Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurityService' = '%LOCALAPPDATA%\Microsoft\WindowsServices\WindowsSecurityService.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsSecurityService' = '%LOCALAPPDATA%\Microsoft\WindowsServices\WindowsSecurityService.exe'
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowssecurityservice.exe
- <SYSTEM32>\tasks\windowssecurityupdate
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei46122\crypto\cipher\_arc4.pyd
- %TEMP%\_mei46122\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei46122\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei46122\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei46122\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei46122\crypto\hash\_blake2b.pyd
- %TEMP%\_mei46122\crypto\hash\_blake2s.pyd
- %TEMP%\_mei46122\crypto\hash\_md2.pyd
- %TEMP%\_mei46122\crypto\hash\_md4.pyd
- %TEMP%\_mei46122\crypto\hash\_md5.pyd
- %TEMP%\_mei46122\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei46122\crypto\hash\_sha1.pyd
- %TEMP%\_mei46122\crypto\hash\_sha224.pyd
- %TEMP%\_mei46122\crypto\hash\_sha256.pyd
- %TEMP%\_mei46122\crypto\hash\_sha384.pyd
- %TEMP%\_mei46122\crypto\hash\_sha512.pyd
- %TEMP%\_mei46122\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei46122\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei46122\crypto\hash\_keccak.pyd
- %TEMP%\_mei46122\crypto\hash\_poly1305.pyd
- %TEMP%\_mei46122\crypto\math\_modexp.pyd
- %TEMP%\_mei46122\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei46122\crypto\publickey\_curve25519.pyd
- %TEMP%\_mei46122\crypto\publickey\_curve448.pyd
- %TEMP%\_mei46122\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei46122\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei46122\crypto\publickey\_ed448.pyd
- %TEMP%\_mei46122\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei46122\crypto\util\_strxor.pyd
- %TEMP%\_mei46122\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei46122\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei46122\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei46122\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei46122\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei46122\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei46122\vcruntime140.dll
- %TEMP%\_mei46122\vcruntime140_1.dll
- %TEMP%\_mei46122\_asyncio.pyd
- %TEMP%\_mei46122\_bz2.pyd
- %TEMP%\_mei46122\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei46122\_ctypes.pyd
- %TEMP%\_mei46122\_decimal.pyd
- %TEMP%\_mei46122\_elementtree.pyd
- %TEMP%\_mei46122\_hashlib.pyd
- %TEMP%\_mei46122\_lzma.pyd
- %TEMP%\_mei46122\_multiprocessing.pyd
- %TEMP%\_mei46122\_overlapped.pyd
- %TEMP%\_mei46122\_queue.pyd
- %TEMP%\_mei46122\_socket.pyd
- %TEMP%\_mei46122\_sqlite3.pyd
- %TEMP%\_mei46122\_ssl.pyd
- %TEMP%\_mei46122\_uuid.pyd
- %TEMP%\_mei46122\_wmi.pyd
- %TEMP%\_mei46122\attrs-25.3.0.dist-info\installer
- %TEMP%\_mei46122\attrs-25.3.0.dist-info\metadata
- %TEMP%\_mei46122\attrs-25.3.0.dist-info\record
- %TEMP%\_mei46122\attrs-25.3.0.dist-info\wheel
- %TEMP%\_mei46122\attrs-25.3.0.dist-info\licenses\license
- %TEMP%\_mei46122\base_library.zip
- %TEMP%\_mei46122\certifi\cacert.pem
- %TEMP%\_mei46122\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei46122\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei46122\libcrypto-3.dll
- %TEMP%\_mei46122\libffi-8.dll
- %TEMP%\_mei46122\libssl-3.dll
- %TEMP%\_mei46122\modules\__init__.py
- %TEMP%\_mei46122\modules\advanced.py
- %TEMP%\_mei46122\modules\auto_login.py
- %TEMP%\_mei46122\modules\browser.py
- %TEMP%\_mei46122\modules\files.py
- %TEMP%\_mei46122\modules\pdf_rat.py
- %TEMP%\_mei46122\modules\persistence.py
- %TEMP%\_mei46122\modules\sender.py
- %TEMP%\_mei46122\modules\system.py
- %TEMP%\_mei46122\modules\tokens.py
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\delvewheel
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\installer
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\license.txt
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\metadata
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\record
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\wheel
- %TEMP%\_mei46122\numpy-2.2.6.dist-info\entry_points.txt
- %TEMP%\_mei46122\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
- %TEMP%\_mei46122\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
- %TEMP%\_mei46122\numpy\_core\_multiarray_tests.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\fft\_pocketfft_umath.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_bounded_integers.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_common.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_generator.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_mt19937.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_pcg64.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_philox.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\_sfc64.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\bit_generator.cp313-win_amd64.pyd
- %TEMP%\_mei46122\numpy\random\mtrand.cp313-win_amd64.pyd
- %TEMP%\_mei46122\psutil\_psutil_windows.pyd
- %TEMP%\_mei46122\pyexpat.pyd
- %TEMP%\_mei46122\python3.dll
- %TEMP%\_mei46122\python313.dll
- %TEMP%\_mei46122\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei46122\select.pyd
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei46122\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei46122\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei46122\sqlite3.dll
- %TEMP%\_mei46122\unicodedata.pyd
- %TEMP%\_mei46122\win32\win32clipboard.pyd
- %TEMP%\_mei46122\win32\win32crypt.pyd
- %TEMP%\_mei46122\win32\win32gui.pyd
- %TEMP%\_mei46122\win32\win32pdh.pyd
- %LOCALAPPDATA%\microsoft\windowsservices\windowssecurityservice.exe
- %TEMP%\data_2025-09-16_08-34-48\browsers\default_login data.db
Сетевая активность
Подключается к
- 'ap#.#pify.org':443
TCP
Другие
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
Другое
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /query /tn WindowsSecurityUpdate
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsSecurityUpdate /tr %LOCALAPPDATA%\Microsoft\WindowsServices\WindowsSecurityService.exe /sc onlogon /ru SYSTEM /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName, productState | ConvertTo-Json"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName, productState | ConvertTo-Json"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled | ConvertTo-Json"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled | ConvertTo-Json"
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Where-Obj... (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Where-Object DisplayName...
