Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\mservices
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Windows\Libs\WR64.sys'
Создает следующие сервисы
- 'WinRing0_1_2_0' %APPDATA%\Windows\Libs\WR64.sys
Вредоносные функции
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\riftextras.exe
- %TEMP%\_mei25882\libcrypto-1_1.dll
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei25882\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei25882\libffi-7.dll
- %TEMP%\_mei25882\pyexpat.pyd
- %APPDATA%\windows\libs\wr64.sys
- %TEMP%\_mei25882\python3.dll
- %APPDATA%\windows\telemetry\sihost64.exe
- %APPDATA%\microsoft\mservices.exe
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\top_level.txt
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\wheel
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\record
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\metadata
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.psf
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.bsd
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.apache
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\installer
- %TEMP%\_mei25882\certifi\cacert.pem
- %TEMP%\_mei25882\base_library.zip
- %TEMP%\_mei25882\unicodedata.pyd
- %TEMP%\_mei25882\ucrtbase.dll
- %TEMP%\_mei25882\select.pyd
- %TEMP%\_mei25882\python39.dll
- %TEMP%\_mei25882\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei25882\libssl-1_1.dll
- %TEMP%\_mei25882\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei25882\_socket.pyd
- %TEMP%\_mei25882\_queue.pyd
- %TEMP%\_mei25882\_overlapped.pyd
- %TEMP%\_mei25882\_multiprocessing.pyd
- %TEMP%\_mei25882\_lzma.pyd
- %TEMP%\_mei25882\_hashlib.pyd
- %TEMP%\_mei25882\_decimal.pyd
- %TEMP%\_mei25882\_ctypes.pyd
- %TEMP%\_mei25882\_cffi_backend.cp39-win_amd64.pyd
- %TEMP%\_mei25882\_bz2.pyd
- %TEMP%\_mei25882\_brotli.cp39-win_amd64.pyd
- %TEMP%\_mei25882\_asyncio.pyd
- %TEMP%\_mei25882\vcruntime140_1.dll
- %TEMP%\_mei25882\vcruntime140.dll
- %TEMP%\_mei25882\msvcp140.dll
- %TEMP%\riftstore.exe
- %TEMP%\riftdec.exe
- %TEMP%\_mei25882\_ssl.pyd
- %TEMP%\_mei25882\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei25882\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei25882\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-synch-l1-2-0.dll
- %WINDIR%\temp\udd3d6d.tmp
Присваивает атрибут 'скрытый' для следующих файлов
- %TEMP%\riftextras.exe
- %TEMP%\riftdec.exe
Удаляет следующие файлы
- %TEMP%\_mei25882\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei25882\msvcp140.dll
- %TEMP%\_mei25882\libssl-1_1.dll
- %TEMP%\_mei25882\libffi-7.dll
- %TEMP%\_mei25882\libcrypto-1_1.dll
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\wheel
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\top_level.txt
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\record
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\metadata
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.psf
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.bsd
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license.apache
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\license
- %TEMP%\_mei25882\cryptography-35.0.0.dist-info\installer
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei25882\pyexpat.pyd
- %TEMP%\_mei25882\python3.dll
- %TEMP%\_mei25882\python39.dll
- %TEMP%\_mei25882\select.pyd
- %TEMP%\_mei25882\_socket.pyd
- %TEMP%\_mei25882\_queue.pyd
- %TEMP%\_mei25882\_overlapped.pyd
- %TEMP%\_mei25882\_multiprocessing.pyd
- %TEMP%\_mei25882\_lzma.pyd
- %TEMP%\_mei25882\_hashlib.pyd
- %TEMP%\_mei25882\_decimal.pyd
- %TEMP%\_mei25882\_cffi_backend.cp39-win_amd64.pyd
- %TEMP%\_mei25882\_ctypes.pyd
- %TEMP%\_mei25882\_bz2.pyd
- %TEMP%\_mei25882\_brotli.cp39-win_amd64.pyd
- %TEMP%\_mei25882\_asyncio.pyd
- %TEMP%\_mei25882\vcruntime140_1.dll
- %TEMP%\_mei25882\vcruntime140.dll
- %TEMP%\_mei25882\unicodedata.pyd
- %TEMP%\_mei25882\ucrtbase.dll
- %TEMP%\_mei25882\_ssl.pyd
- %TEMP%\_mei25882\certifi\cacert.pem
- %TEMP%\_mei25882\base_library.zip
- %TEMP%\_mei25882\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei25882\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei25882\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei25882\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei25882\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei25882\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\temp\udd3d6d.tmp
Сетевая активность
Подключается к
- 'ju###craft.net':443
- 'us####t.minexmr.com':443
TCP
Другие
- 'ju###craft.net':443
- 'us####t.minexmr.com':443
UDP
- DNS ASK ju###craft.net
- DNS ASK us####t.minexmr.com
Другое
Создает и запускает на исполнение
- '%TEMP%\riftextras.exe'
- '%TEMP%\riftdec.exe'
- '%TEMP%\riftstore.exe'
- '%APPDATA%\microsoft\mservices.exe'
- '%APPDATA%\windows\telemetry\sihost64.exe'
- '%APPDATA%\windows\telemetry\sihost64.exe' ' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreferenc...
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\riftstore.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "mservices" /tr "%APPDATA%\Microsoft\mservices.exe"
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "mservices" /tr "%APPDATA%\Microsoft\mservices.exe"
- '<SYSTEM32>\cmd.exe' cmd /c "%APPDATA%\Microsoft\mservices.exe"
- '<SYSTEM32>\svchost.exe' nrczfxfym0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJR+/H8+DpS8XDhleRuy0z94NO93OIrH6QYRraCGPB3W3dZe97Q5BQPTpcTPwkGcXBe4zM0GMX1EcPY5LUsbG3SmjyzRygpZOGGxrMEefknUV4j9f0oPccwQD+kO6kjUK6a4/S7pW3pHMj...
