Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Modifies file system
Creates the following files
- %TEMP%\uszorappczyl.xml
- %APPDATA%\google\chrome\updater.exe
Deletes the following files
- %TEMP%\uszorappczyl.xml
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /tn "GoogleUpdateTaskMachineQC" /xml "%TEMP%\uszorappczyl.xml"
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
