Trojan.MulDrop5.6211

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\HZ$D.303.1808\DCMD.exe' StaforceTEAM.cmd
'%TEMP%\HZ$D.303.1808\Win32\KMSServer.exe' -port 1688 -ai 43200 -ri 43200 -ip 127.0.0.2
'%WINDIR%\SoftwareDistribution\StaforceTEAM\StaforceTEAM.exe'
'%TEMP%\HZ$D.303.1808\DCMD.exe' CreateTask.cmd

Запускает на исполнение:

'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /format:list
'<SYSTEM32>\findstr.exe' /i Office
'<SYSTEM32>\findstr.exe' /i Windows
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="KMSServer-WinDivert" dir=out program="%TEMP%\HZ$D.303.1808\Win32\KMSServer.exe" localport=1688 protocol=TCP action=allow remoteip=any
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\55c92734-d682-4d71-983e-d6ec3f16059f /f
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\0ff1ce15-a989-479d-af46-f275c6370663 /f
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"\59a52881-a989-479d-af46-f275c6370663 /f
'<SYSTEM32>\net.exe' stop WinDivert1.1
'<SYSTEM32>\net1.exe' stop WinDivert1.1
'<SYSTEM32>\sc.exe' delete WinDivert1.1
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"\0ff1ce15-a989-479d-af46-f275c6370663 /f
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get version /format:list
'<SYSTEM32>\taskkill.exe' /F /T /IM KMSServer.exe
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="KMSServer-WinDivert" dir=in program="%TEMP%\HZ$D.303.1808\Win32\KMSServer.exe" localport=1688 protocol=TCP action=allow remoteip=any
'<SYSTEM32>\schtasks.exe' /Create /TN "KMS Server OnLogon Activate" /TR %WINDIR%\SoftwareDistribution\StaforceTEAM\StaforceTEAM.exe /SC ONLOGON /RU SYSTEM /RL Highest /F
'<SYSTEM32>\schtasks.exe' /Create /TN "KMS Server Daily Activate" /TR %WINDIR%\SoftwareDistribution\StaforceTEAM\StaforceTEAM.exe /SC DAILY /RU SYSTEM /RL Highest /F
'<SYSTEM32>\cmd.exe' /c ""StaforceTEAM.cmd""
'<SYSTEM32>\cmd.exe' /c ""CreateTask.cmd""
'<SYSTEM32>\reg.exe' query "HKU\S-1-5-19"
'<SYSTEM32>\mode.com' con:cols=95 lines=5
'<SYSTEM32>\cscript.exe' <SYSTEM32>\slmgr.vbs -upk
'<SYSTEM32>\reg.exe' query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
'<SYSTEM32>\find.exe' /i "amd64"
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="KMSBLOCK" protocol=any dir=out remoteip=65.52.98.231,65.52.98.232,65.52.98.233 action=block
'<SYSTEM32>\net.exe' stop sppsvc
'<SYSTEM32>\net1.exe' stop sppsvc
'<SYSTEM32>\net1.exe' start sppsvc