Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\soundpadhelper
- <SYSTEM32>\tasks\soundpadhelpers
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\firefox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Internet Explorer\SIGNUP\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\system\firefox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/mara/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\kms\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%TEMP%\SoundPad\soundpadhelper.exe'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\soundpad\soundpadhelper.exe
- %HOMEPATH%\desktop\wzsvaynw.log
- %HOMEPATH%\desktop\yjowartx.log
- %HOMEPATH%\desktop\oluauuil.log
- %HOMEPATH%\desktop\cxjuwevy.log
- nul
- %TEMP%\rjey1cav4o.bat
- %TEMP%\wu5crgrp6d
- %WINDIR%\system\0fc223bdacedc3
- %WINDIR%\system\firefox.exe
- %ProgramFiles(x86)%\internet explorer\signup\56085415360792
- %ProgramFiles(x86)%\internet explorer\signup\wininit.exe
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\0fc223bdacedc3
- %HOMEPATH%\desktop\nvkfqfyp.log
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\firefox.exe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\spoolsv.exe
- C:\kms\480b7989c529f6
- C:\kms\wudfhost.exe
- %TEMP%\soundpad\01b2aa2be9a880
- %HOMEPATH%\desktop\gcvolkje.log
- %HOMEPATH%\desktop\pgdevezl.log
- %HOMEPATH%\desktop\ykmtfxot.log
- %HOMEPATH%\desktop\auiufput.log
- %HOMEPATH%\desktop\qwnzztji.log
- %HOMEPATH%\desktop\yzhijhyx.log
- %TEMP%\soundpad\o9cyujhdcgnyvqnfvfaclb44ygu6fizgl0qv4hmotqm9krefgei6az.bat
- %TEMP%\soundpad\iikoxwk11lycn5magkwecalmxv.vbe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\f3b6ecef712a24
- %HOMEPATH%\desktop\fscqgmih.log
Удаляет следующие файлы
- %TEMP%\wu5crgrp6d
Сетевая активность
UDP
- 'localhost':123
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\SoundPad\iIkoXWk11lYCn5MAGkWeCalMxv.vbe"
- '%TEMP%\soundpad\soundpadhelper.exe'
- '%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\spoolsv.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\SoundPad\o9cYuJHDCgnyvQNfVfAclb44YgU6FiZgl0QV4hMotqM9kreFGEI6AZ.bat" " (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\rjeY1Cav4O.bat" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "soundpadhelpers" /sc MINUTE /mo 12 /tr "'%TEMP%\SoundPad\soundpadhelper.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "soundpadhelper" /sc ONLOGON /tr "'%TEMP%\SoundPad\soundpadhelper.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "soundpadhelpers" /sc MINUTE /mo 9 /tr "'%TEMP%\SoundPad\soundpadhelper.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\kms\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\kms\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\kms\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%WINDIR%\system\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\system\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'%WINDIR%\system\firefox.exe'" /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
