Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /t /im chrome.exe
Modifies file system
Creates the following files
- nul
- %TEMP%\config_login_1790033601599472000\login data
- %TEMP%\config_login_1790033601599472000\login data-journal
- %TEMP%\etilqs_mfpj1gbxcjlhuel
- %TEMP%\etilqs_ae2w4rux5x980yr
- %TEMP%\config_history_1790033654379450700\history
- %TEMP%\config_history_1790033654379450700\history-journal
Deletes following files that it created itself
- %TEMP%\config_login_1790033601599472000\login data-journal
- %LOCALAPPDATA%\google\chrome\user data\devtoolsactiveport
- %TEMP%\config_history_1790033654379450700\history-journal
Network activity
Connects to
- 'ip##fo.io':443
- 'x1.#.lencr.org':80
- 'localhost':49696
- 'clients4.google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'localhost':49713
- 'clients2.google.com':443
- 'localhost':49719
- 'localhost':49725
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://12#.#.0.1:49696/json/version
- http://12#.#.0.1:49713/json/version
- http://12#.#.0.1:49719/json/version
- http://12#.#.0.1:49725/json/version
Other
- 'ip##fo.io':443
- 'localhost':49697
- 'clients2.google.com':443
- 'tr######e.googleapis.com':443
- 'google.com':443
- 'ss#.#static.com':443
- 'localhost':49714
- 'localhost':49720
- 'localhost':49726
UDP
- DNS ASK ip##fo.io
- DNS ASK x1.#.lencr.org
- DNS ASK google.com
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients3.google.com
- DNS ASK ss#.#static.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\vmci
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Vmmouse
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\VMware
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest' (with hidden window)
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\vmci' (with hidden window)
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\Vmmouse' (with hidden window)
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\VMware' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /t /im chrome.exe' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' "--user-data-dir=%LOCALAPPDATA%\Google\Chrome\User Data" --remote-debugging-port=0 --no-first-run --no-default-browser-check --headless=new --disable-gpu about:blank' (with hidden window)
