Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%ProgramFiles%\Google\Libs\WR64.sys'
Создает следующие сервисы
- 'WinRing0_1_2_0' %ProgramFiles%\Google\Libs\WR64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles%\google\chrome\updater.exe
- %WINDIR%\temp\__psscriptpolicytest_do1o4kyw.1n4.ps1
- %WINDIR%\temp\__psscriptpolicytest_urchw3mi.hmd.psm1
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-20-512.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-20-760.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-20-881.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-073.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-119.dump
- %WINDIR%\temp\__psscriptpolicytest_2ajrz3ws.0hx.ps1
- %WINDIR%\temp\__psscriptpolicytest_ndpdas1d.icg.psm1
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-346.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-393.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-462.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-616.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-789.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-21-905.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-080.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-155.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-197.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-247.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-310.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-352.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-403.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-927.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-22-996.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-23-043.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-23-059.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-23-112.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-23-159.dump
- %WINDIR%\temp\content\2448-996-powershell.exe-22-08-23-282.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_l3ljvm0l.yzm.ps1
- %WINDIR%\temp\__psscriptpolicytest_m1oflf4c.isd.psm1
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-29-443.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-29-946.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-094.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-313.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-380.dump
- %WINDIR%\temp\__psscriptpolicytest_glloxjwk.zmm.ps1
- %WINDIR%\temp\__psscriptpolicytest_43tq0vyj.m03.psm1
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-825.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-879.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-30-967.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-135.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-364.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-734.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-800.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-944.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-31-999.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-32-089.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-32-691.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-32-799.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-33-076.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-33-186.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-33-251.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-33-312.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-33-968.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-34-273.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-34-507.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-34-586.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-199.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-210.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-218.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-221.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-233.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-399.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-415.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-547.dump
- %WINDIR%\temp\content\3752-1384-powershell.exe-22-08-35-630.dump
- %WINDIR%\temp\hugisnatimaz.tmp
- %ProgramFiles%\google\libs\wr64.sys
Удаляет файлы, которые сам же создал
- %WINDIR%\temp\__psscriptpolicytest_do1o4kyw.1n4.ps1
- %WINDIR%\temp\__psscriptpolicytest_urchw3mi.hmd.psm1
- %WINDIR%\temp\__psscriptpolicytest_2ajrz3ws.0hx.ps1
- %WINDIR%\temp\__psscriptpolicytest_ndpdas1d.icg.psm1
- %WINDIR%\temp\__psscriptpolicytest_l3ljvm0l.yzm.ps1
- %WINDIR%\temp\__psscriptpolicytest_m1oflf4c.isd.psm1
- %WINDIR%\temp\__psscriptpolicytest_glloxjwk.zmm.ps1
- %WINDIR%\temp\__psscriptpolicytest_43tq0vyj.m03.psm1
- %WINDIR%\temp\hugisnatimaz.tmp
Подменяет следующие файлы
- %WINDIR%\temp\hugisnatimaz.tmp
Изменяет файл HOSTS.
Сетевая активность
Подключается к
- 'xm#####.nanopool.org':10343
TCP
Другие
- 'xm#####.nanopool.org':10343
UDP
- DNS ASK xm#####.nanopool.org
Другое
Создает и запускает на исполнение
- '%ProgramFiles%\google\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#sjcyfxlr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFile...
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#sjcyfxlr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFile...
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\conhost.exe'
- '%WINDIR%\explorer.exe'
