Trojan.KillFiles.64694

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop lanmanserver / y
'<SYSTEM32>\taskkill.exe' /f /t /im rundllhost.exe
'<SYSTEM32>\taskkill.exe' /f /t /im dlllhost.exe
'<SYSTEM32>\taskkill.exe' /f /t /im KvMonXP.exe
'<SYSTEM32>\taskkill.exe' /f /t /im lsars.exe /im lsacs.exe
'<SYSTEM32>\taskkill.exe' /f /im dllhots.exe
'<SYSTEM32>\taskkill.exe' /f /im d11hots.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system

Creates the following files

%TEMP%\1.tmp\2.bat
<SYSTEM32>\dllcache\avifile.dll.new
<SYSTEM32>\dllcache\commdlg.dll.new
<SYSTEM32>\dllcache\keyboard.drv.new
<SYSTEM32>\dllcache\lzexpand.dll.new
<SYSTEM32>\dllcache\mciavi.drv.new
<SYSTEM32>\dllcache\mciseq.drv.new
<SYSTEM32>\dllcache\mciwave.drv.new
<SYSTEM32>\dllcache\mmsystem.dll.new
<SYSTEM32>\dllcache\mmtask.tsk.new
<SYSTEM32>\dllcache\mouse.drv.new
<SYSTEM32>\dllcache\msvideo.dll.new
<SYSTEM32>\dllcache\olecli.dll.new
<SYSTEM32>\dllcache\olesvr.dll.new
<SYSTEM32>\dllcache\shell.dll.new
<SYSTEM32>\dllcache\sound.drv.new
<SYSTEM32>\dllcache\stdole.tlb.new
<SYSTEM32>\dllcache\system.drv.new
<SYSTEM32>\dllcache\tapi.dll.new
<SYSTEM32>\dllcache\timer.drv.new
<SYSTEM32>\dllcache\ver.dll.new
<SYSTEM32>\dllcache\vga.drv.new
<SYSTEM32>\dllcache\avicap.dll.new
<SYSTEM32>\dllcache\wfwnet.drv.new
%WINDIR%\system\winspool.drv.new
%WINDIR%\system\vga.drv.new
%WINDIR%\system\avicap.dll.new
%WINDIR%\system\avifile.dll.new
%WINDIR%\system\commdlg.dll.new
%WINDIR%\system\keyboard.drv.new
%WINDIR%\system\lzexpand.dll.new
%WINDIR%\system\mciavi.drv.new
%WINDIR%\system\mciseq.drv.new
%WINDIR%\system\mciwave.drv.new
%WINDIR%\system\mmsystem.dll.new
%WINDIR%\system\mmtask.tsk.new
%WINDIR%\system\mouse.drv.new
%WINDIR%\system\msvideo.dll.new
%WINDIR%\system\olecli.dll.new
%WINDIR%\system\olesvr.dll.new
%WINDIR%\system\shell.dll.new
%WINDIR%\system\sound.drv.new
%WINDIR%\system\stdole.tlb.new
%WINDIR%\system\system.drv.new
%WINDIR%\system\tapi.dll.new
%WINDIR%\system\timer.drv.new
%WINDIR%\system\ver.dll.new
%WINDIR%\system\wfwnet.drv.new
<SYSTEM32>\dllcache\winspool.drv.new

Deletes the following files

%WINDIR%\system\avicap.dll
%WINDIR%\system\winspool.drv
%WINDIR%\system\wfwnet.drv
%WINDIR%\system\vga.drv
%WINDIR%\system\ver.dll
%WINDIR%\system\timer.drv
%WINDIR%\system\tapi.dll
%WINDIR%\system\system.drv
%WINDIR%\system\stdole.tlb
%WINDIR%\system\sound.drv
%WINDIR%\system\shell.dll
%WINDIR%\system\setup.inf
<DRIVERS>\etc\hosts
%WINDIR%\system\olesvr.dll
%WINDIR%\system\msvideo.dll
%WINDIR%\system\mouse.drv
%WINDIR%\system\mmtask.tsk
%WINDIR%\system\mmsystem.dll
%WINDIR%\system\mciwave.drv
%WINDIR%\system\mciseq.drv
%WINDIR%\system\mciavi.drv
%WINDIR%\system\lzexpand.dll
%WINDIR%\system\keyboard.drv
%WINDIR%\system\commdlg.dll
%WINDIR%\system\avifile.dll
%WINDIR%\system\olecli.dll
%TEMP%\1.tmp\2.bat

