Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\ConsumerInputUpdateTaskMachineUA.job
- %WINDIR%\Tasks\ConsumerInputUpdateTaskMachineCore.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\consumerinput_update] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMTMxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0UwRjI5RjMwLUQ0MTYtNENCNS1BNTFBLUQ4RDFGNTYwRTZCNX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QjFDRTA5NTUtMjhBOS00RUY3LUExNzAtMkJGNEQyNTMzQTg4fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMSIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7Q0M1NEM4OTItODJEQy00RDk1LUFDREUtOEM4NEVGNzFDMkNFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjI1LjEzMSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0icG9wcHl8UE9QNzMzNTc3QjcyM0UzNEUzN0I2MkJFMDY0NDA0RUEwNER8ezYzMEU4RjhGLTYxQUQtNERDNi1CMzg5LUMxNTE4MTdGQzg4NH0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /regserver
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /handoff "bundlename=Consumer Input&appguid={49C47E46-0DD3-4BCD-AF91-A14C104BD9DE}&appname=Consumer Input Chrome Extension&needsadmin=True&lang=en&appguid={C7B061F6-380E-4545-86E3-400E3156FD28}&appname=Consumer Input Firefox Extension&needsadmin=True&lang=en&appguid={1138A907-2253-45D6-99C1-843A0AC58730}&appname=Consumer Input Internet Explorer Extension&needsadmin=True&lang=en&appguid={B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}&appname=Consumer Input Monitoring Tool&needsadmin=True&lang=en&client=poppy|POP733577B723E34E37B62BE064404EA04D|{630E8F8F-61AD-4DC6-B389-C151817FC884}" /installsource otherinstallcmd /sessionid "{E0F29F30-D416-4CB5-A51A-D8D1F560E6B5}" /silent
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMTMxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0UwRjI5RjMwLUQ0MTYtNENCNS1BNTFBLUQ4RDFGNTYwRTZCNX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7M0YwQkYwRjQtNDMzRi00Mjg5LUE2NEMtOEQ2OTk0QjEzQjhBfSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMSIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7NDlDNDdFNDYtMEREMy00QkNELUFGOTEtQTE0QzEwNEJEOURFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSJwb3BweXxQT1A3MzM1NzdCNzIzRTM0RTM3QjYyQkUwNjQ0MDRFQTA0RHx7NjMwRThGOEYtNjFBRC00REM2LUIzODktQzE1MTgxN0ZDODg0fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4OTQiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntDN0IwNjFGNi0zODBFLTQ1NDUtODZFMy00MDBFMzE1NkZEMjh9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9InBvcHB5fFBPUDczMzU3N0I3MjNFMzRFMzdCNjJCRTA2NDQwNEVBMDREfHs2MzBFOEY4Ri02MUFELTREQzYtQjM4OS1DMTUxODE3RkM4ODR9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg5NCIgZXh0cmFjb2RlMT0iMjY4NDM1NDU5Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezExMzhBOTA3LTIyNTMtNDVENi05OUMxLTg0M0EwQUM1ODczMH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0icG9wcHl8UE9QNzMzNTc3QjcyM0UzNEUzN0I2MkJFMDY0NDA0RUEwNER8ezYzMEU4RjhGLTYxQUQtNERDNi1CMzg5LUMxNTE4MTdGQzg4NH0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODk0IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiLz48L2FwcD48YXBwIGFwcGlkPSJ7QjNGODBEQjgtOTUxRi00QTJBLUJFMkYtRUQ2RjRGRjYzQjk4fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSJwb3BweXxQT1A3MzM1NzdCNzIzRTM0RTM3QjYyQkUwNjQ0MDRFQTA0RHx7NjMwRThGOEYtNjFBRC00REM2LUIzODktQzE1MTgxN0ZDODg0fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4OTQiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD4
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /svc
- '%PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe' /regsvc
- '%TEMP%\nso4615.tmp\cookie-retriever.exe' http://co####erinput.com -r panelid
- '%TEMP%\nso4615.tmp\cookie-retriever.exe' http://co####erinput.com -r panelistid
- '%TEMP%\nso4615.tmp\cookie-retriever.exe' http://co####erinput.com -r dcaPrefs
- '%TEMP%\GUMAAEE.tmp\ConsumerInputUpdate.exe' /install "bundlename=Consumer Input&appguid={49C47E46-0DD3-4BCD-AF91-A14C104BD9DE}&appname=Consumer Input Chrome Extension&needsadmin=True&lang=en&appguid={C7B061F6-380E-4545-86E3-400E3156FD28}&appname=Consumer Input Firefox Extension&needsadmin=True&lang=en&appguid={1138A907-2253-45D6-99C1-843A0AC58730}&appname=Consumer Input Internet Explorer Extension&needsadmin=True&lang=en&appguid={B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}&appname=Consumer Input Monitoring Tool&needsadmin=True&lang=en&client=poppy|POP733577B723E34E37B62BE064404EA04D|{630E8F8F-61AD-4DC6-B389-C151817FC884}" /silent
