Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\NUXCTTKD] 'ImagePath' = '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\sejwafmrhmsx.sys'
Создает следующие сервисы
- 'NUXCTTKD' %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\sejwafmrhmsx.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Журнал событий Windows (Windows Event Logging)
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\applicationframehost.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\wusa.exe
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
- sletikpcfccn.exe
- silent crypto miner builder.exe
Перехватывает функции
в браузерах
- Процесс firefox.exe, модуль advapi32.dll
- Процесс iexplore.exe, модуль advapi32.dll
Патчит код
в динамической библиотеке
- Процесс dialer.exe, модуль KERNEL32.dll
- Процесс runtimebroker.exe, модуль ADVAPI32.dll
- Процесс jfrlitn.exe, модуль SECHOST.dll
- Процесс jfrlitn.exe, модуль ADVAPI32.dll
- Процесс svchost.exe, модуль SECHOST.dll
- Процесс svchost.exe, модуль ADVAPI32.dll
- Процесс powercfg.exe, модуль SECHOST.dll
- Процесс powercfg.exe, модуль ADVAPI32.dll
- Процесс sc.exe, модуль SECHOST.dll
- Процесс sc.exe, модуль ADVAPI32.dll
- Процесс powershell.exe, модуль SECHOST.dll
- Процесс powershell.exe, модуль ADVAPI32.dll
- Процесс silent crypto miner builder.exe, модуль SECHOST.dll
- Процесс silent crypto miner builder.exe, модуль ADVAPI32.dll
- Процесс cmd.exe, модуль SECHOST.dll
- Процесс cmd.exe, модуль ADVAPI32.dll
- Процесс wusa.exe, модуль SECHOST.dll
- Процесс wusa.exe, модуль ADVAPI32.dll
в динамической библиотеке NTDLL
- Процесс dialer.exe, модуль ntdll.dll
- Процесс jfrlitn.exe, модуль ntdll.dll
- Процесс svchost.exe, модуль ntdll.dll
- Процесс powercfg.exe, модуль ntdll.dll
- Процесс sc.exe, модуль ntdll.dll
- Процесс powershell.exe, модуль ntdll.dll
- Процесс silent crypto miner builder.exe, модуль ntdll.dll
- Процесс cmd.exe, модуль ntdll.dll
- Процесс wusa.exe, модуль ntdll.dll
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\dialer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei33362\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei33362\vcruntime140.dll
- %TEMP%\_mei33362\vcruntime140_1.dll
- %TEMP%\_mei33362\_asyncio.pyd
- %TEMP%\_mei33362\_bz2.pyd
- %TEMP%\_mei33362\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei33362\_ctypes.pyd
- %TEMP%\_mei33362\_decimal.pyd
- %TEMP%\_mei33362\_hashlib.pyd
- %TEMP%\_mei33362\_lzma.pyd
- %TEMP%\_mei33362\_multiprocessing.pyd
- %TEMP%\_mei33362\_overlapped.pyd
- %TEMP%\_mei33362\_queue.pyd
- %TEMP%\_mei33362\_socket.pyd
- %TEMP%\_mei33362\_sqlite3.pyd
- %TEMP%\_mei33362\_ssl.pyd
- %TEMP%\_mei33362\_wmi.pyd
- %TEMP%\_mei33362\base_library.zip
- %TEMP%\_mei33362\certifi\cacert.pem
- %TEMP%\_mei33362\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei33362\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei33362\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei33362\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei33362\libcrypto-3.dll
- %TEMP%\_mei33362\libffi-8.dll
- %TEMP%\_mei33362\libssl-3.dll
- %TEMP%\_mei33362\psutil\_psutil_windows.pyd
- %TEMP%\_mei33362\pyexpat.pyd
- %TEMP%\_mei33362\python3.dll
- %TEMP%\_mei33362\python313.dll
- %TEMP%\_mei33362\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei33362\select.pyd
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei33362\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei33362\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei33362\sqlite3.dll
- %TEMP%\_mei33362\unicodedata.pyd
- %TEMP%\_mei33362\win32\win32api.pyd
- %TEMP%\_mei33362\win32\win32clipboard.pyd
- %TEMP%\_mei33362\win32\win32crypt.pyd
- %TEMP%\_mei33362\win32\win32security.pyd
- %TEMP%\7crhbjq9
- %TEMP%\neet_marker.txt
- %TEMP%\tmpqxl38uan\1.exe
- %TEMP%\tmpcr51huuz\stealer.exe
- %TEMP%\_mei51162\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pythonwin\mfc140u.dll
- %TEMP%\_mei51162\pythonwin\win32ui.pyd
- %TEMP%\_mei51162\vcruntime140.dll
- %TEMP%\_mei51162\vcruntime140_1.dll
- %TEMP%\_mei51162\_asyncio.pyd
- %TEMP%\_mei51162\_bz2.pyd
- %TEMP%\_mei51162\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei51162\_ctypes.pyd
- %TEMP%\_mei51162\_decimal.pyd
- %TEMP%\_mei51162\_elementtree.pyd
- %TEMP%\_mei51162\_hashlib.pyd
- %TEMP%\_mei51162\_lzma.pyd
- %TEMP%\_mei51162\_multiprocessing.pyd
- %TEMP%\_mei51162\_overlapped.pyd
- %TEMP%\_mei51162\_queue.pyd
- %TEMP%\_mei51162\_socket.pyd
- %TEMP%\_mei51162\_sqlite3.pyd
- %TEMP%\_mei51162\_ssl.pyd
- %TEMP%\_mei51162\_wmi.pyd
- %TEMP%\_mei51162\base_library.zip
- %TEMP%\_mei51162\certifi\cacert.pem
- %TEMP%\_mei51162\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei51162\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei51162\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei51162\libcrypto-3.dll
- %TEMP%\_mei51162\libffi-8.dll
- %TEMP%\_mei51162\libssl-3.dll
- %TEMP%\_mei51162\psutil\_psutil_windows.pyd
- %TEMP%\_mei51162\pyexpat.pyd
- %TEMP%\_mei51162\python3.dll
- %TEMP%\_mei51162\python313.dll
- %TEMP%\_mei51162\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei51162\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei51162\select.pyd
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei51162\sqlite3.dll
- %TEMP%\_mei51162\unicodedata.pyd
- %TEMP%\_mei51162\win32\_win32sysloader.pyd
- %TEMP%\_mei51162\win32\win32api.pyd
- %TEMP%\_mei51162\win32\win32clipboard.pyd
- %TEMP%\_mei51162\win32\win32crypt.pyd
- %TEMP%\_mei51162\win32\win32event.pyd
- %TEMP%\_mei51162\win32\win32security.pyd
- %TEMP%\_mei51162\win32\win32trace.pyd
- %ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe
- %WINDIR%\temp\__psscriptpolicytest_ljq0bszu.t2v.ps1
- %WINDIR%\temp\__psscriptpolicytest_lrufudvk.tdm.psm1
- %TEMP%\tmpbv5awo_g\silent crypto miner builder.exe
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-50-332.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-50-755.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-50-941.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-51-202.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-51-331.dump
- %WINDIR%\temp\__psscriptpolicytest_vkt4wx2z.mgb.ps1
- %WINDIR%\temp\__psscriptpolicytest_pg335c1f.eha.psm1
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-51-708.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-51-740.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-51-836.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-52-012.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-52-744.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-324.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-504.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-548.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-581.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-614.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-646.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-686.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-53-721.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-414.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-509.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-565.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-574.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-630.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-675.dump
- %WINDIR%\temp\content\4820-1152-powershell.exe-10-21-54-840.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\sejwafmrhmsx.sys
- %WINDIR%\temp\__psscriptpolicytest_0hwaoh3l.d0g.ps1
- %WINDIR%\temp\__psscriptpolicytest_d2pxw4zo.4t4.psm1
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-09-310.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-09-666.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-09-778.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-09-977.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-10-020.dump
- %WINDIR%\temp\__psscriptpolicytest_y2ue5e2z.hev.ps1
- %WINDIR%\temp\__psscriptpolicytest_coh2c4cc.gns.psm1
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-10-357.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-10-401.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-10-514.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-11-646.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-12-790.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-14-338.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-16-908.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-214.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-361.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-417.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-549.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-642.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-17-845.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-104.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-226.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-292.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-304.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-384.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-439.dump
- %WINDIR%\temp\content\2696-4748-powershell.exe-10-22-19-578.dump
- %WINDIR%\temp\__psscriptpolicytest_bqbxvw1y.oxt.ps1
- %WINDIR%\temp\__psscriptpolicytest_iyxi1ysn.dqp.psm1
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-29-832.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-30-512.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-31-382.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-36-838.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-36-914.dump
- %WINDIR%\temp\__psscriptpolicytest_gcgxwwb1.td0.ps1
- %WINDIR%\temp\__psscriptpolicytest_af3kbbco.cqd.psm1
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-37-473.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-37-519.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-37-640.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-37-858.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-240.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-409.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-635.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-715.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-758.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-803.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-38-879.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-39-049.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-39-092.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-39-894.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-39-991.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-047.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-055.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-057.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-122.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-168.dump
- %WINDIR%\temp\content\1660-420-powershell.exe-10-22-40-277.dump
Удаляет файлы, которые сам же создал
- %TEMP%\7crhbjq9
- %TEMP%\_mei51162\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei51162\base_library.zip
- %TEMP%\_mei51162\certifi\cacert.pem
- %TEMP%\_mei51162\charset_normalizer\cd.cp313-win_amd64.pyd
- %TEMP%\_mei51162\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei51162\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\installer
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\metadata
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\record
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei51162\cryptography-48.0.0.dist-info\wheel
- %TEMP%\_mei51162\libcrypto-3.dll
- %TEMP%\_mei51162\libffi-8.dll
- %TEMP%\_mei51162\libssl-3.dll
- %TEMP%\_mei51162\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei51162\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei51162\psutil\_psutil_windows.pyd
- %TEMP%\_mei51162\pyexpat.pyd
- %TEMP%\_mei51162\python3.dll
- %TEMP%\_mei51162\python313.dll
- %TEMP%\_mei51162\pythonwin\mfc140u.dll
- %TEMP%\_mei51162\pythonwin\win32ui.pyd
- %TEMP%\_mei51162\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei51162\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei51162\select.pyd
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei51162\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei51162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei51162\sqlite3.dll
- %TEMP%\_mei51162\unicodedata.pyd
- %TEMP%\_mei51162\vcruntime140.dll
- %TEMP%\_mei51162\vcruntime140_1.dll
- %TEMP%\_mei51162\win32\win32api.pyd
- %TEMP%\_mei51162\win32\win32clipboard.pyd
- %TEMP%\_mei51162\win32\win32crypt.pyd
- %TEMP%\_mei51162\win32\win32event.pyd
- %TEMP%\_mei51162\win32\win32security.pyd
- %TEMP%\_mei51162\win32\win32trace.pyd
- %TEMP%\_mei51162\win32\_win32sysloader.pyd
- %TEMP%\_mei51162\_asyncio.pyd
- %TEMP%\_mei51162\_bz2.pyd
- %TEMP%\_mei51162\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei51162\_ctypes.pyd
- %TEMP%\_mei51162\_decimal.pyd
- %TEMP%\_mei51162\_elementtree.pyd
- %TEMP%\_mei51162\_hashlib.pyd
- %TEMP%\_mei51162\_lzma.pyd
- %TEMP%\_mei51162\_multiprocessing.pyd
- %TEMP%\_mei51162\_overlapped.pyd
- %TEMP%\_mei51162\_queue.pyd
- %TEMP%\_mei51162\_socket.pyd
- %TEMP%\_mei51162\_sqlite3.pyd
- %TEMP%\_mei51162\_ssl.pyd
- %TEMP%\_mei51162\_wmi.pyd
- %WINDIR%\temp\__psscriptpolicytest_ljq0bszu.t2v.ps1
- %WINDIR%\temp\__psscriptpolicytest_lrufudvk.tdm.psm1
- %WINDIR%\temp\__psscriptpolicytest_vkt4wx2z.mgb.ps1
- %WINDIR%\temp\__psscriptpolicytest_pg335c1f.eha.psm1
- %WINDIR%\temp\__psscriptpolicytest_0hwaoh3l.d0g.ps1
- %WINDIR%\temp\__psscriptpolicytest_d2pxw4zo.4t4.psm1
- %WINDIR%\temp\__psscriptpolicytest_y2ue5e2z.hev.ps1
- %WINDIR%\temp\__psscriptpolicytest_coh2c4cc.gns.psm1
- %WINDIR%\temp\__psscriptpolicytest_bqbxvw1y.oxt.ps1
- %WINDIR%\temp\__psscriptpolicytest_iyxi1ysn.dqp.psm1
- %WINDIR%\temp\__psscriptpolicytest_gcgxwwb1.td0.ps1
- %WINDIR%\temp\__psscriptpolicytest_af3kbbco.cqd.psm1
Сетевая активность
Подключается к
- 'po##.#ashvault.pro':443
TCP
Другие
- 'po##.#ashvault.pro':443
UDP
- DNS ASK po##.#ashvault.pro
Другое
Создает и запускает на исполнение
- '%TEMP%\tmpqxl38uan\1.exe'
- '%TEMP%\tmpcr51huuz\stealer.exe'
- '%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe'
- '%TEMP%\tmpbv5awo_g\silent crypto miner builder.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
- '<SYSTEM32>\calc.exe' (со скрытым окном)
- '%ProgramFiles%\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\calculator.exe' -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "NUXCTTKD"
- '<SYSTEM32>\sc.exe' create "NUXCTTKD" binpath= "%ALLUSERSPROFILE%\yjwwbpjfgyjw\sletikpcfccn.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "NUXCTTKD"
- '%TEMP%\tmpqxl38uan\1.exe' (со скрытым окном)
- '%TEMP%\tmpcr51huuz\stealer.exe' (со скрытым окном)
- '%TEMP%\tmpbv5awo_g\silent crypto miner builder.exe' (со скрытым окном)
