Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'ImagePath' = '<SYSTEM32>\winsvc.exe'
Создает следующие сервисы
- 'winsvc' <SYSTEM32>\winsvc.exe
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' "/F" "/IM" "winnet.exe"
- '<SYSTEM32>\taskkill.exe' "/F" "/IM" "wincfg.exe"
Изменения в файловой системе
Создает следующие файлы
- <SYSTEM32>\.co7333.tmp
- %TEMP%\temp-ac9d110330697a59\o
- %TEMP%\temp-93259fd31b3279e4\o
- %TEMP%\temp-f4c5b89fbc2fbff4\o
- %TEMP%\temp-b97d2236503a6744\o
- %WINDIR%\temp\__psscriptpolicytest_h2ch3pxb.hfn.ps1
- %WINDIR%\temp\__psscriptpolicytest_5shdmxpp.25y.psm1
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-43-985.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-44-225.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-44-354.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-44-617.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-44-746.dump
- %WINDIR%\temp\__psscriptpolicytest_05y5t3uq.mjb.ps1
- %WINDIR%\temp\__psscriptpolicytest_h0uucfga.5xk.psm1
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-45-349.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-45-427.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-45-496.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-45-628.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-105.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-391.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-607.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-661.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-692.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-739.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-777.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-824.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-46-862.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-152.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-221.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-253.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-268.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-306.dump
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-338.dump
- %WINDIR%\temp\temp-9d0514412bcb479e\e
- %WINDIR%\temp\content\1468-4988-powershell.exe-21-29-48-391.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_of3nqexb.gi4.ps1
- %WINDIR%\temp\__psscriptpolicytest_bjqvdxj4.5yc.psm1
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-50-333.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-50-592.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-50-699.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-50-874.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-50-914.dump
- %WINDIR%\temp\__psscriptpolicytest_w30vj5pm.jhl.ps1
- %WINDIR%\temp\__psscriptpolicytest_xi4lapu3.1hc.psm1
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-079.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-100.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-153.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-258.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-376.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-462.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-570.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-603.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-635.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-667.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-699.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-728.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-51-751.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-142.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-198.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-231.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-274.dump
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-296.dump
- %WINDIR%\temp\temp-168c619f6e3dc13d\e
- %WINDIR%\temp\content\4680-2736-powershell.exe-21-29-52-338.dump
- %WINDIR%\temp\__psscriptpolicytest_waqmgdd1.exw.ps1
- %WINDIR%\temp\__psscriptpolicytest_nv04cmk4.ldt.psm1
- %WINDIR%\temp\content\4688-3936-powershell.exe-21-29-54-126.dump
- %WINDIR%\temp\content\4688-3936-powershell.exe-21-29-54-698.dump
- %WINDIR%\temp\__psscriptpolicytest_n4jolnx1.mdt.ps1
- %WINDIR%\temp\__psscriptpolicytest_o1zzdg4w.ngw.psm1
