Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\OssecSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\OssecSvc] 'ImagePath' = '"%ProgramFiles%\ossec-agent\ossec-agent.exe"'
Modifies file system:
Creates the following files:
- %TEMP%\nsa2.tmp\SimpleSC.dll
- %ProgramFiles%\ossec-agent\shared\win_malware_rcl.txt
- %ProgramFiles%\ossec-agent\shared\win_audit_rcl.txt
- %ProgramFiles%\ossec-agent\help.txt
- %ProgramFiles%\ossec-agent\vista_sec.txt
- %ProgramFiles%\ossec-agent\active-response\bin\route-null.cmd
- %ProgramFiles%\ossec-agent\active-response\bin\restart-ossec.cmd
- %ProgramFiles%\ossec-agent\client.keys
- %ProgramFiles%\ossec-agent\internal_options.conf
- %ProgramFiles%\ossec-agent\uninstall.exe
- %ProgramFiles%\ossec-agent\VERSION.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\OSSEC\Manage Agent.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OSSEC\Documentation.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OSSEC\Edit Config.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OSSEC\Uninstall.lnk
- %TEMP%\nsa2.tmp\nsExec.dll
- %TEMP%\nsa2.tmp\ns3.tmp
- %ProgramFiles%\ossec-agent\rootcheck.conf
- %ProgramFiles%\ossec-agent\shared\win_applications_rcl.txt
- %ProgramFiles%\ossec-agent\LICENSE.txt
- %ProgramFiles%\ossec-agent\add-localfile.exe
- %ProgramFiles%\ossec-agent\shared\rootkit_files.txt
- %ProgramFiles%\ossec-agent\ossec-lua.exe
- %ProgramFiles%\ossec-agent\ossec-luac.exe
- %ProgramFiles%\ossec-agent\ossec-agent.exe
- %ProgramFiles%\ossec-agent\default-ossec.conf
- %ProgramFiles%\ossec-agent\manage_agents.exe
- %ProgramFiles%\ossec-agent\win32ui.exe
- %ProgramFiles%\ossec-agent\shared\ar.conf
- %ProgramFiles%\ossec-agent\ossec.log
- %TEMP%\nsa2.tmp\System.dll
- %ProgramFiles%\ossec-agent\ossec-rootcheck.exe
- %ProgramFiles%\ossec-agent\setup-windows.exe
- %ProgramFiles%\ossec-agent\setup-syscheck.exe
- %ProgramFiles%\ossec-agent\setup-iis.exe
- %ProgramFiles%\ossec-agent\service-start.exe
- %ProgramFiles%\ossec-agent\service-stop.exe
- %ProgramFiles%\ossec-agent\doc.html
- %ProgramFiles%\ossec-agent\shared\rootkit_trojans.txt
- %ProgramFiles%\ossec-agent\ossec.conf
- %ProgramFiles%\ossec-agent\local_internal_options.conf
- %TEMP%\nsa2.tmp\ns4.tmp
Deletes the following files:
- %TEMP%\nsa2.tmp\ns3.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsa2.tmp\ns3.tmp' "%ProgramFiles%\ossec-agent\ossec-agent.exe" install-service
- '%ProgramFiles%\ossec-agent\ossec-agent.exe' install-service
- '%TEMP%\nsa2.tmp\ns4.tmp' "%ProgramFiles%\ossec-agent\setup-windows.exe" "%ProgramFiles%\ossec-agent"
- '%ProgramFiles%\ossec-agent\setup-windows.exe' "%ProgramFiles%\ossec-agent"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c sc config OssecSvc start= auto
- '<SYSTEM32>\sc.exe' config OssecSvc start= auto
- '<SYSTEM32>\cmd.exe' /c echo y|cacls . /T /G Administrators:f
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\cacls.exe' . /T /G Administrators:f
