Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Classes\offlineRule\shell\open\command] '' = '"%WINDIR%\projone\potcm\clientstat.exe" "%1"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\pobus] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\pobus] 'ImagePath' = '%WINDIR%\projone\potcm\pobus64.exe'
- [HKLM\System\CurrentControlSet\Services\poflt64] 'ImagePath' = 'system32\DRIVERS\poflt64.sys'
Создает следующие сервисы
- 'pobus' %WINDIR%\projone\potcm\pobus64.exe
- 'poflt64' system32\DRIVERS\poflt64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
изменяет следующие системные настройки:
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000000'
Регистрирует фильтр файловой системы
- [HKLM\System\CurrentControlSet\Services\poflt64] 'Group' = 'FSFilter Content Screener'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nspb912.tmp
- %WINDIR%\projone\potcm\spcyex64.dll
- %WINDIR%\projone\potcm\procmgr64.dll
- %WINDIR%\projone\potcm\ctask64.dll
- %WINDIR%\projone\potcm\patch64.dll
- %WINDIR%\projone\potcm\filedp64.dll
- %WINDIR%\projone\potcm\potdi643.sys
- %WINDIR%\projone\potcm\powfp643.sys
- %WINDIR%\projone\potcm\poflt64.sys
- %WINDIR%\projone\potcm\powall64.dll
- %WINDIR%\projone\potcm\docguard64.dll
- %WINDIR%\projone\potcm\doced64.dll
- %WINDIR%\projone\potcm\sscanner64.dll
- %WINDIR%\projone\potcm\imagent64.dll
- %WINDIR%\projone\potcm\poprotect664.sys
- %WINDIR%\projone\potcm\poprotect64.dll
- %WINDIR%\projone\potcm\sensinfo64.dll
- %WINDIR%\projone\potcm\sqlcipher64.dll
- %WINDIR%\projone\potcm\odipus64.dll
- %WINDIR%\projone\potcm\actmon64.dll
- %WINDIR%\projone\potcm\scrnrcd64.dll
- %WINDIR%\projone\potcm\usbmgr64.dll
- %WINDIR%\projone\potcm\athenx64.dll
- %WINDIR%\projone\potcm\poda64.exe
- %WINDIR%\projone\potcm\pohost64.exe
- %WINDIR%\projone\potcm\pobus64.exe
- %WINDIR%\projone\potcm\pomqc364.dll
- %WINDIR%\projone\potcm\clientbase64.dll
- %WINDIR%\projone\potcm\workflow64.dll
- %WINDIR%\projone\potcm\docscanner64.dll
- %WINDIR%\projone\potcm\podumper64.dll
- %WINDIR%\projone\potcm\poflt64.inf
- %WINDIR%\projone\potcm\shlext64.dll
- %WINDIR%\projone\potcm\rptcache64.dll
- %WINDIR%\projone\potcm\rtinfo64.dll
- %WINDIR%\projone\potcm\anyconn64.dll
- %WINDIR%\projone\potcm\rtfile64.dll
- %WINDIR%\projone\potcm\backup64.dll
- %WINDIR%\projone\potcm\leakways64.dll
- %WINDIR%\projone\potcm\athens64.dll
- %WINDIR%\projone\potcm\swvv64.sys
- <DRIVERS>\set23d5.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009202.tmp
- %WINDIR%\projone\potcm\placeholder64.dll
- %WINDIR%\projone\potcm\cache\patch\office_add.dat
- %WINDIR%\projone\potcm\cache\patch\system.dat
- %WINDIR%\projone\potcm\cache\patch\system64.dat
- %WINDIR%\projone\potcm\cache\patch\system64_add.dat
- %WINDIR%\projone\potcm\cache\patch\system_add.dat
- %WINDIR%\projone\potcm\cache\patch\ffea3215.dat
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009198.tmp
- %WINDIR%\projone\potcm\langrp64.dll
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009198
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009199
- %WINDIR%\temp\b78b.tmp
- %ALLUSERSPROFILE%\projone\patch_info
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009200.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009200
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009201.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009201
