Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'ImagePath' = '%WINDIR%\CarbonBlack\cb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'ImagePath' = '<DRIVERS>\carbonblackk.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\cbtdiflt] 'ImagePath' = '<DRIVERS>\cbtdiflt.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'Start' = '00000001'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /C "echo y|<SYSTEM32>\cacls %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\cacls.exe' %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)
- '%TEMP%\RarSFX0\CarbonBlackClientSetup.exe' /S
- '%WINDIR%\CarbonBlack\cb.exe'
- '%TEMP%\nsn3.tmp\ns4.tmp' cmd.exe /C "echo y|<SYSTEM32>\cacls %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\CabB.tmp
- %WINDIR%\Temp\Cab9.tmp
- %WINDIR%\Temp\CabF.tmp
- %WINDIR%\Temp\CabD.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %WINDIR%\Temp\Cab7.tmp
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\Temp\Cab11.tmp
- %WINDIR%\Temp\Cab1D.tmp
- %WINDIR%\Temp\Cab1B.tmp
- %WINDIR%\Temp\Cab21.tmp
- %WINDIR%\Temp\Cab1F.tmp
- %WINDIR%\Temp\Cab15.tmp
- %WINDIR%\Temp\Cab13.tmp
- %WINDIR%\Temp\Cab19.tmp
- %WINDIR%\Temp\Cab17.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\data
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\data
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\data
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\info.txt
- %WINDIR%\CarbonBlack\store\TMP_7E7620240C233DD849F72658B5B2E9DF\data
- %WINDIR%\CarbonBlack\store\TMP_7E7620240C233DD849F72658B5B2E9DF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\info.txt
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\data
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\data
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\data
- %WINDIR%\Temp\Cab23.tmp
- %WINDIR%\CarbonBlack\store\TMP_F5AEE133BF44521852819C2202D82453\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\data
- %WINDIR%\CarbonBlack\store\TMP_BB5CBFFC096497506167BCE1D9690EF2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F5AEE133BF44521852819C2202D82453\data
- %WINDIR%\CarbonBlack\store\TMP_28BD3128DD85EEBA6AEF9A15D25B2346\info.txt
- %WINDIR%\CarbonBlack\store\TMP_ECA24AB73FCFFA754D4070CDB03529E3\data
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\info.txt
- %WINDIR%\CarbonBlack\store\TMP_28BD3128DD85EEBA6AEF9A15D25B2346\data
- %WINDIR%\CarbonBlack\store\TMP_BB5CBFFC096497506167BCE1D9690EF2\data
- %WINDIR%\CarbonBlack\store\TMP_857AE842E5779194595C1AA6428690A2\data
- %WINDIR%\CarbonBlack\store\TMP_857AE842E5779194595C1AA6428690A2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_888190E31455FAD793312F8D087146EB\data
- %WINDIR%\CarbonBlack\store\TMP_888190E31455FAD793312F8D087146EB\info.txt
- %WINDIR%\CarbonBlack\store\TMP_1AFF244CA134956C54474F4E2433E4CE\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C72661F8552ACE7C5C85E16A3CF505C4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_1AFF244CA134956C54474F4E2433E4CE\data
- %WINDIR%\CarbonBlack\store\TMP_C72661F8552ACE7C5C85E16A3CF505C4\data
- %WINDIR%\CarbonBlack\store\TMP_ECA24AB73FCFFA754D4070CDB03529E3\info.txt
- %WINDIR%\Temp\Cab2F.tmp
- %WINDIR%\Temp\Cab2D.tmp
- %WINDIR%\CarbonBlack\store\TMP_E47100B70748FC790FFE6299CDF7EF2D\data
- %WINDIR%\CarbonBlack\store\TMP_E47100B70748FC790FFE6299CDF7EF2D\info.txt
- %WINDIR%\Temp\Cab27.tmp
- %WINDIR%\Temp\Cab25.tmp
- %WINDIR%\Temp\Cab2B.tmp
- %WINDIR%\Temp\Cab29.tmp
- %WINDIR%\Temp\Cab31.tmp
- %WINDIR%\CarbonBlack\store\TMP_385E9AEC6E100DBEBEE5BD1F27A55E1D\data
- %WINDIR%\CarbonBlack\store\TMP_385E9AEC6E100DBEBEE5BD1F27A55E1D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2D40EDB9BF811590DAD7406DEC67B926\data
- %WINDIR%\CarbonBlack\store\TMP_2D40EDB9BF811590DAD7406DEC67B926\info.txt
- %WINDIR%\Temp\Cab35.tmp
- %WINDIR%\Temp\Cab33.tmp
- %WINDIR%\CarbonBlack\store\TMP_DD6D5ABAD9B8C13CEDA4752370BA982C\data
- %WINDIR%\CarbonBlack\store\TMP_DD6D5ABAD9B8C13CEDA4752370BA982C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_CEFBCDBADD70C6BB9538B6CAF224FB2E\data
- %WINDIR%\CarbonBlack\store\catalog
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\data
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\data
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\info.txt
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\info.txt
- %TEMP%\nsn3.tmp\ns4.tmp
