Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'ImagePath' = '<DRIVERS>\carbonblackk.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'ImagePath' = '%WINDIR%\CarbonBlack\cb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\cbtdiflt] 'ImagePath' = '<DRIVERS>\cbtdiflt.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\cbstream] 'ImagePath' = '<DRIVERS>\cbstream.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'Start' = '00000001'
Вредоносные функции:
Запускает на исполнение:
- '%WINDIR%\CarbonBlack\cb.exe'
- '%ProgramFiles%\temp\CarbonBlackClientSetup.exe' /S
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\temp\CB.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\data
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\data
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\data
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\data
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\info.txt
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\data
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B948935205DF3E6310084702B62E21CF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B948935205DF3E6310084702B62E21CF\data
- %WINDIR%\CarbonBlack\store\TMP_800DF77D6987A9A355650449D270B3E7\info.txt
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\data
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\info.txt
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\data
- %WINDIR%\CarbonBlack\store\TMP_800DF77D6987A9A355650449D270B3E7\data
- %WINDIR%\CarbonBlack\store\TMP_5AB83FDB52B41EDD21F24111585FC6AD\data
- %WINDIR%\CarbonBlack\store\TMP_92B79ED92E60D8A43782E398519A1AD4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_92B79ED92E60D8A43782E398519A1AD4\data
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\data
- %WINDIR%\CarbonBlack\store\TMP_5AB83FDB52B41EDD21F24111585FC6AD\info.txt
- %WINDIR%\Temp\Cab22.tmp
- %WINDIR%\Temp\Cab24.tmp
- %WINDIR%\Temp\Cab26.tmp
- %WINDIR%\Temp\Cab1C.tmp
- %WINDIR%\Temp\Cab1E.tmp
- %WINDIR%\Temp\Cab20.tmp
- %WINDIR%\Temp\Cab28.tmp
- %WINDIR%\Temp\Cab30.tmp
- %WINDIR%\Temp\Cab32.tmp
- %WINDIR%\Temp\Cab34.tmp
- %WINDIR%\Temp\Cab2A.tmp
- %WINDIR%\Temp\Cab2C.tmp
- %WINDIR%\Temp\Cab2E.tmp
- %WINDIR%\Temp\Cab1A.tmp
- %WINDIR%\Temp\Cab6.tmp
- %WINDIR%\Temp\Cab8.tmp
- %WINDIR%\Temp\CabA.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %WINDIR%\Temp\Cab4.tmp
- %WINDIR%\Temp\CabC.tmp
- %WINDIR%\Temp\Cab14.tmp
- %WINDIR%\Temp\Cab16.tmp
- %WINDIR%\Temp\Cab18.tmp
- %WINDIR%\Temp\CabE.tmp
- %WINDIR%\Temp\Cab10.tmp
- %WINDIR%\Temp\Cab12.tmp
- %WINDIR%\CarbonBlack\carbonblack.db
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\info.txt
- %WINDIR%\CarbonBlack\Sensor.LOG
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\uninst.exe
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\data
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\data
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\data
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\data
- %WINDIR%\CarbonBlack\store\catalog
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\info.txt
- <DRIVERS>\cbtdiflt.sys
- %TEMP%\nsi2.tmp
- %TEMP%\nst3.tmp\System.dll
- %TEMP%\nst3.tmp\nsislog.dll
- %ProgramFiles%\temp\CarbonBlackClientSetup.exe
- %ProgramFiles%\temp\sensorsettings.ini
- %ProgramFiles%\temp\CB.bat
- %WINDIR%\CarbonBlack\InstallLogs\install-5.1.0.50911-2016-11-03_154040.log
- <DRIVERS>\CarbonBlackK.sys
- <DRIVERS>\cbk7.sys
- <DRIVERS>\cbstream.sys
- %WINDIR%\CarbonBlack\sensorsettings.ini
- %TEMP%\nst3.tmp\nsSCM.dll
- %WINDIR%\CarbonBlack\cb.exe
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\data
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\data
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\data
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\data
- %WINDIR%\CarbonBlack\store\TMP_075EA6C849AB0FE416A3D6DD65C3CF41\info.txt
- %WINDIR%\CarbonBlack\store\TMP_075EA6C849AB0FE416A3D6DD65C3CF41\data
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\data
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\data
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\info.txt
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\data
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\info.txt
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\data
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\data
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\data
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\data
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\info.txt
Удаляет следующие файлы:
- %WINDIR%\Temp\Cab20.tmp
- %WINDIR%\Temp\Cab1E.tmp
- %WINDIR%\Temp\Cab24.tmp
- %WINDIR%\Temp\Cab22.tmp
- %WINDIR%\Temp\Cab18.tmp
- %WINDIR%\Temp\Cab16.tmp
- %WINDIR%\Temp\Cab1C.tmp
- %WINDIR%\Temp\Cab1A.tmp
- %WINDIR%\Temp\Cab30.tmp
- %WINDIR%\Temp\Cab2E.tmp
- %WINDIR%\Temp\Cab34.tmp
- %WINDIR%\Temp\Cab32.tmp
- %WINDIR%\Temp\Cab28.tmp
- %WINDIR%\Temp\Cab26.tmp
- %WINDIR%\Temp\Cab2C.tmp
- %WINDIR%\Temp\Cab2A.tmp
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\data
- %TEMP%\nst3.tmp\System.dll
- %WINDIR%\Temp\Cab4.tmp
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\info.txt
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\sensorsettings.ini
- %TEMP%\nst3.tmp\nsSCM.dll
- %TEMP%\nst3.tmp\nsislog.dll
- %WINDIR%\Temp\Cab10.tmp
- %WINDIR%\Temp\CabE.tmp
- %WINDIR%\Temp\Cab14.tmp
- %WINDIR%\Temp\Cab12.tmp
- %WINDIR%\Temp\Cab8.tmp
- %WINDIR%\Temp\Cab6.tmp
- %WINDIR%\Temp\CabC.tmp
- %WINDIR%\Temp\CabA.tmp
Подменяет следующие файлы:
- %WINDIR%\CarbonBlack\carbonblack.db-journal
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'www.download.windowsupdate.com':80
- '17#.#6.21.111':443
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/WindowsPCA.crl via 20#.#6.232.182
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