- %WINDIR%\projone\potcm\cache\patch\expiredkb.dat
- %WINDIR%\projone\potcm\cache\patch\office.dat
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009197
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009197.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009196
- %WINDIR%\projone\potcm\log\pobus64\20241029124546_pobus64-0.log
- %WINDIR%\projone\potcm\log\pobus64\20241029124547_pobus64-0.log
- C:\system volume information\cid
- %WINDIR%\projone\potcm\log\poda32\20241029124550_poda32-0.log
- <SYSTEM32>\grouppolicy\gpt.ini
- %ALLUSERSPROFILE%\projone\asphs\logs\assisths-20241029-124559.095.log
- %WINDIR%\projone\potcm\log\poda64\20241029124600_poda64-0.log
- %WINDIR%\projone\potcm\powol64.dll
- %WINDIR%\projone\potcm\libcurl64.dll
- <SYSTEM32>\config\systemprofile\appdata\local\gdipfontcachev1.dat
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009192.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009192
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009194.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009194
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009195.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009195
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009196.tmp
- %WINDIR%\projone\potcm\intcap64.dll
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\explorer\explorerstartuplog_runonce.etl
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009199.tmp
- %WINDIR%\projone\potcm\libeay64.dll
- %WINDIR%\projone\potcm\posoftmgr.exe
- %WINDIR%\projone\potcm\libcurl32.dll
- %WINDIR%\projone\potcm\compress32.dll
- %WINDIR%\projone\potcm\sscreator.exe
- %WINDIR%\projone\potcm\ssreader.exe
- %WINDIR%\projone\potcm\vsccreator.exe
- %WINDIR%\projone\potcm\setuphlpr.dll
- %WINDIR%\projone\potcm\assists.exe
- %WINDIR%\projone\potcm\skin\wfviewer
- %WINDIR%\projone\potcm\screenhooks32.dll
- %WINDIR%\projone\potcm\wfviewer.exe
- %WINDIR%\projone\potcm\wfchost.exe
- %WINDIR%\projone\potcm\clientstat.exe
- %WINDIR%\projone\potcm\nf732.sys
- %WINDIR%\projone\potcm\nf764.sys
- %WINDIR%\projone\potcm\nf1064.sys
- %WINDIR%\projone\potcm\nfapi.dll
- %WINDIR%\projone\potcm\ssleay32.dll
- %WINDIR%\projone\potcm\libeay32.dll
- %WINDIR%\projone\potcm\clientbase32.dll
- %WINDIR%\projone\potcm\poda32.exe
- %WINDIR%\projone\potcm\athenx32.dll
- %TEMP%\nsabf6a.tmp\system.dll
- %WINDIR%\projone\potcm\lang\zh_cn.json
- %WINDIR%\projone\potcm\lang\lang-2052.dll
- %WINDIR%\projone\potcm\skin\sscreator
- %WINDIR%\projone\potcm\skin\enced_normal.ico
- %WINDIR%\projone\potcm\skin\enced_offline.ico
- %WINDIR%\projone\potcm\skin\enced_unauthorized.ico
- %WINDIR%\projone\potcm\nftdi32.sys
- %WINDIR%\projone\potcm\acagent.exe
- %WINDIR%\projone\potcm\skin\shlext
- %WINDIR%\projone\potcm\skin\clientinfo
- %WINDIR%\projone\potcm\skin\sscannerwnd
- %WINDIR%\projone\potcm\skin\bakviewer
- %WINDIR%\projone\potcm\skin\woumgr
- %WINDIR%\projone\potcm\skin\pochat
- %WINDIR%\projone\potcm\skin\posoftmgr
- %WINDIR%\projone\potcm\athens32.dll
- %TEMP%\setuphlpr.dll
- %WINDIR%\projone\potcm\skin\wfchost
- %WINDIR%\projone\potcm\siriux32.dll
- %WINDIR%\projone\potcm\compress64.dll
- %WINDIR%\projone\potcm\nfentry32.dll
- %WINDIR%\projone\potcm\assisthost.exe
- %WINDIR%\projone\potcm\assisths.exe
- %WINDIR%\projone\potcm\ffebas50
- %WINDIR%\projone\potcm\ffebas51.dll
- %WINDIR%\projone\potcm\ffebas52.dll