Substitutes the following files

<SYSTEM32>\dllcache\avicap.dll.new
<SYSTEM32>\dllcache\vga.drv.new
<SYSTEM32>\dllcache\ver.dll.new
<SYSTEM32>\dllcache\timer.drv.new
<SYSTEM32>\dllcache\tapi.dll.new
<SYSTEM32>\dllcache\system.drv.new
<SYSTEM32>\dllcache\stdole.tlb.new
<SYSTEM32>\dllcache\sound.drv.new
<SYSTEM32>\dllcache\shell.dll.new
<SYSTEM32>\dllcache\olesvr.dll.new
<SYSTEM32>\dllcache\olecli.dll.new
<SYSTEM32>\dllcache\msvideo.dll.new
<SYSTEM32>\dllcache\mouse.drv.new
<SYSTEM32>\dllcache\mmtask.tsk.new
<SYSTEM32>\dllcache\mmsystem.dll.new
<SYSTEM32>\dllcache\mciwave.drv.new
<SYSTEM32>\dllcache\mciseq.drv.new
<SYSTEM32>\dllcache\mciavi.drv.new
<SYSTEM32>\dllcache\lzexpand.dll.new
<SYSTEM32>\dllcache\keyboard.drv.new
<SYSTEM32>\dllcache\commdlg.dll.new
<SYSTEM32>\dllcache\avifile.dll.new
<SYSTEM32>\dllcache\wfwnet.drv.new
<SYSTEM32>\dllcache\winspool.drv.new

Substitutes the HOSTS file.

