Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftUSBMonitor' = '%LOCALAPPDATA%\AppData\iusb3mon.exe'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftUSBMonitor' = '%LOCALAPPDATA%\AppData\iusb3mon.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\googlesystem\googleupdater\googleupdatertasksystem144.0.7547.0{2d3232cd-ad22-4992-a5e9-79ef5c323278}
- <SYSTEM32>\tasks\mytaskname
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService144.0.7547.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService144.0.7547.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service -...
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService144.0.7547.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService144.0.7547.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service...
Creates the following services
- 'GoogleUpdaterInternalService144.0.7547.0' %ProgramFiles(x86)%\Google\GoogleUpdaterd.0.7547.0�pdater.exe" --system --windows-service --service=update-interna
- 'GoogleUpdaterService144.0.7547.0' %ProgramFiles(x86)%\Google\GoogleUpdaterd.0.7547.0�pdater.exe" --system --windows-service --service=updat
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppData\iusb3mon.exe' -Force"
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.3.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irimg1.bmp
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- nul
- %LOCALAPPDATA%\appdata\iusb3mon.exe
- %LOCALAPPDATA%\local\ziliao.jpg
- %ProgramFiles%\your product\В№ГЁВёГЁ.exe
- %ProgramFiles(x86)%\google\googleupdater\updater.log
- %TEMP%\google4820_410603476\updater.packed.7z
- %TEMP%\google4820_1518449964\updater.7z
- %TEMP%\google4820_1518449964\bin\uninstall.cmd
- %TEMP%\google4820_1518449964\bin\updater.exe
- %ProgramFiles(x86)%\google\googleupdater\updater_history.jsonl
- %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\crashpad\settings.dat
- %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\uninstall.cmd
- %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\updater.exe
- %ProgramFiles(x86)%\google\googleupdater\8f03b08d-3823-43d2-a17a-5998483177a5.tmp
- %ProgramFiles(x86)%\google\update\googleupdate.exe
- %ProgramFiles(x86)%\google\googleupdater\398a4e6b-3f64-4a1a-b423-009596daf2ff.tmp
- %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\09567cab-4f48-4832-8c81-0910222787ec.tmp
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- %TEMP%\886453_task.xml
- %ProgramFiles(x86)%\updater_chrome_url_fetcher_4420_1660287950\eb472dd72adb274a8c7ee32e9cdf44a84063bad07ec9403bcaa2c822411a08c3
- %ProgramFiles(x86)%\google\googleupdater\578fbc76-430b-403d-9ebf-5db60535e03b.tmp
- %ProgramFiles(x86)%\google\googleupdater\crx_cache\5e2f9008-272f-4625-a555-34ba858f3d5b.tmp
- %APPDATA%\5d284ad3271b51c62735fa5a50037d6f.data
- %TEMP%\sedebugprivilege.inf
- %TEMP%\sedebugprivilege.log
- %TEMP%\sedebugprivilege.jfm
- %TEMP%\sedebugprivilege.sdb
- %ProgramFiles(x86)%\updater_chrome_url_fetcher_4420_1660287950\decoded_xz
Deletes following files that it created itself
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irimg1.bmp
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.3.dll
- %TEMP%\google4820_1518449964\updater.7z
- %TEMP%\google4820_1518449964\bin\uninstall.cmd
- %TEMP%\google4820_1518449964\bin\updater.exe
- %TEMP%\886453_task.xml
- %TEMP%\sedebugprivilege.inf
- %ProgramFiles(x86)%\updater_chrome_url_fetcher_4420_1660287950\eb472dd72adb274a8c7ee32e9cdf44a84063bad07ec9403bcaa2c822411a08c3
Moves the following system files
- from %WINDIR%\security\database\edb.log to %WINDIR%\security\database\edb00001.log
Moves the following files
- from %ProgramFiles(x86)%\google\googleupdater\8f03b08d-3823-43d2-a17a-5998483177a5.tmp to %ProgramFiles(x86)%\google\googleupdater\prefs.json
- from %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\09567cab-4f48-4832-8c81-0910222787ec.tmp to %ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\prefs.json
- from %ProgramFiles(x86)%\google\googleupdater\crx_cache\5e2f9008-272f-4625-a555-34ba858f3d5b.tmp to %ProgramFiles(x86)%\google\googleupdater\crx_cache\metadata.json
- from %ProgramFiles(x86)%\updater_chrome_url_fetcher_4420_1660287950\decoded_xz to %ProgramFiles(x86)%\google\googleupdater\crx_cache\6b04de234a31f137f09ae3717922a89239f989f3667ae958f3928a9811c13da4
Network activity
Connects to
- 'yy##dymo.me':25448
- 'up####.googleapis.com':443
- 'ed####.me.gvt1.com':80
- 'dl.google.com':443
TCP
HTTP GET requests
- http://ed####.me.gvt1.com/edgedl/diffgen-puffin/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D/eb472dd72adb274a8c7ee32e9cdf44a84063bad07ec9403bcaa2c822411a08c3
