Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updateservice
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\msedge.exe
- nul
Network activity
Connects to
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
TCP
Other
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Creates and executes the following
- '%TEMP%\msedge.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /tn UpdateService /f
- '<SYSTEM32>\schtasks.exe' /delete /tn UpdateService /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc ONLOGON /tn UpdateService /tr \"%TEMP%\msedge.exe\" /ru %USERNAME%
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /tn UpdateService /tr \"%TEMP%\msedge.exe\" /ru user
