Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Background' = '"%ProgramFiles%\WindowsPowerShell\Modules\Pester\3.4.0\svchost.exe"'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'ImagePath' = '"<SYSTEM32>\WindowsInput.exe"'
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- svchost.exe
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;....
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000002'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tmp1.tmp.exe
- %TEMP%\nsje.tmp\system.dll
- %TEMP%\nsjd.tmp
- %TEMP%\uogvlthh.dll
- %TEMP%\resb.tmp
- %TEMP%\csca.tmp
- %TEMP%\uogvlthh.out
- %TEMP%\uogvlthh.cmdline
- %TEMP%\uogvlthh.0.cs
- %TEMP%\tmp9.tmp.exe
- %WINDIR%\temp\scs8.tmp
- %WINDIR%\temp\scs7.tmp
- <Текущая директория>\738.exe
- %ProgramFiles%\windowspowershell\modules\pester\3.4.0\svchost.exe.config
- %ProgramFiles%\windowspowershell\modules\pester\3.4.0\svchost.exe
- <SYSTEM32>\windowsinput.installstate
- <SYSTEM32>\windowsinput.exe.config
- <SYSTEM32>\windowsinput.exe
- %TEMP%\3yxfemq1.dll
- %TEMP%\res6.tmp
- %TEMP%\csc5.tmp
- %TEMP%\3yxfemq1.out
- %TEMP%\3yxfemq1.cmdline
- %TEMP%\3yxfemq1.0.cs
- %APPDATA%\1337\antiav.bat
- %APPDATA%\1337\disable-windows-defender.exe
- %TEMP%\nsj4.tmp\system.dll
- %TEMP%\nsz3.tmp
- %APPDATA%\svchost.exe
- %APPDATA%\svchost.exe.config
Присваивает атрибут 'скрытый' для следующих файлов
- %ProgramFiles%\windowspowershell\modules\pester\3.4.0\svchost.exe
Удаляет следующие файлы
- %TEMP%\nsj4.tmp\system.dll
- %TEMP%\uogvlthh.dll
- %TEMP%\uogvlthh.cmdline
- %TEMP%\uogvlthh.out
- %TEMP%\csca.tmp
- %TEMP%\resb.tmp
- <Текущая директория>\738.exe
- %TEMP%\uogvlthh.0.cs
- %WINDIR%\temp\scs8.tmp
- %TEMP%\3yxfemq1.0.cs
- %TEMP%\3yxfemq1.out
- %TEMP%\3yxfemq1.cmdline
- %TEMP%\3yxfemq1.dll
- %TEMP%\csc5.tmp
- %TEMP%\res6.tmp
- %WINDIR%\temp\scs7.tmp
- %TEMP%\nsje.tmp\system.dll
Сетевая активность
Подключается к
- '77.##.174.121':10134
Другое
Ищет следующие окна
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9a0.99c.380001'
Создает и запускает на исполнение
- '%TEMP%\tmp1.tmp.exe'
- '%APPDATA%\1337\disable-windows-defender.exe'
- '<SYSTEM32>\windowsinput.exe' --install
- '<SYSTEM32>\windowsinput.exe'
- '%ProgramFiles%\windowspowershell\modules\pester\3.4.0\svchost.exe'
- '%TEMP%\tmp9.tmp.exe'
- '%APPDATA%\svchost.exe' /launchSelfAndExit "%ProgramFiles%\WindowsPowerShell\Modules\Pester\3.4.0\svchost.exe" 2040 /protectFile
- '%APPDATA%\svchost.exe' /watchProcess "%ProgramFiles%\WindowsPowerShell\Modules\Pester\3.4.0\svchost.exe" 2040 "/protectFile"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3yxfemq1.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "%TEMP%\CSC5.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uogvlthh.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB.tmp" "%TEMP%\CSCA.tmp"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\1337\antiav.bat" "
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3yxfemq1.cmdline"
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "<SYSTEM32>\rlls64.dll" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "<SYSTEM32>\rlls.dll" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove...
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;....
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "%TEMP%\CSC5.tmp"
- '<SYSTEM32>\reg.exe' Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknl...
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.re#####tknowledge.com/conf...
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uogvlthh.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB.tmp" "%TEMP%\CSCA.tmp"
