Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Extension_Service' = '"%APPDATA%\ServiceApp.exe" -b'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %APPDATA%\pzip.dll
- %APPDATA%\serviceapp.exe
Moves the following files
- from %ProgramFiles(x86)%\google\update\googleupdate.exe to %ProgramFiles(x86)%\google\update\googleupdate.exe_
- from %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdate.exe to %ProgramFiles(x86)%\google\update\1.3.26.9\googleupdate.exe_
- from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.exe_
Network activity
TCP
HTTP GET requests
- http://is##g.me/service.php
UDP
- DNS ASK google.com
- DNS ASK is##g.me
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- ClassName: 'AutoHotkey' WindowName: '%APPDATA%\ServiceApp.exe'
Creates and executes the following
- '%APPDATA%\serviceapp.exe' -b
- '%WINDIR%\syswow64\sc.exe' stop windefend' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete windefend' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop windefend
- '%WINDIR%\syswow64\sc.exe' delete windefend
