Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\calc.exe
Modifies file system
Creates the following files
- %APPDATA%\chromesvc.vbe
- %APPDATA%\microsoft\pagefile.inf
- %APPDATA%\microsoft\recycler\desktop.ini
- %APPDATA%\microsoft\recycler\null.vbe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\empty.lnk
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\pagefile.inf
Deletes following files that it created itself
- %APPDATA%\chromesvc.vbe
Network activity
Connects to
- 'cl###.dnss.zzux.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?6b##############
Other
- 'cl###.dnss.zzux.com':443
UDP
- DNS ASK cl###.dnss.zzux.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\ChromeSvc.vbe"
Executes the following
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\ChromeSvc.vbe"' (with hidden window)
