Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\BITAUNXM] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\BITAUNXM] 'ImagePath' = '%ALLUSERSPROFILE%\fgvdzypifxdm\bmwpxmiwqzuu.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\WinRing0x64.sys'
Создает следующие сервисы
- 'BITAUNXM' %ALLUSERSPROFILE%\fgvdzypifxdm\bmwpxmiwqzuu.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\WinRing0x64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Журнал событий Windows (Windows Event Logging)
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\fgvdzypifxdm\bmwpxmiwqzuu.exe
- %WINDIR%\temp\__psscriptpolicytest_4xoftudl.qqq.ps1
- %WINDIR%\temp\__psscriptpolicytest_ccp2bl4b.kqs.psm1
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-07-655.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-07-853.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-07-915.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-054.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-085.dump
- %WINDIR%\temp\__psscriptpolicytest_k3desoa5.b2k.ps1
- %WINDIR%\temp\__psscriptpolicytest_irfhnphx.d0j.psm1
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-232.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-255.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-301.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-386.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-487.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-556.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-662.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-685.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-706.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-737.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-758.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-778.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-08-799.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-129.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-176.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-214.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-245.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-277.dump
- %WINDIR%\temp\content\4788-792-powershell.exe-12-18-09-330.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\qiutwwxhlnco.sys
- %WINDIR%\temp\__psscriptpolicytest_bxktitzj.mhr.ps1
- %WINDIR%\temp\__psscriptpolicytest_e0vwklyl.hjn.psm1
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-350.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-551.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-636.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-775.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-806.dump
- %WINDIR%\temp\__psscriptpolicytest_14m3cd5z.4dr.ps1
- %WINDIR%\temp\__psscriptpolicytest_as1pzdxp.yqj.psm1
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-940.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-22-956.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-002.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-103.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-210.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-288.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-388.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-424.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-455.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-476.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-497.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-528.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-549.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-915.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-962.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-23-984.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-24-000.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-24-031.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-24-047.dump
- %WINDIR%\temp\content\2772-1992-powershell.exe-12-18-24-101.dump
- %WINDIR%\temp\__psscriptpolicytest_mmsyheyi.uqz.ps1
- %WINDIR%\temp\__psscriptpolicytest_t4vxyg2z.mty.psm1
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-247.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-455.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-541.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-699.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-741.dump
- %WINDIR%\temp\__psscriptpolicytest_4yixdfsf.ju4.ps1
- %WINDIR%\temp\__psscriptpolicytest_5azqfjl5.ji3.psm1
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-941.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-32-974.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-040.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-210.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-436.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-629.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-772.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-804.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-848.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-870.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-901.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-965.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-33-996.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-553.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-708.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-750.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-759.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-761.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-792.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-855.dump
- %WINDIR%\temp\content\656-3440-powershell.exe-12-18-34-937.dump
Удаляет файлы, которые сам же создал
- %WINDIR%\temp\__psscriptpolicytest_4xoftudl.qqq.ps1
- %WINDIR%\temp\__psscriptpolicytest_ccp2bl4b.kqs.psm1
- %WINDIR%\temp\__psscriptpolicytest_k3desoa5.b2k.ps1
- %WINDIR%\temp\__psscriptpolicytest_irfhnphx.d0j.psm1
- %WINDIR%\temp\__psscriptpolicytest_bxktitzj.mhr.ps1
- %WINDIR%\temp\__psscriptpolicytest_e0vwklyl.hjn.psm1
- %WINDIR%\temp\__psscriptpolicytest_14m3cd5z.4dr.ps1
- %WINDIR%\temp\__psscriptpolicytest_as1pzdxp.yqj.psm1
- %WINDIR%\temp\__psscriptpolicytest_mmsyheyi.uqz.ps1
- %WINDIR%\temp\__psscriptpolicytest_t4vxyg2z.mty.psm1
- %WINDIR%\temp\__psscriptpolicytest_4yixdfsf.ju4.ps1
- %WINDIR%\temp\__psscriptpolicytest_5azqfjl5.ji3.psm1
Сетевая активность
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK en#####ts.omniatech.io
- DNS ASK po###on-rpc.com
- DNS ASK po####n.drpc.org
- DNS ASK pa###bin.com
Другое
Создает и запускает на исполнение
- '%ALLUSERSPROFILE%\fgvdzypifxdm\bmwpxmiwqzuu.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "BITAUNXM"
- '<SYSTEM32>\sc.exe' create "BITAUNXM" binpath= "%ALLUSERSPROFILE%\fgvdzypifxdm\bmwpxmiwqzuu.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "BITAUNXM"
