Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CarbonBlack] 'ImagePath' = '%WINDIR%\CarbonBlack\cb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'ImagePath' = '<DRIVERS>\carbonblackk.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\cbtdiflt] 'ImagePath' = '<DRIVERS>\cbtdiflt.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\carbonblackk] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\CarbonBlack\cb.exe'
- '%TEMP%\nsc3.tmp\ns4.tmp' cmd.exe /C "echo y|<SYSTEM32>\cacls %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)"
- '<SYSTEM32>\wscript.exe' "C:\Users\Default\AppData\Local\Temp\CarbonBlack\run.vbs"
- 'C:\Users\Default\AppData\Local\Temp\CarbonBlack\CarbonBlackClientSetup.exe' /S
Executes the following:
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\cacls.exe' %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Default\AppData\Local\Temp\CarbonBlack\run.bat" "
- '<SYSTEM32>\cmd.exe' /C "echo y|<SYSTEM32>\cacls %WINDIR%\CarbonBlack\uninst.exe /S:D:PAI(A;;FA;;;SY)(A;;FA;;;BA)"
Modifies file system:
Creates the following files:
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\info.txt
- %WINDIR%\CarbonBlack\store\TMP_4E74AF063C3271FBEA20DD940CFD1184\data
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998_\data
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\data
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\data
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998_\info.txt
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_765B30C776A1780B46B479FE614F707C\data
- %WINDIR%\CarbonBlack\store\TMP_A7F95A53EE055115DF03588997A47D4D\data
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998\info.txt
- %WINDIR%\CarbonBlack\store\TMP_52FA7084B555110C0DE75C1DDEE585D5\data
- %WINDIR%\CarbonBlack\store\TMP_F132FDBBC0A040F07E10EA944FF57FEF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F132FDBBC0A040F07E10EA944FF57FEF\data
- %WINDIR%\CarbonBlack\store\TMP_52FA7084B555110C0DE75C1DDEE585D5\info.txt
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\data
- %WINDIR%\CarbonBlack\store\TMP_9D0F3A66244D6CAB3519FE1BF988D23A\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9D0F3A66244D6CAB3519FE1BF988D23A\data
- %WINDIR%\CarbonBlack\store\TMP_3F5B0BAF6AEA3F604E6E13D73F9FDB31\info.txt
- %WINDIR%\CarbonBlack\store\TMP_3F5B0BAF6AEA3F604E6E13D73F9FDB31\data
- %WINDIR%\CarbonBlack\store\TMP_96E48C7EB9089D1DBF6F85CA11B264DF\info.txt
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\data
- %WINDIR%\CarbonBlack\store\TMP_CEFBCDBADD70C6BB9538B6CAF224FB2E\info.txt
- %WINDIR%\CarbonBlack\store\TMP_CEFBCDBADD70C6BB9538B6CAF224FB2E\data
- %WINDIR%\CarbonBlack\store\TMP_B3BCD9EBF4E95D7B4B24307C55CE6D60\info.txt
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %WINDIR%\Temp\Cab27.tmp
- %WINDIR%\Temp\Cab29.tmp
- %WINDIR%\Temp\Cab2B.tmp
- %WINDIR%\Temp\Cab25.tmp
- %WINDIR%\Temp\Cab1F.tmp
- %WINDIR%\Temp\Cab21.tmp
- %WINDIR%\Temp\Cab23.tmp
- %WINDIR%\Temp\Cab35.tmp
- %WINDIR%\CarbonBlack\store\TMP_E47100B70748FC790FFE6299CDF7EF2D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_E47100B70748FC790FFE6299CDF7EF2D\data
- %WINDIR%\Temp\Cab33.tmp
- %WINDIR%\Temp\Cab2D.tmp
- %WINDIR%\Temp\Cab2F.tmp
- %WINDIR%\Temp\Cab31.tmp
- %WINDIR%\Temp\Cab1D.tmp
- %WINDIR%\Temp\CabB.tmp
- %WINDIR%\Temp\CabD.tmp
- %WINDIR%\Temp\CabF.tmp
- %WINDIR%\Temp\Cab9.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\Temp\Cab7.tmp
- %WINDIR%\Temp\Cab17.tmp
- %WINDIR%\Temp\Cab19.tmp
- %WINDIR%\Temp\Cab1B.tmp
- %WINDIR%\Temp\Cab15.tmp
- %WINDIR%\CarbonBlack\EventLogs\eventlog_200390.624.log.zip
- %WINDIR%\Temp\Cab11.tmp
- %WINDIR%\Temp\Cab13.tmp
- %WINDIR%\CarbonBlack\store\TMP_2A5779B8ACAD56048714B7707FA7AD43\info.txt
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\info.txt
- %WINDIR%\CarbonBlack\store\TMP_01C3346C241652F43AED8E2149881BFE\data
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\info.txt
- %WINDIR%\CarbonBlack\store\catalog
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\info.txt
- %WINDIR%\CarbonBlack\store\TMP_BD7FB0957C716F1A60333AEE04DE2178\data
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\data
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\data
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\info.txt
- %WINDIR%\CarbonBlack\store\TMP_A0732187050030AE399B241436565E64\data
- %WINDIR%\CarbonBlack\store\TMP_8F078AE4ED187AAABC0A305146DE6716\info.txt
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\info.txt
- %WINDIR%\CarbonBlack\store\TMP_C6CE6EEC82F187615D1002BB3BB50ED4\data
- %WINDIR%\CarbonBlack\store\TMP_84885F9B82F4D55C6146EBF6065D75D2\data
- %WINDIR%\CarbonBlack\store\TMP_F12B178B1678D778CFD3FF1FC38C71FB\info.txt
- %TEMP%\nss2.tmp
- %WINDIR%\CarbonBlack\InstallLogs\install-6.0.2.70329-2017-08-22_122222.log
- %WINDIR%\CarbonBlack\sensorsettings.ini
- C:\Users\Default\AppData\Local\Temp\CarbonBlack\CarbonBlackClientSetup.exe
- C:\Users\Default\AppData\Local\Temp\CarbonBlack\run.bat
- C:\Users\Default\AppData\Local\Temp\CarbonBlack\run.vbs
- C:\Users\Default\AppData\Local\Temp\CarbonBlack\sensorsettings.ini
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\carbonblack.db
- %WINDIR%\CarbonBlack\uninst.exe
- %WINDIR%\CarbonBlack\Sensor.LOG
- %WINDIR%\CarbonBlack\cb.exe
- <DRIVERS>\cbtdiflt.sys
- <DRIVERS>\CarbonBlackK.sys
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\info.txt
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\info.txt
- %WINDIR%\CarbonBlack\store\TMP_30A70078120C871B3E528259EBD72821\data
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\data
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EEB024F2C81F0D55936FB825D21A91D6\data
- %WINDIR%\CarbonBlack\store\TMP_F15405ACD8E629883A695E288DC1F62C\info.txt
- %WINDIR%\CarbonBlack\store\TMP_086A457B5CEC15731EC03E6EA6C9CD8D\data
- %WINDIR%\CarbonBlack\store\TMP_3ADCE7346E279C8E7ADEC5F2428385C6\info.txt
- %WINDIR%\CarbonBlack\store\TMP_3ADCE7346E279C8E7ADEC5F2428385C6\data
- %WINDIR%\CarbonBlack\store\TMP_086A457B5CEC15731EC03E6EA6C9CD8D\info.txt
- %WINDIR%\CarbonBlack\store\TMP_EA04AD67501587F2C018E79B6B541224\data
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\info.txt
- %WINDIR%\CarbonBlack\store\TMP_53707052F3855159C3FF126EB85F5E4B\data
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\data
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\info.txt
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9889C99D0509330FE490B4E3925DB493\info.txt
- %WINDIR%\CarbonBlack\store\TMP_7435B108B935E42EA92CA94F59C8E717\data
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\info.txt
- %WINDIR%\CarbonBlack\store\TMP_24232996A38C0B0CF151C2140AE29FC8\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\data
- %WINDIR%\CarbonBlack\store\TMP_5567008021AFB03BA5DCF5DA9E0783D4\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\data
- %WINDIR%\CarbonBlack\store\TMP_F1958FBF86D5C004CF19A5951A9514B7\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447_\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\info.txt
Deletes the following files:
- %WINDIR%\Temp\Cab27.tmp
- %WINDIR%\Temp\Cab25.tmp
- %WINDIR%\Temp\Cab2B.tmp
- %WINDIR%\Temp\Cab29.tmp
- %WINDIR%\Temp\Cab23.tmp
- %WINDIR%\Temp\Cab1D.tmp
- %WINDIR%\Temp\Cab1B.tmp
- %WINDIR%\Temp\Cab21.tmp
- %WINDIR%\Temp\Cab1F.tmp
- %WINDIR%\Temp\Cab2D.tmp
- %TEMP%\nsc3.tmp\nsislog.dll
- %TEMP%\nsc3.tmp\nsExec.dll
- %TEMP%\nsc3.tmp\System.dll
- %TEMP%\nsc3.tmp\nsSCM.dll
- %TEMP%\nsc3.tmp\ns4.tmp
- %WINDIR%\Temp\Cab31.tmp
- %WINDIR%\Temp\Cab2F.tmp
- %WINDIR%\Temp\Cab35.tmp
- %WINDIR%\Temp\Cab33.tmp
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998_\data
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\info.txt
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\CarbonBlack\store\TMP_71219FB075443331D48E8C393F53A998_\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447\data
- %WINDIR%\CarbonBlack\carbonblack.db-journal
- %WINDIR%\CarbonBlack\sensorsettings.ini
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\info.txt
- %WINDIR%\CarbonBlack\store\TMP_9EE650C6EC161A9251335611CB1DD447__\data
- %WINDIR%\Temp\Cab7.tmp
- %WINDIR%\Temp\Cab15.tmp
- %WINDIR%\Temp\Cab13.tmp
- %WINDIR%\Temp\Cab19.tmp
- %WINDIR%\Temp\Cab17.tmp
- %WINDIR%\Temp\Cab11.tmp
- %WINDIR%\Temp\CabB.tmp
- %WINDIR%\Temp\Cab9.tmp
- %WINDIR%\Temp\CabF.tmp
- %WINDIR%\Temp\CabD.tmp
Substitutes the following files:
- %WINDIR%\CarbonBlack\carbonblack.db-journal
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/WindowsPCA.crl via 20#.#6.232.182
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
