Trojan.Inject6.15250

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ec83.tmp\ec84.tmp\ec85.bat
<SYSTEM32>\windowspowershell\v1.0\devcon.exe
<SYSTEM32>\windowspowershell\v1.0\findstr.ps1
<SYSTEM32>\windowspowershell\v1.0\getwlanhwids.exe
<SYSTEM32>\windowspowershell\v1.0\libiconv2.dll
<SYSTEM32>\windowspowershell\v1.0\libintl3.dll
<SYSTEM32>\windowspowershell\v1.0\showusbnumber.exe
<SYSTEM32>\windowspowershell\v1.0\test.exe
<SYSTEM32>\windowspowershell\v1.0\usbview.exe
%TEMP%\__psscriptpolicytest_wbngeh35.cre.ps1
%TEMP%\__psscriptpolicytest_vtrk2dz1.n5f.psm1
%TEMP%\content\2808-4036-getwlanhwids.exe-21-01-31-655.dump
%TEMP%\content\2808-4036-getwlanhwids.exe-21-01-33-132.dump
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\getwlanhwids.exe.log
%TEMP%\__psscriptpolicytest_0kitd0nu.0rx.ps1
%TEMP%\__psscriptpolicytest_0zwfam3i.xys.psm1
%TEMP%\content\2080-1088-getwlanhwids.exe-21-01-35-348.dump
%TEMP%\content\2080-1088-getwlanhwids.exe-21-01-36-397.dump
%TEMP%\__psscriptpolicytest_2wnctetx.5p5.ps1
%TEMP%\__psscriptpolicytest_pfpupwr3.kii.psm1
%TEMP%\content\1960-4076-getwlanhwids.exe-21-01-39-461.dump
%TEMP%\content\1960-4076-getwlanhwids.exe-21-01-40-546.dump
%TEMP%\__psscriptpolicytest_nw1habpf.2tj.ps1
%TEMP%\__psscriptpolicytest_didclled.rzn.psm1
%TEMP%\content\3772-2884-getwlanhwids.exe-21-01-43-498.dump
%TEMP%\content\3772-2884-getwlanhwids.exe-21-01-44-626.dump
%TEMP%\__psscriptpolicytest_5swstu1w.os5.ps1
%TEMP%\__psscriptpolicytest_qwqdr2y2.rfo.psm1
%TEMP%\content\3784-2704-getwlanhwids.exe-21-01-47-452.dump
%TEMP%\content\3784-2704-getwlanhwids.exe-21-01-48-591.dump
%TEMP%\__psscriptpolicytest_i0kfndrk.rbg.ps1
%TEMP%\__psscriptpolicytest_0moxk3if.xne.psm1
%TEMP%\content\4404-1416-getwlanhwids.exe-21-01-51-992.dump
%TEMP%\content\4404-1416-getwlanhwids.exe-21-01-53-568.dump
%TEMP%\__psscriptpolicytest_wa1mku4z.kvo.ps1
%TEMP%\__psscriptpolicytest_ebeo0wzl.i31.psm1
%TEMP%\content\3688-1144-getwlanhwids.exe-21-01-56-683.dump
%TEMP%\content\3688-1144-getwlanhwids.exe-21-01-57-981.dump
%TEMP%\__psscriptpolicytest_3qqw5gjt.uzz.ps1
%TEMP%\__psscriptpolicytest_x51lchrn.me4.psm1
%TEMP%\content\3244-4140-getwlanhwids.exe-21-02-00-705.dump
%TEMP%\content\3244-4140-getwlanhwids.exe-21-02-02-529.dump
%TEMP%\__psscriptpolicytest_skb1r4ga.ix4.ps1
%TEMP%\__psscriptpolicytest_dcvhpywe.pkw.psm1
%TEMP%\content\408-816-getwlanhwids.exe-21-02-05-665.dump
%TEMP%\content\408-816-getwlanhwids.exe-21-02-07-526.dump
%TEMP%\__psscriptpolicytest_3xwpoldv.4fv.ps1
%TEMP%\__psscriptpolicytest_10il5rjg.rkn.psm1
%TEMP%\content\4388-3752-getwlanhwids.exe-21-02-10-930.dump
%TEMP%\content\4388-3752-getwlanhwids.exe-21-02-12-246.dump
%TEMP%\__psscriptpolicytest_5rfndc1a.55l.ps1
%TEMP%\__psscriptpolicytest_sjwjjtqd.gjj.psm1
%TEMP%\content\3792-3908-getwlanhwids.exe-21-02-15-670.dump
%TEMP%\content\3792-3908-getwlanhwids.exe-21-02-17-497.dump
%TEMP%\__psscriptpolicytest_bmllamlc.ovk.ps1
%TEMP%\__psscriptpolicytest_wbakoxid.ywc.psm1
%TEMP%\content\4016-1376-getwlanhwids.exe-21-02-24-909.dump
%TEMP%\content\4016-1376-getwlanhwids.exe-21-02-27-425.dump
%TEMP%\__psscriptpolicytest_2fhcoo2y.xay.ps1
%TEMP%\__psscriptpolicytest_tosbvq5o.jsr.psm1
%TEMP%\content\1020-1648-getwlanhwids.exe-21-02-31-110.dump
%TEMP%\content\1020-1648-getwlanhwids.exe-21-02-32-605.dump
%TEMP%\__psscriptpolicytest_p5midcas.nsq.ps1
%TEMP%\__psscriptpolicytest_t0d4f41s.zqz.psm1
%TEMP%\content\3272-1100-getwlanhwids.exe-21-02-35-659.dump
%TEMP%\content\3272-1100-getwlanhwids.exe-21-02-37-091.dump
%TEMP%\__psscriptpolicytest_4odkyj1f.hl0.ps1
%TEMP%\__psscriptpolicytest_d15pkaot.dhb.psm1
%TEMP%\content\4404-3252-getwlanhwids.exe-21-02-48-341.dump
%TEMP%\content\4404-3252-getwlanhwids.exe-21-02-52-022.dump
%TEMP%\__psscriptpolicytest_buc3lr1y.i4o.ps1
%TEMP%\__psscriptpolicytest_evugvpbg.22x.psm1
%TEMP%\content\3688-4020-getwlanhwids.exe-21-02-58-718.dump
%TEMP%\content\3688-4020-getwlanhwids.exe-21-03-01-259.dump
%TEMP%\__psscriptpolicytest_jp43f0na.pa2.ps1
%TEMP%\__psscriptpolicytest_i1bzndlj.wxc.psm1
%TEMP%\content\3512-2076-getwlanhwids.exe-21-03-05-615.dump

