Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlackK] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlackKNM] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\CarbonBlack\cb.exe
- %TEMP%\CarbonBlackClientSetup-v2.3.0.123.exe /S
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\CarbonBlack\store\TMP_43DA983415EA533F9E667FDB415F4655\data
- %WINDIR%\CarbonBlack\store\TMP_CD3879812B56F0F7AEB38A3CBC79C81E\info.txt
- %WINDIR%\CarbonBlack\store\TMP_CD3879812B56F0F7AEB38A3CBC79C81E\data
- %WINDIR%\CarbonBlack\store\TMP_43DA983415EA533F9E667FDB415F4655\info.txt
- %WINDIR%\CarbonBlack\store\TMP_DA201A0A309B96381FD674D0FAB5DA86\info.txt
- %WINDIR%\CarbonBlack\store\TMP_DA201A0A309B96381FD674D0FAB5DA86\data
- %WINDIR%\CarbonBlack\store\TMP_10F36FA092D7A309A0647FCDC764AE6C\data
- %WINDIR%\CarbonBlack\store\TMP_D38408967BE738D0C1B47005BCE8CEEB\info.txt
- %WINDIR%\CarbonBlack\store\TMP_D38408967BE738D0C1B47005BCE8CEEB\data
- %WINDIR%\CarbonBlack\store\TMP_FB537F29A827D78F756154CF397A113F\info.txt
- %WINDIR%\CarbonBlack\store\TMP_975D12353B1D525C0F3444C447FB3B9A\data
- %WINDIR%\CarbonBlack\store\TMP_90FDAA22F38D9E911F91FA3B8A1F7E5D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_90FDAA22F38D9E911F91FA3B8A1F7E5D\data
- %WINDIR%\CarbonBlack\store\TMP_975D12353B1D525C0F3444C447FB3B9A\info.txt
- %WINDIR%\CarbonBlack\store\TMP_1AFF244CA134956C54474F4E2433E4CE\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C72661F8552ACE7C5C85E16A3CF505C4\data
- %WINDIR%\CarbonBlack\store\TMP_1AFF244CA134956C54474F4E2433E4CE\data
- %WINDIR%\CarbonBlack\store\TMP_C72661F8552ACE7C5C85E16A3CF505C4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_857AE842E5779194595C1AA6428690A2\data
- %WINDIR%\CarbonBlack\store\TMP_888190E31455FAD793312F8D087146EB\info.txt
- %WINDIR%\CarbonBlack\store\TMP_888190E31455FAD793312F8D087146EB\data
- %WINDIR%\CarbonBlack\store\TMP_4FE9D9FA62D020E35E0AC6D1AEEB96F0\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4FE9D9FA62D020E35E0AC6D1AEEB96F0\data
- %WINDIR%\CarbonBlack\store\TMP_10F36FA092D7A309A0647FCDC764AE6C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B3742DEE858B243E77C73D2B8F7C8223\data
- %WINDIR%\CarbonBlack\store\TMP_F5AEE133BF44521852819C2202D82453\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F5AEE133BF44521852819C2202D82453\data
- %WINDIR%\CarbonBlack\store\TMP_B3742DEE858B243E77C73D2B8F7C8223\info.txt
- %WINDIR%\CarbonBlack\store\TMP_FB537F29A827D78F756154CF397A113F\data
- %WINDIR%\CarbonBlack\store\TMP_D5988A5048E4DC7175BCA9F29FC144AE\info.txt
- %WINDIR%\CarbonBlack\store\TMP_D5988A5048E4DC7175BCA9F29FC144AE\data
- %WINDIR%\CarbonBlack\store\TMP_2C8FDB176F22629EA5342DB474FAC391\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B83DAB6BA597E8079854632909A96DC2\data
- %WINDIR%\CarbonBlack\store\TMP_7808313CBC634EE08346D5DDFEF1CC5F\info.txt
- %WINDIR%\CarbonBlack\store\TMP_7808313CBC634EE08346D5DDFEF1CC5F\data
- %WINDIR%\CarbonBlack\store\TMP_B83DAB6BA597E8079854632909A96DC2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\data
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\data
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2C8FDB176F22629EA5342DB474FAC391\data
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\data
- %WINDIR%\CarbonBlack\store\TMP_5AF68A5E44734A082442668E9C787743\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2B9B56A89A8A42E917511972A6DB36E3\info.txt
- %WINDIR%\CarbonBlack\store\TMP_5AF68A5E44734A082442668E9C787743\data
- %WINDIR%\CarbonBlack\store\TMP_2CDE496666A975A2CE8F969F3042C8DB\data
- %WINDIR%\CarbonBlack\store\TMP_5C201E9741BB40AF60A7C66D2B3AFCC4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_5C201E9741BB40AF60A7C66D2B3AFCC4\data
- %WINDIR%\CarbonBlack\store\TMP_2CDE496666A975A2CE8F969F3042C8DB\info.txt
- %WINDIR%\CarbonBlack\store\TMP_05CB782F2C7024AA92B1722A926BBD3A\data
- %WINDIR%\CarbonBlack\store\TMP_E682696D7F982494A8CFC80C5B59D422\info.txt
- %WINDIR%\CarbonBlack\store\TMP_E682696D7F982494A8CFC80C5B59D422\data
- %WINDIR%\CarbonBlack\store\TMP_05CB782F2C7024AA92B1722A926BBD3A\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2B9B56A89A8A42E917511972A6DB36E3\data
