Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\OssecSvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\OssecSvc] 'ImagePath' = '"%ProgramFiles(x86)%\ossec-agent\ossec-agent.exe"'
Creates the following services
- 'OssecSvc' "%ProgramFiles(x86)%\ossec-agent\ossec-agent.exe"
- 'OssecSvc' %ProgramFiles(x86)%\ossec-agent\ossec-agent.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\ossec-agent\ossec-agent.exe
- %ProgramFiles(x86)%\ossec-agent\win_malware_rcl.txt
- %ProgramFiles(x86)%\ossec-agent\win_audit_rcl.txt
- %ProgramFiles(x86)%\ossec-agent\help.txt
- %ProgramFiles(x86)%\ossec-agent\vista_sec.csv
- %ProgramFiles(x86)%\ossec-agent\route-null.cmd
- %ProgramFiles(x86)%\ossec-agent\restart-ossec.cmd
- %ProgramFiles(x86)%\ossec-agent\client.keys
- %ProgramFiles(x86)%\ossec-agent\uninstall.exe
- %ProgramFiles(x86)%\ossec-agent\version.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ossec\manage agent.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ossec\documentation.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ossec\edit config.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ossec\uninstall.lnk
- %ProgramFiles(x86)%\ossec-agent\ossec.log
- %ProgramFiles(x86)%\ossec-agent\.tmp.ossec.conf
- %ProgramFiles(x86)%\ossec-agent\win_applications_rcl.txt
- %ProgramFiles(x86)%\ossec-agent\.agent_info
- %ProgramFiles(x86)%\ossec-agent\rootcheck.conf
- %ProgramFiles(x86)%\ossec-agent\add-localfile.exe
- %ProgramFiles(x86)%\ossec-agent\ossec.conf
- %ProgramFiles(x86)%\ossec-agent\default-ossec.conf
- %ProgramFiles(x86)%\ossec-agent\manage_agents.exe
- %ProgramFiles(x86)%\ossec-agent\os_win32ui.exe
- %ProgramFiles(x86)%\ossec-agent\win32ui.exe
- %ProgramFiles(x86)%\ossec-agent\ossec-rootcheck.exe
- %ProgramFiles(x86)%\ossec-agent\internal_options.conf
- %ProgramFiles(x86)%\ossec-agent\setup-windows.exe
- %ProgramFiles(x86)%\ossec-agent\setup-syscheck.exe
- %ProgramFiles(x86)%\ossec-agent\setup-iis.exe
- %ProgramFiles(x86)%\ossec-agent\service-start.exe
- %ProgramFiles(x86)%\ossec-agent\service-stop.exe
- %ProgramFiles(x86)%\ossec-agent\doc.html
- %ProgramFiles(x86)%\ossec-agent\rootkit_trojans.txt
- %ProgramFiles(x86)%\ossec-agent\rootkit_files.txt
- %ProgramFiles(x86)%\ossec-agent\license.txt
- %ProgramFiles(x86)%\ossec-agent\rids\sender_counter
Moves the following files
- from %ProgramFiles(x86)%\ossec-agent\rootkit_trojans.txt to %ProgramFiles(x86)%\ossec-agent\shared\rootkit_trojans.txt
- from %ProgramFiles(x86)%\ossec-agent\rootkit_files.txt to %ProgramFiles(x86)%\ossec-agent\shared\rootkit_files.txt
- from %ProgramFiles(x86)%\ossec-agent\win_malware_rcl.txt to %ProgramFiles(x86)%\ossec-agent\shared\win_malware_rcl.txt
- from %ProgramFiles(x86)%\ossec-agent\win_audit_rcl.txt to %ProgramFiles(x86)%\ossec-agent\shared\win_audit_rcl.txt
- from %ProgramFiles(x86)%\ossec-agent\win_applications_rcl.txt to %ProgramFiles(x86)%\ossec-agent\shared\win_applications_rcl.txt
- from %ProgramFiles(x86)%\ossec-agent\route-null.cmd to %ProgramFiles(x86)%\ossec-agent\active-response\bin\route-null.cmd
- from %ProgramFiles(x86)%\ossec-agent\restart-ossec.cmd to %ProgramFiles(x86)%\ossec-agent\active-response\bin\restart-ossec.cmd
- from %ProgramFiles(x86)%\ossec-agent\os_win32ui.exe to %ProgramFiles(x86)%\os_win32ui.exe
- from %ProgramFiles(x86)%\ossec-agent\win32ui.exe to %ProgramFiles(x86)%\win32ui.exe
- from %ProgramFiles(x86)%\ossec-agent\uninstall.exe to %ProgramFiles(x86)%\uninstall.exe
- from %ProgramFiles(x86)%\ossec-agent\doc.html to %ProgramFiles(x86)%\doc.html
- from %ProgramFiles(x86)%\ossec-agent\help.txt to %ProgramFiles(x86)%\help.txt
- from %ProgramFiles(x86)%\ossec-agent\ossec.conf to %ProgramFiles(x86)%\ossec-agent\ossec.conf.bak
Substitutes the following files
- %ProgramFiles(x86)%\ossec-agent\os_win32ui.exe
- %ProgramFiles(x86)%\ossec-agent\win32ui.exe
- %ProgramFiles(x86)%\ossec-agent\uninstall.exe
- %ProgramFiles(x86)%\ossec-agent\doc.html
- %ProgramFiles(x86)%\ossec-agent\help.txt
- %ProgramFiles(x86)%\ossec-agent\ossec.conf
Network activity
UDP
- '10.##.189.31':1514
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\ossec-agent\ossec-agent.exe' install-service
- '%ProgramFiles(x86)%\ossec-agent\setup-windows.exe' "%ProgramFiles(x86)%\ossec-agent"
- '%ProgramFiles(x86)%\ossec-agent\setup-syscheck.exe' "%ProgramFiles(x86)%\ossec-agent" "enable"
- '%ProgramFiles(x86)%\ossec-agent\setup-iis.exe' "%ProgramFiles(x86)%\ossec-agent"
- '%ProgramFiles(x86)%\ossec-agent\ossec-agent.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc config OssecSvc start= auto
- '%WINDIR%\syswow64\net1.exe' "stop" "OssecSvc"
- '%WINDIR%\syswow64\net.exe' "stop" "OssecSvc"
- '%WINDIR%\syswow64\cmd.exe' /c move ..\help.txt .
- '%WINDIR%\syswow64\cmd.exe' /c move ..\doc.html .
- '%WINDIR%\syswow64\cmd.exe' /c move ..\uninstall.exe .
- '%WINDIR%\syswow64\cmd.exe' /c move ..\win32ui.exe .
- '%WINDIR%\syswow64\cmd.exe' /c move ..\os_win32ui.exe .
- '%WINDIR%\syswow64\net.exe' "start" "OssecSvc"
- '%WINDIR%\syswow64\cacls.exe' * /T /G Administrators:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls * /T /G Administrators:f
- '%WINDIR%\syswow64\cmd.exe' /c move help.txt ../
- '%WINDIR%\syswow64\cmd.exe' /c move doc.html ../
- '%WINDIR%\syswow64\cmd.exe' /c move uninstall.exe ../
- '%WINDIR%\syswow64\cmd.exe' /c move win32ui.exe ../
- '%WINDIR%\syswow64\cmd.exe' /c move os_win32ui.exe ../
- '%WINDIR%\syswow64\sc.exe' config OssecSvc start= auto
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\net1.exe' "start" "OssecSvc"
