Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\xdwdMalwareDef32.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\xdwd.dll'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\{45ee32a7-8373-4690-8436-46e8543bc165}
- <SYSTEM32>\tasks\{b26e1efc-50c6-4559-8bf6-d420c96bb734}
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
- <SYSTEM32>\tasks\{6c56c99b-72c0-489a-819a-ffb06afc03e5}
- <SYSTEM32>\tasks\{1670eb3f-ba1b-4dee-9f23-5be953640853}
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /im explorer.exe /f
Патчит код
в динамической библиотеке AMSI
- Процесс nonagon.exe, модуль Amsi.dll
- Процесс xdwdmalwaredef32.exe, модуль Amsi.dll
в динамической библиотеке NTDLL
- Процесс nonagon.exe, модуль ntdll.dll
- Процесс taskkill.exe, модуль ntdll.dll
- Процесс timeout.exe, модуль ntdll.dll
- Процесс explorer.exe, модуль ntdll.dll
- Процесс svchost.exe, модуль ntdll.dll
- Процесс xdwdmalwaredef32.exe, модуль ntdll.dll
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\content\5696-2132-<Имя файла>.exe-23-13-53-195.dump
- %TEMP%\server.exe
- %TEMP%\nonagon.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<Имя файла>.exe.log
- %TEMP%\_mei4922\vcruntime140.dll
- %TEMP%\_mei4922\_bz2.pyd
- %TEMP%\_mei4922\_decimal.pyd
- %TEMP%\_mei4922\_hashlib.pyd
- %TEMP%\_mei4922\_lzma.pyd
- %TEMP%\_mei4922\_socket.pyd
- %TEMP%\_mei4922\_ssl.pyd
- %TEMP%\_mei4922\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\content\4376-4264-nonagon.exe-23-13-57-505.dump
- %TEMP%\_mei4922\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei4922\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei4922\base_library.zip
- %TEMP%\_mei4922\libcrypto-1_1.dll
- %TEMP%\_mei4922\libssl-1_1.dll
- %TEMP%\_mei4922\python311.dll
- %TEMP%\_mei4922\select.pyd
- %TEMP%\_mei4922\ucrtbase.dll
- %TEMP%\_mei4922\unicodedata.pyd
- %TEMP%\binary2.ini
- %WINDIR%\xdwdmalwaredef32.exe
- %WINDIR%\web\malwaredef32.exe
- %WINDIR%\xdwd.dll
- nul
- %TEMP%\content\4936-4956-xdwdmalwaredef32.exe-23-15-06-042.dump
- %TEMP%\content\4940-4916-xdwdmalwaredef32.exe-23-15-06-074.dump
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\xdwdmalwaredef32.exe
- %WINDIR%\web\malwaredef32.exe
- %WINDIR%\xdwd.dll
Удаляет файлы, которые сам же создал
- %TEMP%\_mei4922\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei4922\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei4922\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei4922\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei4922\base_library.zip
- %TEMP%\_mei4922\libcrypto-1_1.dll
- %TEMP%\_mei4922\libssl-1_1.dll
- %TEMP%\_mei4922\python311.dll
- %TEMP%\_mei4922\select.pyd
- %TEMP%\_mei4922\ucrtbase.dll
- %TEMP%\_mei4922\unicodedata.pyd
- %TEMP%\_mei4922\vcruntime140.dll
- %TEMP%\_mei4922\_bz2.pyd
- %TEMP%\_mei4922\_decimal.pyd
- %TEMP%\_mei4922\_hashlib.pyd
- %TEMP%\_mei4922\_lzma.pyd
- %TEMP%\_mei4922\_socket.pyd
- %TEMP%\_mei4922\_ssl.pyd
Сетевая активность
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ic###azip.com
- DNS ASK ip##fo.io
- DNS ASK ap#.msn.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\server.exe'
- '%TEMP%\nonagon.exe'
- '%WINDIR%\xdwdmalwaredef32.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' netsh advfirewall firewall add rule name="]m[jJ1S@J[fDJa" dir=in action=allow program="%WINDIR%\xdwdMalwareDef32.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "%WINDIR%\xdwdMalwareDef32.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "" /tr "%WINDIR%\xdwdMalwareDef32.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "%WINDIR%\Web/MalwareDef32.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 30 /tn "" /tr "%WINDIR%\Web/MalwareDef32.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /C taskkill /im explorer.exe /f > NUL 2>&1 && timeout /t 3 /nobreak > NUL && start explorer.exe
- '<SYSTEM32>\timeout.exe' /t 3 /nobreak
- '%WINDIR%\explorer.exe'
- '%WINDIR%\explorer.exe' /NoUACCheck
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