- '%TEMP%\nsuA93B.tmp' /install "bundlename=Consumer Input&appguid={49C47E46-0DD3-4BCD-AF91-A14C104BD9DE}&appname=Consumer Input Chrome Extension&needsadmin=True&lang=en&appguid={C7B061F6-380E-4545-86E3-400E3156FD28}&appname=Consumer Input Firefox Extension&needsadmin=True&lang=en&appguid={1138A907-2253-45D6-99C1-843A0AC58730}&appname=Consumer Input Internet Explorer Extension&needsadmin=True&lang=en&appguid={B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}&appname=Consumer Input Monitoring Tool&needsadmin=True&lang=en&client=poppy|POP733577B723E34E37B62BE064404EA04D|{630E8F8F-61AD-4DC6-B389-C151817FC884}" /silent
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateHelper.msi
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_zh-CN.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_ja.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\psuser.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateBroker.exe
- %PROGRAM_FILES%\Consumer Input\Update\ConsumerInputUpdate.exe
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\psmachine.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_fr.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\ConsumerInputCrashHandler.exe
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdate.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\ConsumerInputUpdate.exe
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_de.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_es-419.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_es.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\goopdateres_en.dll
- %PROGRAM_FILES%\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateOnDemand.exe
- %WINDIR%\Installer\MSI40D8.tmp
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
- C:\Config.Msi\aea61.rbs
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
- <LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
- %WINDIR%\Installer\aea62.msi
- %TEMP%\Tar368B.tmp
- C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_fdaad129-04df-4089-bb80-174ce725f721
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\eb44cbce-c44e-457e-91e9-5bccb3831b03
- <SYSTEM32>\Tasks\ConsumerInputUpdateTaskMachineCore
- %TEMP%\Cab366B.tmp
- %WINDIR%\Installer\aea5e.msi
- <SYSTEM32>\Tasks\ConsumerInputUpdateTaskMachineUA
- %TEMP%\TarB011.tmp
- %TEMP%\GUTAAFF.tmp
- %TEMP%\nsuA93B.tmp
- %PROGRAM_FILES%\Consumer Input\CIuninstall.exe
- %TEMP%\GUMAAEE.tmp\ConsumerInputUpdate.exe
- %TEMP%\GUMAAEE.tmp\ConsumerInputUpdateHelper.msi
- %TEMP%\GUMAAEE.tmp\goopdate.dll
- %TEMP%\GUMAAEE.tmp\ConsumerInputCrashHandler.exe
- %PROGRAM_FILES%\Consumer Input\CIuninstall.ico
- %TEMP%\nso4615.tmp\modern-header.bmp
- %TEMP%\nso4615.tmp\nsis_plugin.dll
- %TEMP%\nso4615.tmp\UAC.dll
- %TEMP%\nso4615.tmp\UserMgr.dll
- %TEMP%\nso4615.tmp\System.dll
- %TEMP%\nso4615.tmp\cookie-retriever.exe
- <LS_APPDATA>\Consumer Input Installer_SID.dat
- %TEMP%\GUMAAEE.tmp\ConsumerInputUpdateBroker.exe
- %TEMP%\CabAF22.tmp
- %TEMP%\GUMAAEE.tmp\goopdateres_zh-CN.dll
- %TEMP%\GUMAAEE.tmp\goopdateres_ja.dll
- %TEMP%\TarAF33.tmp
- %TEMP%\CabB010.tmp
- %TEMP%\TarAFC1.tmp
- %TEMP%\CabAFB1.tmp
- %TEMP%\GUMAAEE.tmp\goopdateres_fr.dll
- %TEMP%\GUMAAEE.tmp\psuser.dll
- %TEMP%\GUMAAEE.tmp\psmachine.dll
- %TEMP%\GUMAAEE.tmp\ConsumerInputUpdateOnDemand.exe
- %TEMP%\GUMAAEE.tmp\goopdateres_de.dll
- %TEMP%\GUMAAEE.tmp\goopdateres_es-419.dll
- %TEMP%\GUMAAEE.tmp\goopdateres_es.dll
- %TEMP%\GUMAAEE.tmp\goopdateres_en.dll
Deletes the following files:
- %WINDIR%\Installer\MSI40D8.tmp
- %TEMP%\Tar368B.tmp
- %TEMP%\Cab366B.tmp
- %WINDIR%\Installer\aea60.ipi
- %WINDIR%\Installer\aea5e.msi
- C:\Config.Msi\aea61.rbs
- %TEMP%\TarB011.tmp
- %TEMP%\TarAF33.tmp
- %TEMP%\CabAF22.tmp
- <LS_APPDATA>\Consumer Input Installer_SID.dat
- %TEMP%\CabB010.tmp
- %TEMP%\TarAFC1.tmp
- %TEMP%\CabAFB1.tmp
Network activity:
Connects to:
- 'cs######0-crl.verisign.com':80
- 'up####.#onsumerinput.com':443
- 'crl.verisign.com':80
- 'sd###.#onsumerinput.com':443
- 'oc##.#erisign.com':80
TCP:
HTTP GET requests:
- oc##.#erisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CEEpKyuBy%2BAZdnAPioiQJdbA%3D
- cs######0-crl.verisign.com/CSC3-2010.crl
- oc##.#erisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D
- crl.verisign.com/pca3-g5.crl
UDP:
- DNS ASK cs######0-crl.verisign.com
- DNS ASK up####.#onsumerinput.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK sd###.#onsumerinput.com
- DNS ASK oc##.#erisign.com
- DNS ASK crl.verisign.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