- %WINDIR%\CarbonBlack\store\TMP_0A1161DB4FCCF7821736C70D70A0F5A3\info.txt
- %WINDIR%\CarbonBlack\store\TMP_0A1161DB4FCCF7821736C70D70A0F5A3\data
- %WINDIR%\CarbonBlack\store\TMP_857AE842E5779194595C1AA6428690A2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C76735BFB7214907B4590DD35AE64A79\data
- %WINDIR%\CarbonBlack\uninst.exe
- %WINDIR%\CarbonBlack\store\TMP_93F9FABD1E6D1726458188C9DD421A7D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C76735BFB7214907B4590DD35AE64A79\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9BEACB911CA61E5881102188AB7FB431\data
- %WINDIR%\CarbonBlack\store\TMP_42A1912DBDF8BCC087A1CAE008DB060C\data
- %WINDIR%\CarbonBlack\store\whitelist
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\data
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\data
- %WINDIR%\CarbonBlack\store\TMP_1471C5F110CF36D7299AA0F41AED018E\data
- %WINDIR%\CarbonBlack\store\TMP_93F9FABD1E6D1726458188C9DD421A7D\data
- %WINDIR%\CarbonBlack\store\TMP_1471C5F110CF36D7299AA0F41AED018E\info.txt
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\info.txt
- %TEMP%\nsm3.tmp\System.dll
- %WINDIR%\CarbonBlack\cb.exe
- %WINDIR%\CarbonBlack\cbclient.bin
- %TEMP%\nsm3.tmp\nsSCM.dll
- %TEMP%\FE1.tmp
- %TEMP%\cbclient.bin
- %TEMP%\CarbonBlackClientSetup-v2.3.0.123.exe
- %WINDIR%\CarbonBlack\store\TMP_42A1912DBDF8BCC087A1CAE008DB060C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2ED0B7F12A60F90092081C50FA0EC2B2\data
- %WINDIR%\CarbonBlack\store\TMP_9BEACB911CA61E5881102188AB7FB431\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2ED0B7F12A60F90092081C50FA0EC2B2\info.txt
- %WINDIR%\CarbonBlack\cbclient.pem
- <DRIVERS>\CarbonBlackK.sys
- <DRIVERS>\CarbonBlackKNM.sys
- %WINDIR%\CarbonBlack\client.log
- %WINDIR%\CarbonBlack\store\TMP_1F57EB5B92B2AC7F9D71A77D184D8C13\data
- %WINDIR%\CarbonBlack\store\TMP_81459CB8E975003AD28B8ABB8DFA8329\data
- %WINDIR%\CarbonBlack\store\TMP_1320AEA7057A26A671D9548CC7BEBDA5\info.txt
- %WINDIR%\CarbonBlack\store\TMP_1F57EB5B92B2AC7F9D71A77D184D8C13\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C28500101BC66FDABD830F8DE51A59A0\info.txt
- %WINDIR%\CarbonBlack\store\TMP_81459CB8E975003AD28B8ABB8DFA8329\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C28500101BC66FDABD830F8DE51A59A0\data
- %WINDIR%\CarbonBlack\store\TMP_075EA6C849AB0FE416A3D6DD65C3CF41\data
- %WINDIR%\CarbonBlack\store\TMP_B0FEFA816D61EC66AA765DDF534EAB5E\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B0FEFA816D61EC66AA765DDF534EAB5E\data
- %WINDIR%\CarbonBlack\store\TMP_075EA6C849AB0FE416A3D6DD65C3CF41\info.txt
- %WINDIR%\CarbonBlack\store\TMP_1320AEA7057A26A671D9548CC7BEBDA5\data
- %WINDIR%\CarbonBlack\store\TMP_ECA24AB73FCFFA754D4070CDB03529E3\info.txt
- %WINDIR%\CarbonBlack\store\TMP_ECA24AB73FCFFA754D4070CDB03529E3\data
- %WINDIR%\CarbonBlack\store\TMP_851547797C2A7F8A04841644C471A567\info.txt
- %WINDIR%\CarbonBlack\store\TMP_851547797C2A7F8A04841644C471A567\data
- %WINDIR%\CarbonBlack\store\TMP_4E39C36213E95FB971A61A247BDE2F61\info.txt
- %WINDIR%\CarbonBlack\store\TMP_E26F50A92EE564F21C30501AA6173676\data
- %WINDIR%\CarbonBlack\store\TMP_26ACBD865F8CFF730F1791C4D0854352\info.txt
- %WINDIR%\CarbonBlack\store\TMP_26ACBD865F8CFF730F1791C4D0854352\data
- %WINDIR%\CarbonBlack\store\TMP_E26F50A92EE564F21C30501AA6173676\info.txt
- %WINDIR%\CarbonBlack\store\TMP_7D676AC8CC19341117C77C261647BA07\data
- %WINDIR%\CarbonBlack\store\TMP_6201BACF384292A5FE94CE73364AE53A\info.txt
- %WINDIR%\CarbonBlack\store\TMP_6201BACF384292A5FE94CE73364AE53A\data
- %WINDIR%\CarbonBlack\store\TMP_7D676AC8CC19341117C77C261647BA07\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E39C36213E95FB971A61A247BDE2F61\data
- %WINDIR%\CarbonBlack\store\TMP_6728270CB7DBB776ED086F5AC4C82310\info.txt
- %WINDIR%\CarbonBlack\store\TMP_6728270CB7DBB776ED086F5AC4C82310\data
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\CarbonBlack\cbclient.pem
- %WINDIR%\CarbonBlack\cbclient.bin
Удаляет следующие файлы:
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\nsm3.tmp\nsSCM.dll
- %TEMP%\FE1.tmp
Сетевая активность:
Подключается к:
- '10.##5.200.22':443