- %WINDIR%\temp\content\3380-1984-powershell.exe-21-29-56-003.dump
- %WINDIR%\temp\content\3380-1984-powershell.exe-21-29-56-541.dump
- %WINDIR%\temp\__psscriptpolicytest_wytfhvgr.vmt.ps1
- %WINDIR%\temp\__psscriptpolicytest_vklctl5n.w0o.psm1
- %WINDIR%\temp\content\4300-3236-powershell.exe-21-29-58-087.dump
- %WINDIR%\temp\content\4300-3236-powershell.exe-21-29-58-747.dump
- %WINDIR%\temp\__psscriptpolicytest_znpir0kj.ehf.ps1
- %WINDIR%\temp\__psscriptpolicytest_hchoo43c.zl3.psm1
- %WINDIR%\temp\content\3492-3916-powershell.exe-21-30-00-602.dump
- %WINDIR%\temp\content\3492-3916-powershell.exe-21-30-01-304.dump
- %WINDIR%\temp\__psscriptpolicytest_kftznruc.qhl.ps1
- %WINDIR%\temp\__psscriptpolicytest_sbihchex.koa.psm1
- %WINDIR%\temp\content\3764-212-powershell.exe-21-30-03-969.dump
- %WINDIR%\temp\content\3764-212-powershell.exe-21-30-05-067.dump
- %WINDIR%\temp\temp-d438a06d72b23cf8\e
- %WINDIR%\temp\temp-9c311138fdaf0b5c\e
- %WINDIR%\temp\temp-387f62bec79658c2\e
- %WINDIR%\temp\temp-d7c1d8b70f1d12e9\e
- <SYSTEM32>\winnet.exe
- <SYSTEM32>\wincfg.exe
- %WINDIR%\temp\__psscriptpolicytest_3xvhkyff.vnc.ps1
- %WINDIR%\temp\__psscriptpolicytest_xj42blrg.2ll.psm1
Удаляет файлы, которые сам же создал
- %TEMP%\temp-ac9d110330697a59\o
- %TEMP%\temp-93259fd31b3279e4\o
- %TEMP%\temp-f4c5b89fbc2fbff4\o
- %TEMP%\temp-b97d2236503a6744\o
- %WINDIR%\temp\__psscriptpolicytest_h2ch3pxb.hfn.ps1
- %WINDIR%\temp\__psscriptpolicytest_5shdmxpp.25y.psm1
- %WINDIR%\temp\__psscriptpolicytest_05y5t3uq.mjb.ps1
- %WINDIR%\temp\__psscriptpolicytest_h0uucfga.5xk.psm1
- %WINDIR%\temp\temp-9d0514412bcb479e\e
- %WINDIR%\temp\__psscriptpolicytest_of3nqexb.gi4.ps1
- %WINDIR%\temp\__psscriptpolicytest_bjqvdxj4.5yc.psm1
- %WINDIR%\temp\__psscriptpolicytest_w30vj5pm.jhl.ps1
- %WINDIR%\temp\__psscriptpolicytest_xi4lapu3.1hc.psm1
- %WINDIR%\temp\temp-168c619f6e3dc13d\e
- %WINDIR%\temp\__psscriptpolicytest_waqmgdd1.exw.ps1
- %WINDIR%\temp\__psscriptpolicytest_nv04cmk4.ldt.psm1
- %WINDIR%\temp\__psscriptpolicytest_n4jolnx1.mdt.ps1
- %WINDIR%\temp\__psscriptpolicytest_o1zzdg4w.ngw.psm1
- %WINDIR%\temp\__psscriptpolicytest_wytfhvgr.vmt.ps1
- %WINDIR%\temp\__psscriptpolicytest_vklctl5n.w0o.psm1
- %WINDIR%\temp\__psscriptpolicytest_znpir0kj.ehf.ps1
- %WINDIR%\temp\__psscriptpolicytest_hchoo43c.zl3.psm1
- %WINDIR%\temp\__psscriptpolicytest_kftznruc.qhl.ps1
- %WINDIR%\temp\__psscriptpolicytest_sbihchex.koa.psm1
- %WINDIR%\temp\temp-d438a06d72b23cf8\e
- %WINDIR%\temp\temp-9c311138fdaf0b5c\e
- %WINDIR%\temp\temp-387f62bec79658c2\e
- %WINDIR%\temp\temp-d7c1d8b70f1d12e9\e
- %WINDIR%\temp\__psscriptpolicytest_3xvhkyff.vnc.ps1
- %WINDIR%\temp\__psscriptpolicytest_xj42blrg.2ll.psm1
Перемещает следующие файлы
- <SYSTEM32>\.co7333.tmp в <SYSTEM32>\winsvc.exe
Самоудаляется.
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\winsvc.exe' "<Полный путь к файлу>"
- '<SYSTEM32>\winsvc.exe'
Запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"<SYSTEM32>\winsvc.exe\"" "DisplayName=\"Windows System Service...
- '<SYSTEM32>\sc.exe' create winsvc type=own start=auto error=ignore binPath=<SYSTEM32>\winsvc.exe "DisplayName=Windows System Service"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
- '<SYSTEM32>\sc.exe' failure winsvc reset=0 actions=restart/0/restart/0/restart/0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
- '<SYSTEM32>\sc.exe' description winsvc "Windows System Service is the main system supervision service."
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "start" "winsvc"
- '<SYSTEM32>\sc.exe' start winsvc
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"<SYSTEM32>\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"%WINDIR%\Temp\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
- '<SYSTEM32>\powercfg.exe' -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
- '<SYSTEM32>\powercfg.exe' -change standby-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
- '<SYSTEM32>\powercfg.exe' -change standby-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
- '<SYSTEM32>\powercfg.exe' -change hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
- '<SYSTEM32>\powercfg.exe' -change hibernate-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"<SYSTEM32>\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTrave...