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
'<SYSTEM32>\sc.exe' stop "Smart Card Report"
'<SYSTEM32>\sc.exe' delete "mssecsvc2.1"
'<SYSTEM32>\sc.exe' stop "mssecsvc2.1"
'<SYSTEM32>\sc.exe' delete "mssecsvc2.0"
'<SYSTEM32>\sc.exe' stop "mssecsvc2.0"
'<SYSTEM32>\sc.exe' delete Microsarver
'<SYSTEM32>\sc.exe' stop Microsarver
'<SYSTEM32>\sc.exe' stop MicrosotMaims
'<SYSTEM32>\sc.exe' delete MicrosotMaims
'<SYSTEM32>\sc.exe' delete MicrosotMais
'<SYSTEM32>\sc.exe' stop MicrosotMais
'<SYSTEM32>\sc.exe' delete ServicesMain
'<SYSTEM32>\sc.exe' stop ServicesMain
'<SYSTEM32>\sc.exe' stop Hostserver
'<SYSTEM32>\sc.exe' stop "jgumfoxl update"
'<SYSTEM32>\sc.exe' delete HostManger
'<SYSTEM32>\sc.exe' stop HostManger
'<SYSTEM32>\sc.exe' delete "clr_optimzation_v4.0.52738 _64"
'<SYSTEM32>\sc.exe' stop "clr_optimzation_v4.0.52738 _64"
'<SYSTEM32>\sc.exe' delete Famserver
'<SYSTEM32>\sc.exe' stop Famserver
'<SYSTEM32>\sc.exe' delete FormManger
'<SYSTEM32>\sc.exe' stop FormManger
'<SYSTEM32>\sc.exe' delete NetPipeAtcivator
'<SYSTEM32>\sc.exe' stop NetPipeAtcivator
'<SYSTEM32>\sc.exe' delete ServiceMaims
'<SYSTEM32>\sc.exe' stop ServiceMaims
'<SYSTEM32>\sc.exe' delete Hostserver
'<SYSTEM32>\cacls.exe' "C:\ProgramData\Microsoft\WmiApprsv\csrss.exe" /d everyone
'<SYSTEM32>\sc.exe' delete "jgumfoxl update"
'<SYSTEM32>\attrib.exe' +s +h +a +r <DRIVERS>\etc\hosts
'<SYSTEM32>\attrib.exe' -s -h -a -r <DRIVERS>\etc\hosts
'<SYSTEM32>\cacls.exe' <DRIVERS>\etc\hosts /g users:f
'<SYSTEM32>\netsh.exe' ipsec static set policy name=Aliyun assign=y
'<SYSTEM32>\netsh.exe' ipsec static add rule name=deny1 policy=Aliyun filterlist=denylist filteraction=deny
'<SYSTEM32>\netsh.exe' ipsec static add filteraction name=deny action=block
'<SYSTEM32>\netsh.exe' ipsec static add filteraction name=Allow action=permit
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
'<SYSTEM32>\netsh.exe' ipsec static add filterlist name=denylist
'<SYSTEM32>\sc.exe' delete ServiceMais
'<SYSTEM32>\sc.exe' delete "Smart Card Report"
'<SYSTEM32>\wbem\wmic.exe' process where "name='lsass.exe' and ExecutablePath='C:\\Windows\\Fonts\\lsass.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='conhost.exe' and ExecutablePath='C:\\Windows\\Fonts\\conhost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\Fonts\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='csrss.exe' and ExecutablePath='C:\\Windows\\Fonts\\csrss.exe'" call Terminate
'<SYSTEM32>\cacls.exe' "%WINDIR%\Fonts\csrss.exe" /g everyone:f
'<SYSTEM32>\cacls.exe' "%WINDIR%\Fonts\svchost.exe" /g everyone:f
'<SYSTEM32>\cacls.exe' "%WINDIR%\Fonts\conhost.exe" /g everyone:f
'<SYSTEM32>\cacls.exe' "%WINDIR%\Fonts\dlllhost.exe" /g everyone:f
'<SYSTEM32>\cacls.exe' "%WINDIR%\Fonts\rundllhost.exe" /g everyone:f
'<SYSTEM32>\attrib.exe' -s -h -r %WINDIR%\Fonts\csrss.exe
'<SYSTEM32>\attrib.exe' -s -h -r %WINDIR%\Fonts\svchost.exe
'<SYSTEM32>\attrib.exe' -s -h -r %WINDIR%\Fonts\conhost.exe
'<SYSTEM32>\attrib.exe' -s -h -r %WINDIR%\Fonts\dlllhost.exe
'<SYSTEM32>\netsh.exe' ipsec static add policy name=Aliyun
'<SYSTEM32>\attrib.exe' -s -h -r %WINDIR%\Fonts\rundllhost.exe
'<SYSTEM32>\sc.exe' stop ServiceMais
'<SYSTEM32>\sc.exe' delete ServiceSais
'<SYSTEM32>\sc.exe' stop ServiceSais
'<SYSTEM32>\sc.exe' delete COMSysCts
'<SYSTEM32>\cmd.exe' /S /D /c" echo y"
'<SYSTEM32>\attrib.exe' +s +h +r %WINDIR%\svchost.exe
'<SYSTEM32>\sc.exe' delete clr_optimization_v4.0.30318_64
'<SYSTEM32>\sc.exe' stop clr_optimization_v4.0.30318_64
'<SYSTEM32>\sc.exe' delete RpcEpt
'<SYSTEM32>\sc.exe' stop RpcEpt
'<SYSTEM32>\sc.exe' delete lanmanserver
'<SYSTEM32>\sc.exe' config lanmanserver start= DISABLED
