Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ChromeUpdateHelper' = '"%LOCALAPPDATA%\Google\Update\f2vtlok7\chromeupdatecore.exe" /boot'
Malicious functions
Intercepts control using hardware breakpoints
in NTDLL dll
- chrome.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromeupdatecore.exe
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chrome.dll
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chrome.exe
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromestabilitymonitor.exe
- %ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chrome_elf.dll
- %ProgramFiles(x86)%\google\update\install\f2vtlok7\googleupdateclient.exe
- %LOCALAPPDATA%\google\update\f2vtlok7\chromeupdatecore.exe
- %LOCALAPPDATA%\google\update\f2vtlok7\chrome_elf.dll
- %ProgramFiles(x86)%\google\update\install\f2vtlok7\chrome_elf.dll
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromeupdatecore.exe' /install2
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromestabilitymonitor.exe'
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chrome.exe'
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' -L
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' --query-gpu=name,driver_version --format=csv,noheader
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' --query-gpu=pci.bus_id --format=csv,noheader,nounits
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' --query-gpu=memory.total --format=csv,noheader,nounits
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\nvidia-smi.exe' --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits
Executes the following
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromeupdatecore.exe' /install2' (with hidden window)
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chromestabilitymonitor.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\chromium\update client\f2vtlok7\chrome.exe' ' (with hidden window)
