Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\CheckManagerAgent_f549] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\CheckManagerAgent_f549] 'ImagePath' = '%ALLUSERSPROFILE%\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe'
Создает следующие сервисы
- 'CheckManagerAgent_f549' %ALLUSERSPROFILE%\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:UserProfile -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:ProgramData -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:TEMP -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.exe' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.sys' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\nslookup.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\microsoftlogsbebd9ac8\softupdateb320.exe
- %WINDIR%\temp\__psscriptpolicytest_yhvpcjf1.3g5.ps1
- %WINDIR%\temp\__psscriptpolicytest_rs00kqt5.sxb.psm1
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-44-726.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-48-796.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-52-915.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-54-123.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-54-324.dump
- %WINDIR%\temp\__psscriptpolicytest_pgacaeot.acn.ps1
- %WINDIR%\temp\__psscriptpolicytest_4gqoo5d1.2jb.psm1
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-58-613.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-58-683.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-52-59-118.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-00-790.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-04-517.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-13-914.dump
- %WINDIR%\temp\__psscriptpolicytest_evzaludg.n2r.ps1
- %WINDIR%\temp\__psscriptpolicytest_3v2vxfhn.cyp.psm1
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-22-677.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-23-040.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-23-906.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-24-941.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-25-191.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-25-269.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-25-356.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-25-856.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-26-258.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-26-817.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-125.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-233.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-249.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-325.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-382.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-382.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-437.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-446.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-448.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-466.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-513.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-529.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-27-560.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-567.dump
- %WINDIR%\temp\content\3248-2144-powershell.exe-16-53-27-699.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-440.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-561.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-614.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-635.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-638.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-703.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-735.dump
- %WINDIR%\temp\content\1036-1836-powershell.exe-16-53-28-858.dump
- %WINDIR%\temp\__psscriptpolicytest_oi31ouh5.vcg.ps1
- %WINDIR%\temp\__psscriptpolicytest_qxxatasd.xts.psm1
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-35-393.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-35-656.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-35-864.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-055.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-128.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-149.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-190.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-222.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-260.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-291.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-854.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-932.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-36-970.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-37-033.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-37-055.dump
- %WINDIR%\temp\content\3384-4748-powershell.exe-16-53-37-133.dump
- %WINDIR%\temp\__psscriptpolicytest_ursvbvil.g1g.ps1
- %WINDIR%\temp\__psscriptpolicytest_tk043ay1.r3p.psm1
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-42-820.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-033.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-257.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-496.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-572.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-613.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-647.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-687.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-722.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-43-763.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-379.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-494.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-539.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-548.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-551.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-603.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-638.dump
- %WINDIR%\temp\content\3260-788-powershell.exe-16-53-44-726.dump
- %WINDIR%\temp\__psscriptpolicytest_hes4phvw.rwa.ps1
- %WINDIR%\temp\__psscriptpolicytest_czbzncso.bqu.psm1
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-48-183.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-48-369.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-48-538.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-055.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-140.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-198.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-241.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-284.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-327.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-49-381.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-50-438.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-51-958.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-53-050.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-53-091.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-53-114.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-54-351.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-55-006.dump
- %WINDIR%\temp\content\1188-1700-powershell.exe-16-53-55-512.dump
- %WINDIR%\temp\__psscriptpolicytest_yjramatn.guj.ps1
- %WINDIR%\temp\__psscriptpolicytest_pf0tzmqa.ic1.psm1
- %WINDIR%\temp\content\4856-3868-powershell.exe-16-53-59-121.dump
Удаляет файлы, которые сам же создал
- %WINDIR%\temp\__psscriptpolicytest_yhvpcjf1.3g5.ps1
- %WINDIR%\temp\__psscriptpolicytest_rs00kqt5.sxb.psm1
- %WINDIR%\temp\__psscriptpolicytest_pgacaeot.acn.ps1
- %WINDIR%\temp\__psscriptpolicytest_4gqoo5d1.2jb.psm1
- %WINDIR%\temp\__psscriptpolicytest_evzaludg.n2r.ps1
- %WINDIR%\temp\__psscriptpolicytest_3v2vxfhn.cyp.psm1
- %WINDIR%\temp\__psscriptpolicytest_oi31ouh5.vcg.ps1
- %WINDIR%\temp\__psscriptpolicytest_qxxatasd.xts.psm1
- %WINDIR%\temp\__psscriptpolicytest_ursvbvil.g1g.ps1
- %WINDIR%\temp\__psscriptpolicytest_tk043ay1.r3p.psm1
- %WINDIR%\temp\__psscriptpolicytest_hes4phvw.rwa.ps1
- %WINDIR%\temp\__psscriptpolicytest_czbzncso.bqu.psm1
- %WINDIR%\temp\__psscriptpolicytest_yjramatn.guj.ps1
- %WINDIR%\temp\__psscriptpolicytest_pf0tzmqa.ic1.psm1
Самоперемещается
- из <Полный путь к файлу> в \:p
Другое
Создает и запускает на исполнение
- '%ALLUSERSPROFILE%\microsoftlogsbebd9ac8\softupdateb320.exe'
Запускает на исполнение
- '<SYSTEM32>\sc.exe' delete "CheckManagerAgent_f549" (со скрытым окном)
- '<SYSTEM32>\sc.exe' create "CheckManagerAgent_f549" binpath= "%ALLUSERSPROFILE%\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe" start= "auto" (со скрытым окном)
- '<SYSTEM32>\sc.exe' start "CheckManagerAgent_f549" (со скрытым окном)
- '<SYSTEM32>\nslookup.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:UserProfile -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:ProgramData -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:TEMP -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.exe' -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.sys' -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'svchost.exe' -Force (со скрытым окном)
