Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_buugxp4w.rbe.ps1
- %WINDIR%\temp\__psscriptpolicytest_0r3fvf2o.top.psm1
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-064.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-264.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-334.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-465.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-496.dump
- %WINDIR%\temp\__psscriptpolicytest_4expozgd.yo4.ps1
- %WINDIR%\temp\__psscriptpolicytest_lht4qfoc.tzm.psm1
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-621.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-635.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-682.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-766.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-851.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-19-920.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-021.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-052.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-083.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-105.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-136.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-168.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-183.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-527.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-573.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-596.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-643.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-658.dump
- %WINDIR%\temp\content\3968-1756-powershell.exe-14-13-20-712.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_h1t455gd.1tp.ps1
- %WINDIR%\temp\__psscriptpolicytest_1butexpw.4bi.psm1
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-23-342.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-23-741.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-23-804.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-039.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-151.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-258.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-303.dump
- %WINDIR%\temp\__psscriptpolicytest_tw0amaez.4jp.ps1
- %WINDIR%\temp\__psscriptpolicytest_fcgwphmw.nu0.psm1
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-621.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-661.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-852.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-24-976.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-009.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-056.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-087.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-125.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-388.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-442.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-558.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-611.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-643.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-25-674.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-003.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-153.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-257.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-309.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-642.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-658.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-673.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-758.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-774.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-843.dump
- %WINDIR%\temp\content\3884-2368-powershell.exe-14-13-26-881.dump
- %WINDIR%\temp\e10.tmp
- %ProgramFiles%\google\libs\wr64.sys
- %ProgramFiles%\google\libs\g.log
- %WINDIR%\temp\145b.tmp
Сетевая активность
UDP
- DNS ASK xm#####.nanopool.org
- DNS ASK pa###bin.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#rinqwltqb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtask...
- '%ProgramFiles%\google\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System....
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentContr...
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System....
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\schtasks.exe' /run /tn GoogleUpdateTaskMachineQC
- '<SYSTEM32>\cmd.exe' /c mkdir "%ProgramFiles%\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "%ProgramFiles%\Google\Libs\g.log"
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Name, VideoProcessor
