Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '*ChromeUpdate' = 'rundll32.exe %HOMEPATH%\Documents\ChromeData.dll,EntryPoint'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\regsvr32.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\chromedata.dll
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe'
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe %HOMEPATH%\Documents\ChromeData.dll",EntryPoint /f & exit
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe %HOMEPATH%\Documents\ChromeData.dll",EntryPoint /f
