Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Classes\Folder\shell\open\command] '' = 'cmd.exe /c start /min notepad.exe'
- [<HKLM>\Software\Classes\Word.Document.12\shell\open\command] '' = '"<Текущая директория>\\cystack_response.exe""%ProgramFiles%\Microsoft Office\Office14\WINWORD.EXE" /n "%1"'
- [<HKLM>\Software\Classes\Word.Document.12\shell\open\command] '' = '"%ProgramFiles%\Microsoft Office\Office14\WINWORD.EXE" /n "%1"'
Изменения в файловой системе
Создает следующие файлы
- %HOMEPATH%\.cystack\datastore\cystack windows_contact.contact
- %HOMEPATH%\.cystack\datastore\http\www.microsoft.com.exe
- %HOMEPATH%\.cystack\datastore\cystack windows_contact.zip
- C:\cystack_response.exe
- C:\cystack_test.docx
Удаляет следующие файлы
- C:\cystack_test.docx
Сетевая активность
Подключается к
- 'sl##k.com':443
- 'microsoft.com':80
TCP
- 'sl##k.com':443
UDP
- DNS ASK sl##k.com
- DNS ASK microsoft.com
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\smss.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<Полный путь к файлу>\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\WUDFHost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\mdm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertifi...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\audiodg.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\taskhost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\spoolsv.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%WINDIR%\explorer.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\dwm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%ProgramFiles(x86)%\Internet Explorer\iexplore.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subj...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\svchost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\lsm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\lsass.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status ...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\services.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\conhost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\winlogon.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\wininit.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\csrss.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status ...' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Start-Process -FilePath . est.docx -WindowStyle Hidden "' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature \"%CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe\" "' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature %WINDIR%\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe "' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\sdclt.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<Полный путь к файлу>\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\WUDFHost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\mdm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertifi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\audiodg.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\taskhost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\spoolsv.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%WINDIR%\explorer.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\dwm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"%ProgramFiles(x86)%\Internet Explorer\iexplore.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subj...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\svchost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\lsm.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\lsass.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\services.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\conhost.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\winlogon.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Stat...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\wininit.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Statu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\csrss.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Start-Process -FilePath . est.docx -WindowStyle Hidden "
- '<SYSTEM32>\control.exe' /name Microsoft.BackupAndRestoreCenter
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature -FilePath \"<SYSTEM32>\smss.exe\" | `Select-object -Property Status,Path, ` @{Name='SubjectName';Expression={($_.SignerCertificate.Subject)}} | Select-String Status "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature \"%CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe\" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-AuthenticodeSignature %WINDIR%\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe "
