Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '666999666' = '%LOCALAPPDATA%\<Имя файла>.exe'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\fontdrvhostf
- <SYSTEM32>\tasks\fontdrvhost
- <SYSTEM32>\tasks\searchapps
- <SYSTEM32>\tasks\searchapp
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\windows piskaw
- <SYSTEM32>\tasks\windows piska
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\runtimebrokerr
- <SYSTEM32>\tasks\runtimebroker
- <SYSTEM32>\tasks\sihosts
- <SYSTEM32>\tasks\sihost
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\useroobebrokeru
- <SYSTEM32>\tasks\useroobebroker
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%TEMP%\msblocksavesintohost\portComsurrogate.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\fontdrvhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\SearchApp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Start Menu\Windows piska.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows NT\TableTextService\en-US\fontdrvhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Containers\serviced\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\SchCache\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Media Player\RuntimeBroker.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\sihost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Defender.bak\en-US\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\UserOOBEBroker.exe'
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\<Имя файла>.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
- %TEMP%\windows piska.exe
- %TEMP%\dcratbuild.exe
- %TEMP%\msblocksavesintohost\svzmir2egga6.bat
- %TEMP%\msblocksavesintohost\portcomsurrogate.exe
- %TEMP%\msblocksavesintohost\phdgwlcib2u.vbe
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-201.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-388.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-588.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-634.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-656.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-671.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-772.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-819.dump
- %TEMP%\content\6132-3264-portcomsurrogate.exe-20-26-38-857.dump
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\fontdrvhost.exe
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\5b884080fd4f94
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-39-654.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-40-546.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-41-117.dump
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\searchapp.exe
- C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\38384e6a620884
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-42-007.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-42-596.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-42-954.dump
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\spoolsv.exe
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\f3b6ecef712a24
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-43-244.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-43-479.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-43-694.dump
- %ALLUSERSPROFILE%\start menu\windows piska.exe
- %ALLUSERSPROFILE%\start menu\090feceb564e4a
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-43-942.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-44-134.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-44-354.dump
- %ProgramFiles(x86)%\windows nt\tabletextservice\en-us\fontdrvhost.exe
- %ProgramFiles(x86)%\windows nt\tabletextservice\en-us\5b884080fd4f94
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-44-640.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-44-930.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-45-118.dump
- %WINDIR%\containers\serviced\wininit.exe
- %WINDIR%\containers\serviced\56085415360792
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-45-462.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-45-666.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-45-960.dump
- %WINDIR%\schcache\spoolsv.exe
- %WINDIR%\schcache\f3b6ecef712a24
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-46-155.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-46-426.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-46-762.dump
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\spoolsv.exe
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\f3b6ecef712a24
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-47-193.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-47-406.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-47-609.dump
- %ProgramFiles(x86)%\windows media player\runtimebroker.exe
- %ProgramFiles(x86)%\windows media player\9e8d7a4ca61bd9
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-47-923.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-48-198.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-48-452.dump
- C:\msocache\all users\sihost.exe
- C:\msocache\all users\66fc9ff0ee96c2
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-48-744.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-49-028.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-49-254.dump
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\lsass.exe
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\6203df4a6bafc7
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-49-561.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-49-915.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-50-244.dump
- %ProgramFiles(x86)%\windows defender.bak\en-us\csrss.exe
- %ProgramFiles(x86)%\windows defender.bak\en-us\886983d96e3d3e
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-50-553.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-50-788.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-51-009.dump
- C:\users\default\favorites\useroobebroker.exe
- C:\users\default\favorites\7ccfebd9e92364
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-51-255.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-51-586.dump
- %TEMP%\content\6132-5328-portcomsurrogate.exe-20-26-51-840.dump
- %TEMP%\dadb44289a330fe8d3d886d1bef0b8a34b01d7134.5.32519db8ead89f07aaa87158931ef8b320af2338ef
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\portcomsurrogate.exe.log
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-20-801.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-20-812.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-065.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-097.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-130.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-141.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-160.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-315.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-499.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-511.dump
- %TEMP%\content\3464-2632-spoolsv.exe-20-27-21-599.dump
Присваивает атрибут 'скрытый' для следующих файлов
- <Полный путь к файлу>
Изменяет файл HOSTS.
Сетевая активность
UDP
- DNS ASK gs##tic.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\windows piska.exe'
- '%TEMP%\dcratbuild.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\msblocksavesintohost\PHdgwlcib2U.vbe"
- '%TEMP%\msblocksavesintohost\portcomsurrogate.exe'
- '%ProgramFiles(x86)%\microsoft analysis services\as oledb\spoolsv.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 && DEL /f <Имя файла>.exe
- '%WINDIR%\syswow64\timeout.exe' /t 1
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\msblocksavesintohost\sVzmir2egga6.bat" " (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\fontdrvhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\fontdrvhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\fontdrvhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\SearchApp.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SearchApp" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\SearchApp.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90160000-0116-0409-1000-0000000FF1CE}-C\SearchApp.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90160000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows piskaW" /sc MINUTE /mo 13 /tr "'%ALLUSERSPROFILE%\Start Menu\Windows piska.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows piska" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Start Menu\Windows piska.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows piskaW" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Start Menu\Windows piska.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows NT\TableTextService\en-US\fontdrvhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'%WINDIR%\Containers\serviced\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%WINDIR%\Containers\serviced\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'%WINDIR%\Containers\serviced\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'%WINDIR%\SchCache\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%WINDIR%\SchCache\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'%WINDIR%\SchCache\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Windows Media Player\RuntimeBroker.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBroker" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\sihost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sihost" /sc ONLOGON /tr "'C:\MSOCache\All Users\sihost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\sihost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90160000-0018-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\UserOOBEBroker.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "UserOOBEBroker" /sc ONLOGON /tr "'C:\Users\Default\Favorites\UserOOBEBroker.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "UserOOBEBrokerU" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Favorites\UserOOBEBroker.exe'" /rl HIGHEST /f
- '<SYSTEM32>\wscript.exe' "%TEMP%\41ebb58d-3df9-4bdd-8e01-67934cdfc66e.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\03295ad0-3018-4e4e-a9ff-b6a480fb6c60.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\adae4bca-9290-4352-8788-27ee199bc3bd.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\fe525371-6655-4dee-a89f-40736d8ff02a.vbs"
- '%ProgramFiles(x86)%\microsoft analysis services\as oledb\spoolsv.exe' (со скрытым окном)