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\info.txt
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\data
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\data
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\info.txt
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\data
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716_\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\data
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\info.txt
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716_\data
- %TEMP%\nsn3.tmp\nsExec.dll
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\RarSFX0\GPO_README.txt
- %WINDIR%\CarbonBlack\InstallLogs\install-5.2.1.61026-2017-03-23_122828.log
- %TEMP%\nsn3.tmp\nsislog.dll
- %TEMP%\RarSFX0\version.txt
- %TEMP%\RarSFX0\sensorsettings.ini
- %TEMP%\RarSFX0\cbsetup.msi
- %TEMP%\RarSFX0\CarbonBlackClientSetup.exe
- %WINDIR%\CarbonBlack\sensorsettings.ini
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\Sensor.LOG
- %WINDIR%\CarbonBlack\uninst.exe
- %WINDIR%\CarbonBlack\carbonblack.db
- %WINDIR%\CarbonBlack\cb.exe
- %TEMP%\nsn3.tmp\nsSCM.dll
- <DRIVERS>\CarbonBlackK.sys
- <DRIVERS>\cbtdiflt.sys
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\data
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\data
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\info.txt
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\data
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\data
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\data
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C262A5C06FB4720BFEC948BC38A967A4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F132FDBBC0A040F07E10EA944FF57FEF\data
- %WINDIR%\CarbonBlack\store\TMP_F132FDBBC0A040F07E10EA944FF57FEF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_CEFBCDBADD70C6BB9538B6CAF224FB2E\info.txt
- %WINDIR%\CarbonBlack\store\TMP_AABE0170406ABBA0116BA835BE4BC38F\data
- %WINDIR%\CarbonBlack\store\TMP_80967D204408679E55B309D9E60C6F90\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C262A5C06FB4720BFEC948BC38A967A4\data
- %WINDIR%\CarbonBlack\store\TMP_AABE0170406ABBA0116BA835BE4BC38F\info.txt
- %WINDIR%\CarbonBlack\store\TMP_80967D204408679E55B309D9E60C6F90\data
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\data
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\data
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\data
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\info.txt
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\data
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\data
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\data
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\info.txt
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\data
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\data
Удаляет следующие файлы:
- %WINDIR%\Temp\Cab2D.tmp
- %WINDIR%\Temp\Cab2B.tmp
- %WINDIR%\Temp\Cab2F.tmp
- %TEMP%\nsn3.tmp\nsExec.dll
- %TEMP%\nsn3.tmp\ns4.tmp
- %WINDIR%\Temp\Cab23.tmp
- %WINDIR%\Temp\Cab21.tmp
- %WINDIR%\Temp\Cab25.tmp
- %WINDIR%\Temp\Cab29.tmp
- %WINDIR%\Temp\Cab27.tmp
- %TEMP%\nsn3.tmp\nsislog.dll
- %TEMP%\RarSFX0\cbsetup.msi
- %TEMP%\RarSFX0\CarbonBlackClientSetup.exe
- %TEMP%\RarSFX0\GPO_README.txt
- %TEMP%\RarSFX0\version.txt
- %TEMP%\RarSFX0\sensorsettings.ini
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\nsn3.tmp\nsSCM.dll
- %WINDIR%\Temp\Cab31.tmp
- %WINDIR%\Temp\Cab35.tmp
- %WINDIR%\Temp\Cab33.tmp
- %WINDIR%\Temp\Cab1F.tmp
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\info.txt
- %WINDIR%\Temp\Cab7.tmp
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\sensorsettings.ini
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\data
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\info.txt
- %WINDIR%\Temp\Cab9.tmp
- %WINDIR%\Temp\Cab17.tmp
- %WINDIR%\Temp\Cab15.tmp
- %WINDIR%\Temp\Cab19.tmp
- %WINDIR%\Temp\Cab1D.tmp
- %WINDIR%\Temp\Cab1B.tmp
- %WINDIR%\Temp\CabD.tmp
- %WINDIR%\Temp\CabB.tmp
- %WINDIR%\Temp\CabF.tmp
- %WINDIR%\Temp\Cab13.tmp
- %WINDIR%\Temp\Cab11.tmp
Подменяет следующие файлы:
- %WINDIR%\CarbonBlack\carbonblack.db-journal
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'www.download.windowsupdate.com':80
- '<L####NET>.42.145':443
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/WindowsPCA.crl via 20#.#6.232.182
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
