Trojan.AutoIt.787

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
[<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
[<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%PROGRAMDATA%\system volume information\grouppolicy\nvrtc64_101_0.dll
%PROGRAMDATA%\system volume information\grouppolicy\xmrig-cuda.dll
%PROGRAMDATA%\system volume information\grouppolicy\config.json
%PROGRAMDATA%\system volume information\codeintegrity\wudfcompanionhost.exe
%PROGRAMDATA%\system volume information\codeintegrity\wudfhost.exe
%PROGRAMDATA%\system volume information\codeintegrity\config.json
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%PROGRAMDATA%\system volume information\grouppolicy\nvrtc-builtins64_101.dll
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4kib76z\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h0pvkfxv\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5lnuzsu7\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\811hqxka\desktop.ini
%PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5lnuzsu7\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h0pvkfxv\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4kib76z\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\811hqxka\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Сетевая активность

TCP

Запросы HTTP GET

http://19#.#28.127.174/b2/MpSigStub.exe
http://19#.#28.127.174/b2/upnpcont.exe
http://19#.#28.127.174/b2/64/c/config.json
http://19#.#28.127.174/b2/64/c/WinRing0x64.sys
http://19#.#28.127.174/b2/64/c/WUDFHost.exe
http://19#.#28.127.174/b2/64/c/WUDFCompanionHost.exe
http://19#.#28.127.174/b2/64/g/config.json
http://19#.#28.127.174/b2/64/g/WinRing0x64.sys
http://19#.#28.127.174/b2/64/g/xmrig-cuda.dll
http://19#.#28.127.174/b2/64/g/nvrtc64_101_0.dll
http://19#.#28.127.174/b2/64/g/nvrtc-builtins64_101.dll
http://19#.#28.127.174/b2/64/g/UIMgrBroker.exe

Другое

Создает и запускает на исполнение

'%PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe'
'%PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe' ' (со скрытым окном)
'%PROGRAMDATA%\system volume information\mpsigstub.exe' ' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c icacls "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA) & icacls "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA) & icacls "%PROGRAMDATA%\Sy...' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
'<SYSTEM32>\cmd.exe' /c icacls "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA) & icacls "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA) & icacls "%PROGRAMDATA%\Sy...
'<SYSTEM32>\icacls.exe' "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA)
'<SYSTEM32>\icacls.exe' "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA)