Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WorkFolders' = '%APPDATA%\WorkFolders\server.exe'
Вредоносные функции
Патчит код
в динамической библиотеке AMSI
- Процесс ahmsc.exe, модуль Amsi.dll
в динамической библиотеке NTDLL
- Процесс ahmsc.exe, модуль ntdll.dll
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\onefile_3468_137145_6tmztdknza0\server.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\_bz2.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_cffi_backend.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_ctypes.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_decimal.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_hashlib.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_lzma.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_multiprocessing.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_queue.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_socket.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_sqlite3.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_ssl.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\_wmi.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\config.json
- %TEMP%\onefile_3468_137145_6tmztdknza0\index.html
- %TEMP%\onefile_3468_137145_6tmztdknza0\libcrypto-3.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\libffi-8.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\libssl-3.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\pyexpat.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\python3.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\python312.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\select.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\sqlite3.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\unicodedata.pyd
- %TEMP%\onefile_3468_137145_6tmztdknza0\vcruntime140.dll
- %TEMP%\onefile_3468_137145_6tmztdknza0\bin\abe_key_extractor.exe
- %TEMP%\onefile_3468_137145_6tmztdknza0\bin\chromelevator.exe
- %TEMP%\onefile_3468_137145_6tmztdknza0\cryptography\hazmat\bindings\_rust.pyd
- %APPDATA%\workfolders\bin\abe_key_extractor.exe
- %APPDATA%\workfolders\bin\chromelevator.exe
- %APPDATA%\workfolders\config.json
- %APPDATA%\workfolders\cryptography\hazmat\bindings\_rust.pyd
- %APPDATA%\workfolders\index.html
- %APPDATA%\workfolders\libcrypto-3.dll
- %APPDATA%\workfolders\libffi-8.dll
- %APPDATA%\workfolders\libssl-3.dll
- %APPDATA%\workfolders\pyexpat.pyd
- %APPDATA%\workfolders\python3.dll
- %APPDATA%\workfolders\python312.dll
- %APPDATA%\workfolders\select.pyd
- %APPDATA%\workfolders\server.dll
- %APPDATA%\workfolders\sqlite3.dll
- %APPDATA%\workfolders\unicodedata.pyd
- %APPDATA%\workfolders\vcruntime140.dll
- %APPDATA%\workfolders\_bz2.pyd
- %APPDATA%\workfolders\_cffi_backend.pyd
- %APPDATA%\workfolders\_ctypes.pyd
- %APPDATA%\workfolders\_decimal.pyd
- %APPDATA%\workfolders\_hashlib.pyd
- %APPDATA%\workfolders\_lzma.pyd
- %APPDATA%\workfolders\_multiprocessing.pyd
- %APPDATA%\workfolders\_queue.pyd
- %APPDATA%\workfolders\_socket.pyd
- %APPDATA%\workfolders\_sqlite3.pyd
- %APPDATA%\workfolders\_ssl.pyd
- %APPDATA%\workfolders\_wmi.pyd
- %APPDATA%\workfolders\server.exe
- %APPDATA%\workfolders\_gd.vbs
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a34c507-1114.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a34c50e-688.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a34c507-1114.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a34c50e-688.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\edge_bits_1672_1833846195\dde93974-5cbc-4ecc-898f-436e62207c34
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- 'localhost':8080
TCP
Запросы HTTP GET
- http://lo###host:8080/api/forensics via localhost
Другие
- 'co####.edge.skype.com':443
- 'localhost':49706
- 'localhost':49707
UDP
- DNS ASK co####.edge.skype.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Полный путь к файлу>"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://localhost:8080/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://localhost:8080/ (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @{} # Motherboard try { $mb = Get-CimInstance Win32_BaseBoard; $r.mobo_manufacturer = \"$($mb.Manufacture...
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,1242654634548124921,860887227267228274,131072 --lang=en-US --service-sandbox-type=none --mojo-pl...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() Get-CimInstance Win32_Process | ForEach-Object { $owner = \"\" try { $owner = $_.GetOwner().Us...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() # 64-bit Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*\" -ErrorAction Si...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() Get-AppxPackage -AllUsers -ErrorAction SilentlyContinue | Select-Object -First 100 | ForEach-Object { ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() Get-CimInstance Win32_StartupCommand -ErrorAction SilentlyContinue | ForEach-Object { $r += @{name...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | ForEach-Object { $r += @{name=\"$($_...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " $ErrorActionPreference = 'SilentlyContinue' $r = @() Get-ScheduledTask -ErrorAction SilentlyContinue | Select-Object -First 100 | ForEach-Object { $tas...