Удаляет файлы, которые сам же создал

%TEMP%\__psscriptpolicytest_wbngeh35.cre.ps1
%TEMP%\__psscriptpolicytest_vtrk2dz1.n5f.psm1
%TEMP%\__psscriptpolicytest_0kitd0nu.0rx.ps1
%TEMP%\__psscriptpolicytest_0zwfam3i.xys.psm1
%TEMP%\__psscriptpolicytest_2wnctetx.5p5.ps1
%TEMP%\__psscriptpolicytest_pfpupwr3.kii.psm1
%TEMP%\__psscriptpolicytest_nw1habpf.2tj.ps1
%TEMP%\__psscriptpolicytest_didclled.rzn.psm1
%TEMP%\__psscriptpolicytest_5swstu1w.os5.ps1
%TEMP%\__psscriptpolicytest_qwqdr2y2.rfo.psm1
%TEMP%\__psscriptpolicytest_i0kfndrk.rbg.ps1
%TEMP%\__psscriptpolicytest_0moxk3if.xne.psm1
%TEMP%\__psscriptpolicytest_wa1mku4z.kvo.ps1
%TEMP%\__psscriptpolicytest_ebeo0wzl.i31.psm1
%TEMP%\__psscriptpolicytest_3qqw5gjt.uzz.ps1
%TEMP%\__psscriptpolicytest_x51lchrn.me4.psm1
%TEMP%\__psscriptpolicytest_skb1r4ga.ix4.ps1
%TEMP%\__psscriptpolicytest_dcvhpywe.pkw.psm1
%TEMP%\__psscriptpolicytest_3xwpoldv.4fv.ps1
%TEMP%\__psscriptpolicytest_10il5rjg.rkn.psm1
%TEMP%\__psscriptpolicytest_5rfndc1a.55l.ps1
%TEMP%\__psscriptpolicytest_sjwjjtqd.gjj.psm1
%TEMP%\__psscriptpolicytest_bmllamlc.ovk.ps1
%TEMP%\__psscriptpolicytest_wbakoxid.ywc.psm1
%TEMP%\__psscriptpolicytest_2fhcoo2y.xay.ps1
%TEMP%\__psscriptpolicytest_tosbvq5o.jsr.psm1
%TEMP%\__psscriptpolicytest_p5midcas.nsq.ps1
%TEMP%\__psscriptpolicytest_t0d4f41s.zqz.psm1
%TEMP%\__psscriptpolicytest_4odkyj1f.hl0.ps1
%TEMP%\__psscriptpolicytest_d15pkaot.dhb.psm1
%TEMP%\__psscriptpolicytest_buc3lr1y.i4o.ps1
%TEMP%\__psscriptpolicytest_evugvpbg.22x.psm1
%TEMP%\__psscriptpolicytest_jp43f0na.pa2.ps1
%TEMP%\__psscriptpolicytest_i1bzndlj.wxc.psm1

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\getwlanhwids.exe'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\EC83.tmp\EC84.tmp\EC85.bat <Полный путь к файлу>" (со скрытым окном)
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\findstr.ps1"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\libiconv2.dll"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\libintl3.dll"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\usbview.exe"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\TEST.exe"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\showusbnumber.exe"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\devcon.exe"
'<SYSTEM32>\attrib.exe' +S +H "<Текущая директория>\getwlanhwids.exe"
'<SYSTEM32>\netsh.exe' wlan show interfaces
'<SYSTEM32>\timeout.exe' 1