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95##############
Other
- 'up####.googleapis.com':443
- 'dl.google.com':443
- 'yy##dymo.me':25448
UDP
- DNS ASK yy##dymo.me
- DNS ASK up####.googleapis.com
- DNS ASK dl.google.com
- DNS ASK ed####.me.gvt1.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Q360SafeMonClass' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:5226434 "__IRAFN:<Full path to file>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4226853953-3309226944-3078887307-1000"
- '%LOCALAPPDATA%\appdata\iusb3mon.exe'
- '%ProgramFiles%\your product\В№ГЁВёГЁ.exe'
- '%ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\updater.exe' --system --windows-service --service=update-internal
- '%ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\updater.exe' --crash-handler --system "--database=%ProgramFiles(x86)%\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0...
- '%ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\updater.exe' --system --windows-service --service=update
- '%ProgramFiles(x86)%\google\googleupdater\144.0.7547.0\updater.exe' --unzip-worker --system --mojo-platform-channel-handle=1868
Executes the following
- '<SYSTEM32>\cmd.exe' /c net session >nul 2>&1
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq 360tray.exe" 2>nul | find /I "360tray.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq 360tray.exe"
- '<SYSTEM32>\find.exe' /I "360tray.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq QQPCTray.exe" 2>nul | find /I "QQPCTray.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq QQPCTray.exe"
- '<SYSTEM32>\find.exe' /I "QQPCTray.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq QQPCRTP.exe" 2>nul | find /I "QQPCRTP.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq QQPCRTP.exe"
- '<SYSTEM32>\find.exe' /I "QQPCRTP.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq Huorong.exe" 2>nul | find /I "Huorong.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Huorong.exe"
- '<SYSTEM32>\find.exe' /I "Huorong.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsMain.exe" 2>nul | find /I "HipsMain.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq HipsMain.exe"
- '<SYSTEM32>\find.exe' /I "HipsMain.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsDaemon.exe" 2>nul | find /I "HipsDaemon.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq HipsDaemon.exe"
- '<SYSTEM32>\find.exe' /I "HipsDaemon.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsTray.exe" 2>nul | find /I "HipsTray.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq HipsTray.exe"
- '<SYSTEM32>\find.exe' /I "HipsTray.exe"
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsLog.exe" 2>nul | find /I "HipsLog.exe" >nul
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq HipsLog.exe"
- '<SYSTEM32>\find.exe' /I "HipsLog.exe"
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppData\iusb3mon.exe' -Force" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c timeout /t 2 /nobreak >nul
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUA...
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /tn "MyTaskName" /xml "%TEMP%\886453_task.xml" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MyTaskName" /xml "%TEMP%\886453_task.xml" /f
- '%WINDIR%\syswow64\secedit.exe' /configure /db %TEMP%\SeDebugPrivilege.sdb /cfg %TEMP%\SeDebugPrivilege.inf /overwrite /log %TEMP%\SeDebugPrivilege.log /quiet
- '<SYSTEM32>\cmd.exe' /c net session >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq 360tray.exe" 2>nul | find /I "360tray.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq QQPCTray.exe" 2>nul | find /I "QQPCTray.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq QQPCRTP.exe" 2>nul | find /I "QQPCRTP.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq Huorong.exe" 2>nul | find /I "Huorong.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsMain.exe" 2>nul | find /I "HipsMain.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsDaemon.exe" 2>nul | find /I "HipsDaemon.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsTray.exe" 2>nul | find /I "HipsTray.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /FI "IMAGENAME eq HipsLog.exe" 2>nul | find /I "HipsLog.exe" >nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\AppData\iusb3mon.exe' -Force" >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 2 /nobreak >nul' (with hidden window)
- '%LOCALAPPDATA%\appdata\iusb3mon.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUA...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /tn "MyTaskName" /xml "%TEMP%\886453_task.xml" /f' (with hidden window)
