebTYOugLZSq2uTX6TlhLdFeUu8bOec8HgW6I/huzrxmmQagsNHtQbyc50tOsnEUyp1bVLP84yhqDyDBvhhpZvS0cHSfXz/Cw6FUCATcKjMz2zBzyNWbG1OnZC5iIGQMwgNl47wrXtI3cY+43grm8LytAKKb0u1oN4T3BLAHklwCWLiFeIhDXNfnOtvNmW4EKaDsuPW1mHplVJzRX4rVUm9wCkPoOpgFvZta2FFIxx/biAFrJMNqamh7e0VFKlifdsaJO2zg6R675W7srV64ILoyxt8GSDPvxp5eU6rT2d85BYmS4GgjAG68y6CiJ3l3wsIEmSAVaRpU/KH7sk+ykat/wX3medl1vdCJQjRuWAE701TN3I9pi5X2+/uKJ6LdqcdONGNv4QbXMCAXhbj/pOXnUwCD8VLdvgTMxbS0sgHyWKozwaux9kP4d9HIt187Aoqi3iUzrDiXMID8PmJNFlRQlQActjtroTXHrQiYVllkXS1CuPNK6CC+fDKi2PW2UA1WmcS0Oj7OAtoHbFXVLLlv9fY4yDbxzW1VhJXX7AeJmtd73561HR0KH93+TW4pi65KEwzuc5jJ6CrjeWEtSqlaoc1ZOs/B4VrtSjnQknT+I5zXbSGDGiGFqI+zSIiDUOoTDXBfOYRccKCmeT1KRN3nA/Id0n1Bnrwq6sYO/3B+a4AhASIlFx8Z2DvfCVw7RdRxJBtElAT0XM6d45EeW4Mq//I7cKKTYlNvuU6DWYW636HWO6J0QhEOK+Uc76HEqn8H39a+PJfF1BuGgz07TUNmsaM2HEv3nUpCgGNa8V6YsU3Qf/rl7qD31zsT9T2QdStBXOfhfONCUwUK3Y9GzLgFc5XBPVIGedF5hh3O3EtP40ll4oeaE8QyWavvn5sA1U8OvYyRi5+LDZm/Y3FFg55EZb3bzEHF42BmG6hWoZCHTmFiRD0HB519pDu5vLNy8O9m78Yx01KlJFJ1SYrpHKWUzWjROh/Z2bHlfoacfiDffPj0UCCF1X6iFWiJqUyZqLPc48cYJfi1db1PEc/S8m61FgNymvqFeqxfinstWpP7drNGo/7zyF+43ccznomebWHF5viRKrBCWhHxxHrZykiuiIkrelE1SpqOiFknXhzNS+34VLgS1m2yuqwCc2WoEG7Num+0gkKgynwbRynvKXb2JGpvVAJstFEAHkmQpY5G9lazbLZHuKbwFBmgQUBbwwzdQpprSjgmY+ykG1Lnr36K/cokCxSFzNpQSNhnJkyHs5F6ujG3UXow2GbTA1jwlNbXCwnxeYEso53i49XeBCQ1Ql1p2gO4w1JtpKyPHbBGuLj2SFmW2eGnXHIRcbJxfuOGyu2u4Qt9B0OHpp4DFJQAcBElL9bwSXXd/dKcHWx0hg+gLQWlLTpJysv1ILOsZ1ChSKJPh8PmeSlV62S8ZYjgE82HKQ8ns3QBvScFt4G6Ru/6+IHO9a6YMO7RwWkhh/VaSBLuopfyQpRunh3sXYhb1QJkqd1UJPGUrPPZl+jBTru9XW8hhXJ+4uvtk5JpzlfEi+ze7UHj/kUfo4ii+uEpIqoI8MqtQSwf2RbNQknA
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Terminates or attempts to terminate
the following user processes:
- opera.exe
- firefox.exe
- iexplore.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %WINDIR%\Installer\416e0.msi
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450.xpi
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450_.xpi
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-11.exe
- %TEMP%\nsc5.tmp\ExecDos.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\Sense\1e8f6098-2eb1-4b26-a4ea-8cf2f8a11223.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\Cab8.tmp
- %TEMP%\CabA.tmp
- %WINDIR%\Installer\MSIC.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\226.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\192.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\268.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\180.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\28.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\221.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\230.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\244.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\211.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\123.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\locale\en-US\translations.dtd
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-4.exe
- C:\Config.Msi\416e3.rbs
- %TEMP%\MSI421bd.LOG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\manifest.xml
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins\183.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\extensionData\plugins.json
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\defaults\preferences\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\143f44cf-d99c-4e45-8cd9-ef929de77aa8@bdbf6038-0097-480c-8d8e-fc48e28131a8.com\chrome.manifest
- %PROGRAM_FILES%\Sense\1293297481.mxaddon
