Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'raadstu' = '%TEMP%\markssub\TARZ.vbs'
Malicious functions
Injects code into
the following user processes:
- tarz.exe
Patches code
in NTDLL dll
- hydhvv.exe process, ntdll.dll module
- tarz.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\markssub\tarz.exe
- %TEMP%\markssub\tarz.vbs
Network activity
Connects to
- 'drive.google.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dd##############
Other
- 'drive.google.com':443
UDP
- DNS ASK drive.google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\markssub\tarz.exe'
Restarts the analyzed sample