- %WINDIR%\projone\potcm\ffebas53.dll
- %WINDIR%\projone\potcm\ffebas54.dll
- %WINDIR%\projone\potcm\protocolfilters.dll
- %WINDIR%\projone\potcm\docext.dll
- %WINDIR%\projone\potcm\nnagent32.dll
- %WINDIR%\projone\potcm\placeholder32.dll
- %WINDIR%\projone\potcm\naca32.dll
- %WINDIR%\projone\potcm\npcap_inst.exe
- %WINDIR%\projone\potcm\winpcap_inst.exe
- %WINDIR%\projone\potcm\nacmacwatch.dll
- %WINDIR%\projone\potcm\frcinst32.dll
- %WINDIR%\projone\potcm\assistda.exe
- %WINDIR%\projone\potcm\assisthc.dll
- %WINDIR%\projone\potcm\poscsaver.exe
- %WINDIR%\projone\potcm\libssl-1_1.dll
- %WINDIR%\projone\potcm\libcrypto-1_1.dll
- %WINDIR%\projone\potcm\hermes32.dll
- %WINDIR%\projone\potcm\spcyex.mui
- %WINDIR%\projone\potcm\spcyex.dll
- %WINDIR%\projone\potcm\patch32.dll
- %WINDIR%\projone\potcm\patch.db
- %WINDIR%\projone\potcm\polocker.exe
- %WINDIR%\projone\potcm\hecate32.dll
- %WINDIR%\projone\potcm\cryptdt.dll
- %WINDIR%\projone\potcm\ssleay64.dll
- %WINDIR%\projone\potcm\sirius32.dll
- %WINDIR%\projone\potcm\podumper32.dll
- %WINDIR%\projone\potcm\sscanner.exe
- %WINDIR%\projone\potcm\bakviewer.exe
- %WINDIR%\projone\potcm\woumgr.exe
- %WINDIR%\projone\potcm\pochat.exe
- %WINDIR%\projone\potcm\sqlcipher32.dll
- %WINDIR%\projone\potcm\pomqc3.dll
- %WINDIR%\projone\potcm\magichk32.dll
- %WINDIR%\projone\potcm\deskmgr32.dll
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009202
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\projone\potcm\cache\patch\ffea3215.dat
Удаляет следующие файлы
- %WINDIR%\projone\potcm\pohost64.exe
- %TEMP%\nsabf6a.tmp\system.dll
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009192.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009194.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009195.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009196.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009197.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009198.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009199.tmp
- %WINDIR%\temp\b78b.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009200.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009201.tmp
- %LOCALAPPDATA%\projone\a0cc00f1\20241029\009202.tmp
Перемещает следующие файлы
- <DRIVERS>\set23d5.tmp в <DRIVERS>\poflt64.sys
Сетевая активность
Подключается к
- 'localhost':49180
- '<LOCALNET>.1.7':13027
Другое
Ищет следующие окна
- ClassName: 'clientInfoWnd' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\projone\potcm\pobus64.exe' /i
- '%WINDIR%\projone\potcm\pobus64.exe'
- '%WINDIR%\projone\potcm\poda32.exe' 6aabbd76
- '%WINDIR%\projone\potcm\assisths.exe'
- '%WINDIR%\projone\potcm\assists.exe'
- '%WINDIR%\projone\potcm\poda64.exe' 6aabbd76_64
- '%WINDIR%\projone\potcm\assisthost.exe' --hidden
- '%WINDIR%\projone\potcm\assistda.exe' --channel_id=2968.0.3516426862
- '%WINDIR%\projone\potcm\clientstat.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\projone\potcm\shlext64.dll
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\projone\potcm\shlext64.dll
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\setupapi.dll,InstallHinfSection DefaultInstall 132 %WINDIR%\projone\potcm\poflt64.inf (со скрытым окном)
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\projone\potcm\assisths.exe' (со скрытым окном)
- '%WINDIR%\projone\potcm\assists.exe' (со скрытым окном)