- %TEMP%\nsc5.tmp\inetc.dll
- %TEMP%\nsc5.tmp\update.json
- %TEMP%\nsc5.tmp\md5dll.dll
- %TEMP%\nsc5.tmp\UserInfo.dll
- %TEMP%\nsc5.tmp\nsisos.dll
- %TEMP%\nsc5.tmp\326465
- %PROGRAM_FILES%\Sense\Uninstall.exe
- %TEMP%\nsc5.tmp\418965
- %PROGRAM_FILES%\Sense\utils.exe
- %TEMP%\nsz2.tmp\Nudof.exe
- %TEMP%\nsz2.tmp\StdUtils.dll
- %TEMP%\nsz2.tmp\WrapperUtils.dll
- %TEMP%\nsz2.tmp\System.dll
- %TEMP%\nsz2.tmp\Tqvsz.tmp
- %TEMP%\nsc5.tmp\InstallerUtils.dll
- %TEMP%\nsc5.tmp\InstallerUtils2.dll
- %TEMP%\nsc5.tmp\System.dll
- %TEMP%\nsr4.tmp
- %TEMP%\nsc5.tmp\StdUtils.dll
- %TEMP%\comh.426900\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\Sense\b76c60e9-13a8-43f2-ac06-7584bffcba5f.crx
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\Sense\04e3669d-0cf6-4ff1-af4b-e1d570d9f450-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab6.tmp
- %TEMP%\comh.426900\GoogleUpdateOnDemand.exe
- %TEMP%\comh.426900\goopdate.dll
- %TEMP%\comh.426900\GoogleUpdateHelper.msi
- %TEMP%\comh.426900\GoogleUpdate.exe
- %TEMP%\comh.426900\GoogleUpdateBroker.exe
- %TEMP%\comh.426900\psuser.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.426900\psmachine.dll
- %TEMP%\comh.426900\goopdateres_en.dll
- %TEMP%\comh.426900\npGoogleUpdate4.dll
Deletes the following files:
- C:\Config.Msi\416e3.rbs
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\416e2.ipi
- %WINDIR%\Installer\416e0.msi
- %TEMP%\Cab6.tmp
- %TEMP%\nsc5.tmp\326465
- %TEMP%\CabA.tmp
- %TEMP%\Cab8.tmp
Network activity:
Connects to:
- 'ts####.ws.symantec.com':80
- 'cr#.#hawte.com':80
- 'localhost':1046
- 'localhost':1045
- 'www.download.windowsupdate.com':80
- 'er####.#nputdatacloud.com':80
- 'up####.#nputdatacloud.com':80
- 'lo##.##putdatacloud.com':80
- 'st###.##putdatacloud.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nputdatacloud.com/omaha/430FD4D0-B729-4F61-AA34-91526481799D/1/ping.xml?ra########
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- er####.#nputdatacloud.com/installer-error.gif?ac########################################################################################################################################################################################################################################################################################################################################################################################################
- up####.#nputdatacloud.com/installer_updates/001404/update.json
- lo##.##putdatacloud.com/monetization.gif?ev######################################################################################################################################################################################################################################################################
- st###.##putdatacloud.com/installer.gif?ac####################################################################################################################################################################################################################################################################################################################################################################################################################################
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##putdatacloud.com
- DNS ASK up####.#nputdatacloud.com
- DNS ASK er####.#nputdatacloud.com
- DNS ASK st###.##putdatacloud.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