'<SYSTEM32>\net1.exe' stop lanmanserver / y
'<SYSTEM32>\sc.exe' delete "Windows TrustedInstaller"
'<SYSTEM32>\sc.exe' stop "Windows TrustedInstaller"
'<SYSTEM32>\sc.exe' delete clr_optimization_v4.0.33018_64
'<SYSTEM32>\cacls.exe' <DRIVERS>\etc\hosts /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\clr_optimization_v4.0.30318_64\svchost.exe" /d everyone
'<SYSTEM32>\sc.exe' stop COMSysCts
'<SYSTEM32>\sc.exe' delete wmiApSrv
'<SYSTEM32>\sc.exe' stop wmiApSrv
'<SYSTEM32>\sc.exe' delete WmiAppSvr
'<SYSTEM32>\sc.exe' stop WmiAppSvr
'<SYSTEM32>\sc.exe' delete WmiAppSrv
'<SYSTEM32>\sc.exe' stop WmiAppSrv
'<SYSTEM32>\sc.exe' delete WmSrv
'<SYSTEM32>\sc.exe' stop WmSrv
'<SYSTEM32>\sc.exe' delete WinTcpAutoProxySvc
'<SYSTEM32>\sc.exe' stop WinTcpAutoProxySvc
'<SYSTEM32>\wbem\wmic.exe' process where "name='LDE.exe' and ExecutablePath='C:\\ProgramData\\WinTcpAutoProxySvc\\LDE.exe'" call Terminate
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f.
'<SYSTEM32>\sc.exe' stop clr_optimization_v4.0.33018_64
'<SYSTEM32>\netsh.exe' ipsec static add filterlist name=Allowlist
'<SYSTEM32>\cacls.exe' "C:\ProgramData\Microsoft\clr_optimization_v4.0.30318_64\csrss.exe" /d everyone
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\ProgramData\\clr_optimization_v4.0.33018_64\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\svchost.exe'" call Terminate
'<SYSTEM32>\sc.exe' delete ServiceSaims
'<SYSTEM32>\sc.exe' stop ServiceSaims
'<SYSTEM32>\sc.exe' delete MicrosotSaims
'<SYSTEM32>\sc.exe' stop MicrosotSaims
'<SYSTEM32>\sc.exe' delete MicrosotSais
'<SYSTEM32>\sc.exe' stop MicrosotSais
'<SYSTEM32>\wbem\wmic.exe' process where "name='WmiApSrv.exe' and ExecutablePath='C:\\Windows\\sysnative\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='WmiApSrv.exe' and ExecutablePath='C:\\Windows\\system32\\wbem\\WmiApSrv.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\Microsoft\\WmiAppSvr\\csrss.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\Microsoft\\WmiAppSrv\\csrss.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\programdata\\wmiapprsv\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\ProgramData\\WmiAppSvr\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\programdata\\clr_optimization_v4.0.30318_64\\svchost.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\programdata\\wmiappsrv\\svchost.exe'" call Terminate
'<SYSTEM32>\cacls.exe' %WINDIR%\svchost.exe /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\Microsoft\WmiAppSvr\csrss.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\Microsoft\WmiAppSrv\csrss.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\WmiApprsv\svchost.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\WmiAppSvr\svchost.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\WmiAppSrv\svchost.exe" /d everyone
'<SYSTEM32>\cacls.exe' "%WINDIR%\tasksche.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\WmiAppSrv\csrss.exe" /d everyone
'<SYSTEM32>\cacls.exe' "C:\ProgramData\clr_optimization_v4.0.33018_64\svchost.exe" /d everyone
'<SYSTEM32>\cacls.exe' "%WINDIR%\Temp\Networks\taskmgr.exe" /d everyone
'<SYSTEM32>\wbem\wmic.exe' process where "name='taskmgr.exe' and ExecutablePath='C:\\Windows\\Temp\\Networks\\taskmgr.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\WmiAppSrv\\csrss.exe'" call Terminate
'<SYSTEM32>\wbem\wmic.exe' process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\Microsoft\\clr_optimization_v4.0.30318_64\\csrss.exe'" call Terminate
'<SYSTEM32>\cacls.exe' "<SYSTEM32>\wbem\WmiApSrv.exe" /d everyone
'<SYSTEM32>\ipconfig.exe' /flushdns

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial