Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\a227b0a3-9ea4-47a0-b119-28dcfec616b7-4.job
- %WINDIR%\Tasks\a227b0a3-9ea4-47a0-b119-28dcfec616b7-11.job
- %WINDIR%\Tasks\a227b0a3-9ea4-47a0-b119-28dcfec616b7-3.job
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\SmartSaver+ 15\a227b0a3-9ea4-47a0-b119-28dcfec616b7-11.exe' /nRtLDdX=JH8FSNoXW7ERBu8FrFaTRMinG/g79GxCQ7Oaey/+VIOIPjna8+wkTqisT0bXJaqlt2SlBEPaVWW1FLWUHAJ+M/ug5AjRSlzkptMw7bPWmsvsARJsgjaQZrVhtAs7suNbTHYiRDkjnzlVO/TwoWANSSPB/AjT98aPKsjF3ysdbTixpzcyyy61SdtPgN9ZWOsLXI+Biipc6hvwxiXZgzYhy9gWPi7Jaip3UW3PT29WN91w78RKbWgj0GoUVGqO+c7cwsh/U4UCowLI8ZM/jA/RqgQsDTpsZvYhNWA1JFaWTAlFGcLzWjcvAs1Z/wSnZoD72hRrMsPiCUfiygAR1/Kx53IK1qkmp9h3dhIuJkQRWpbq9iUwinzAOR4SUUX83RVl0LABPcgf48LjqYnZs5eNPw1Q1bn0J6GtRWFvNKJBgAhJW7Z/pakqmYSMHt8bjXvq50nyIdJaKJ8nHRzW+u6kAXiKxx6Dc/eDVUUPEvYZGjvHcEvNg9g3nzjKbqcD6VD/b3ALNv1C4ZUxVgLT1UQVcvCjH6Oy3nvhXG7hgwQ9d+l1JmrJJPbus/X+vs1Xo4sSsE1ePZB+msNwMT1xHOLWLeyK/SlP1+KJ0YWQf1baYwSh7kNf9PosJVutB8WMruA69uAWTvmGyT7hm6i6ErhpMxZjdWaI4WIy2JvVOud8TSRZFoUXkL1d+eJgTnkCL1yJFXOe9rqDUGYWHvHJJhHIVY3Xz5NJcAOLWZ6A670mL27JSE4AMf5LYt4K9ckbLbc3Zn1+e+IekO+K87TS5CavC5LbKNQrgXMGka6CtQ+UQI/gaTCQbB2nfCkCVABM7AhXrEYQKEJPxOqCy9kh8S7RkL4gtdnRjJiW/vxHYjceUJHfTI1J4rBolhq8M5B88bS8wS1DsEHFkM59Q+1X2UFPh31Yet56kOWmUZBbILkWLaHXP+63Xg7IGS55gy0fmJC1jTyQkx2EofaVCcBO+mKVYLyYaE99mIgwo//leiRYYd8MrGkzp96LLOVJdDOk/2Map637Sd8fzud73RpPN3MmZD/sD0KsKyTuM7MmI8AgQcaT62sreFnWWqlO6jYNTst0rXyC6ikTEYivG5XBQ+5dgyxyUafj7JpEmtKg6NPj4633vomionEXy6v2AIdrmIPEK10S71l9iR+P5K3vpq4g06efh4kSfFEmlJVxviJzS49qj/H8/OCHxaRBj9tkYjxrZP3+RrwM3K68cr+8CwQV4a5rHfM/LmcOmKvM7o+kzuIIvq7n5UFlXVRKkqdRVLu9OXI5YhBu17Lxo63UkIGoZkHmZhtkJWSdAdGTTOssa8UdU9tZJmNeJXqChC1gL8Uc0WBl65nX1tSzaxDl/z2GEcJNS0PKyyzlzmW68jUqnRn5HXYtS4L/z71nX847xYU9BVZ5lD9IWzSVI9gjkVCfk1mlMC0ZDr3DSacBe643UozYBFV1RMBP6L5FRiQrjDqyGtOVgoaEh3e7ZA4LjzkW7inIeV0dmOEHD84Z2KcKlvJ67+GPeMstxLvJ6Q43UWkdSbJqFZLk+SPlAARp/djtrVyblxi+cEBL2rty2TIz9098ABoEjgSfgggCZjmVfPoezG5HuQgnpKuQN82PNWuRZZ31px13OQYVFyM4XX13TxRrPsHitJ6N0mZxxqKVGKV97BL6+tH1/fGtOhTgi5gQ4jL0Lv7sqKbW+HmeiMWOpbg=
- '%PROGRAM_FILES%\SmartSaver+ 15\a227b0a3-9ea4-47a0-b119-28dcfec616b7-3.exe' /nRtLDdX=SQokcbpzfhH3TBInpyrUemxaZzxSDdKavpAMUcPZnFPndNWaWBOZcrPZohfB0beHONETbZWFpgAw++lV3tLJHOdLT59Huchzw2MJB2tp7mcIM1cpv/S6LpamsN5vmL4+T8Enf1g21p+ZPI27qFIcDKJWXxNmllvbJ8f+B4D2SxGXq8vfOPd7R1mYU1dCRLVytvrd1uXoK+fZqD4R4hUgKDdok4fbekvnpuboGMY56KQR6FQY9Gp3hJzURpUA9AJ9BEBoBkTa//jX+ZNwF/vR4aMU+nW5/W6qHrBXqYANBOUOkALkMLS5RlTSjsAOJ9/lZyjm9oorC2gtK+NHKLE/aAnxpNa7QwnMFagfHqHNHjcVeEdG0rDfSlCHdvvtoCX7pqWVLClp0BAJEPeo24ImbTwOwwEPZFq5307vjcj3sRVrRQsJl/oZ/LvzSRqaQbhaAU/tZSzj9hg39N0yB1rT7+4EqmYhnJJJ9mT+W6gY8KRe68zOtu/kz+ZS6pjCnIh0sMMq3ZOxh1Rve/qKYBC7Or33J5IR1VMQoRS37vv9TeCKZZz4g257puAOByzB9kaR56K/wUTmNaoV8bWnLpKX7DmYrfj4VthuLzhwt3D/1XkCal+0IbHXZuv1sYrjqh20kNaC+0STuLm/38QM0ZtKmgvHeCAkAUfyso4zBUXLuQBgi02o38B+VIE6RxfaA4TYs2g3Of9H5YX2hZbyQl1l6qW9jHVLpNg+b0VjFIQfs0pbsXXeTiH/2XR7/gVUVk7HIh7U6giyiv9ppUqU8SHvp3IEE3TE0URQFyR8bNeCkc9NKLc1arc7oFRs+iGl9W+RQYMYkdRVsxwe8Ubikj93nhEx0gnhhStgtHNOganYf1v4IP12XiZUKBshIz7r02ASdtvyTnCMdLcBGn8G1KEr1XJTvkTW0MbKVWmfKvsLmYx0Fr8z5+eCze1ogLKldgBRcNODvimMYWuA1Bqxg/4GYgOy5JnwzoC9IxT/MimDhk1IwLM4x8W2vbHoYs+W56UnqCjrenJV0NfvJin7wnfNJhsX3MoyspCMBpV28JqPD9EWdlRqNrQFU3GNMZGexpPLD3KxCCtT7XcnRSavWORQW8ImiJ2W5R3CsnCyYi0kFoLlUduMsWf4S3HSDRxzpATYtpv4dgo8f+Ne2AXvFUpwShHxUfqehkfAp6VfodUHtE8VcjR74oUMozkkWGqjD3ewTGdit/gS2BP0VzAVcCaE6S5sR2vwaBjjkOxpd8BVhmucqjBWv4r8xc8m7iPLNpax63WPRauhvpMABSaC8sHVd754G4mAChnmsd92F6HXG72S1RIFxrYiQME11194Yb3Zn9TgJ24dzI3gXbJTvqIMQQ==
- '%TEMP%\comh.212383\GoogleUpdate.exe' /silent /install "appguid={e4ba14c4-b45e-4b50-acd0-fb0c26ec85a5}&appname=e4d2aea5-cea8-48ce-8aa4-e3a4ea76e1cd&needsadmin=True&lang=en"
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\SmartSaver+ 15\a227b0a3-9ea4-47a0-b119-28dcfec616b7-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsk3.tmp\ExecDos.dll
- %TEMP%\Cab4.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\comh.212383\psuser.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\SmartSaver+ 15\48928.crx
- %PROGRAM_FILES%\SmartSaver+ 15\a227b0a3-9ea4-47a0-b119-28dcfec616b7-11.exe
- %TEMP%\Cab6.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\SmartSaver+ 15\360-48928.crx
- %PROGRAM_FILES%\SmartSaver+ 15\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\SmartSaver+ 15\a227b0a3-9ea4-47a0-b119-28dcfec616b7.crx
- %TEMP%\nsk3.tmp\inetc.dll
- %TEMP%\nsk3.tmp\UserInfo.dll
- %TEMP%\nsk3.tmp\md5dll.dll
- %PROGRAM_FILES%\SmartSaver+ 15\utils.exe
- %TEMP%\nsk3.tmp\update.json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\nsk3.tmp\StdUtils.dll
- %TEMP%\nse2.tmp
- %TEMP%\nsk3.tmp\nsisos.dll
- %TEMP%\nsk3.tmp\InstallerUtils2.dll
- %TEMP%\nsk3.tmp\InstallerUtils.dll
- %TEMP%\comh.212383\goopdate.dll
- %TEMP%\comh.212383\GoogleUpdateOnDemand.exe
- %TEMP%\comh.212383\GoogleUpdateHelper.msi
- %TEMP%\comh.212383\psmachine.dll
- %TEMP%\comh.212383\npGoogleUpdate4.dll
- %TEMP%\comh.212383\goopdateres_en.dll
- %PROGRAM_FILES%\SmartSaver+ 15\Uninstall.exe
- %TEMP%\nsk3.tmp\484768
- %TEMP%\nsk3.tmp\453148
- %TEMP%\comh.212383\GoogleUpdateBroker.exe
- %TEMP%\comh.212383\GoogleUpdate.exe
- %TEMP%\comh.212383\GoogleCrashHandler.exe
Deletes the following files:
- %TEMP%\Cab6.tmp
- %TEMP%\Cab8.tmp
- %TEMP%\nsk3.tmp\484768
- %TEMP%\Cab4.tmp
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.#emogensrv.com':80
- 'up####.demogensrv.com':80
- 'er####.demogensrv.com':80
- 'st###.#emogensrv.com':80
TCP:
HTTP GET requests:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.demogensrv.com/installer_updates/001585/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.#emogensrv.com
- DNS ASK up####.demogensrv.com
- DNS ASK er####.demogensrv.com
- DNS ASK st###.#emogensrv.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'