Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\RQ5RO9BR] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\RQ5RO9BR] 'ImagePath' = '%ALLUSERSPROFILE%\p109v35uQ5FS\a7hrt9WNF69O.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\C7Cv6e0r4Lwd.sys'
Создает следующие сервисы
- 'RQ5RO9BR' %ALLUSERSPROFILE%\p109v35uQ5FS\a7hrt9WNF69O.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\C7Cv6e0r4Lwd.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Журнал событий Windows (Windows Event Logging)
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\p109v35uq5fs\a7hrt9wnf69o.exe
- %WINDIR%\temp\__psscriptpolicytest_negygq30.2ic.ps1
- %WINDIR%\temp\__psscriptpolicytest_varuqpjt.xds.psm1
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-38-537.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-38-722.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-38-807.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-38-938.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-38-970.dump
- %WINDIR%\temp\__psscriptpolicytest_wa0i4bdb.stt.ps1
- %WINDIR%\temp\__psscriptpolicytest_nmtezljb.iln.psm1
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-39-124.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-39-155.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-46-139.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-46-239.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-47-029.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-47-126.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-47-253.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-47-277.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-47-298.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-51-460.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-51-491.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-51-531.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-51-593.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-52-368.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-52-437.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-52-468.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-53-993.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-54-008.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-54-093.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-54-124.dump
- %WINDIR%\temp\content\2844-4744-powershell.exe-09-56-54-294.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\c7cv6e0r4lwd.sys
- %WINDIR%\temp\__psscriptpolicytest_ccszqtta.aoc.ps1
- %WINDIR%\temp\__psscriptpolicytest_nhio2k1y.qw4.psm1
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-141.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-326.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-504.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-693.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-744.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-757.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-824.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-871.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-906.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-12-949.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-451.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-535.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-567.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-582.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-636.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-683.dump
- %WINDIR%\temp\content\4112-3116-powershell.exe-09-57-13-768.dump
- %WINDIR%\temp\__psscriptpolicytest_wkmp2a5x.pgf.ps1
- %WINDIR%\temp\__psscriptpolicytest_deeaw1r0.sdx.psm1
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-111.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-265.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-447.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-646.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-689.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-721.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-762.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-783.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-830.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-16-861.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-17-708.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-071.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-114.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-125.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-134.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-175.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-222.dump
- %WINDIR%\temp\content\3968-1624-powershell.exe-09-57-18-307.dump
Удаляет файлы, которые сам же создал
- %WINDIR%\temp\__psscriptpolicytest_negygq30.2ic.ps1
- %WINDIR%\temp\__psscriptpolicytest_varuqpjt.xds.psm1
- %WINDIR%\temp\__psscriptpolicytest_wa0i4bdb.stt.ps1
- %WINDIR%\temp\__psscriptpolicytest_nmtezljb.iln.psm1
- %WINDIR%\temp\__psscriptpolicytest_ccszqtta.aoc.ps1
- %WINDIR%\temp\__psscriptpolicytest_nhio2k1y.qw4.psm1
- %WINDIR%\temp\__psscriptpolicytest_wkmp2a5x.pgf.ps1
- %WINDIR%\temp\__psscriptpolicytest_deeaw1r0.sdx.psm1
Сетевая активность
Подключается к
- 'po##.#ashvault.pro':443
TCP
Другие
- 'po##.#ashvault.pro':443
UDP
- DNS ASK po##.#ashvault.pro
Другое
Создает и запускает на исполнение
- '%ALLUSERSPROFILE%\p109v35uq5fs\a7hrt9wnf69o.exe'
Запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAd...
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' delete "RQ5RO9BR"
- '<SYSTEM32>\sc.exe' create "RQ5RO9BR" binpath= "%ALLUSERSPROFILE%\p109v35uQ5FS\a7hrt9WNF69O.exe" start= "auto"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "RQ5RO9BR"
- '<SYSTEM32>\conhost.exe'
