МОБКС и МСЗИвКС

Вариант

Действия

Вариант

Действия

1

CompName - BKScomp1;

9

CompName – BKScomp9;

Time Zone – UTC +01:00;

Time Zone – UTC +09:00;

DefaultUserName - BKSstud1;

DefaultUserName – BKSstud9;

DefaultPassword – qwerty1;

DefaultPassword – qwerty9;

Run - "FullPath\Discord.exe* /backgroud";

Run - "FullPath\ PyCharm.exe* /backgroud";

Shimcache - whoami.exe, powershell.exe, fsutil.exe + 2

Shimcache – whoami.exe, sc.exe, at.exe + 2 на выбор;

на выбор;

Schedule Task – запуск PyCharm.exe в опр. время;

Schedule Task - запуск google chrome в опр. время;

OpenSavePidlMRU – BKSevil15.txt, BKSevil16.pdf;

OpenSavePidlMRU – BKSevil1.txt, BKSevil2.pdf;

bam – whoami.exe, sc.exe, at.exe;

bam – whoami.exe, powershell.exe, fsutil.exe;

RecentDocs - 9test.txt, 9test.pdf, 9test.zip;

RecentDocs - 1test.txt, 1test.pdf, 1test.zip;

RunMRU – eventvwr.msc, gpedit.msc

RunMRU - secpol.msc, wf.msc;

WordWheelQuery - C:\Temp\evil9\evil\evil9.txt.

WordWheelQuery - C:\Temp\evil1\evil\evil.txt.

2

CompName – BKScomp2;

10

CompName – BKScomp910;

Time Zone – UTC +02:00;

Time Zone – UTC +10:00;

DefaultUserName - BKSstud2;

DefaultUserName – BKSstud10;

DefaultPassword – qwerty2;

DefaultPassword – qwerty10;

Run - "FullPath\Google.exe* /backgroud";

Run - "FullPath\ VMware.exe* /backgroud";

Shimcache

-

systeminfo.exe,

gpupdate.exe,

Shimcache – telegram.exe, taskkill.exe, nslookup.exe

ipconfig.exe + 2 на выбор;

+ 2 на выбор;

Schedule Task - запуск блокнота (notepad) в опр.

Schedule Task – запуск VMware.exe в опр. время;

время;

OpenSavePidlMRU – BKSevil17.txt, BKSevil18.pdf;

OpenSavePidlMRU – BKSevil3.txt, BKSevil4.pdf;

bam – telegram.exe, taskkill.exe, nslookup.exe;

bam – systeminfo.exe, gpupdate.exe, ipconfig.exe;

RecentDocs - 10test.txt, 10test.pdf, 10test.zip;

RecentDocs - 2test.txt, 2test.pdf, 2test.zip;

RunMRU – shell:startup, config;

RunMRU - winver, perfmon;

WordWheelQuery - C:\Temp\evil10\evil\evil10.txt.

WordWheelQuery - C:\Temp\evil2\evil\evil2.txt.

3

CompName – BKScomp3;

11

CompName – BKScomp11;

Time Zone – UTC +03:00;

Time Zone – UTC +11:00;

DefaultUserName – BKSstud3;

DefaultUserName – BKSstud11;

DefaultPassword – qwerty3;

DefaultPassword – qwerty11;

Run - "FullPath\Notepad.exe* /backgroud";

Run - "FullPath\ VirtualBox.exe* /backgroud";

Shimcache - notepad.exe, tasklist.exe, mmc.exe + 2 на

Shimcache – query.exe, powershell.exe, fsutil.exe+ 2

выбор;

на выбор;

Schedule Task - запуск powershell ISE в опр. время;

Schedule Task – запуск VirtualBox.exe в опр. время;

OpenSavePidlMRU – BKSevil5.txt, BKSevil6.pdf;

OpenSavePidlMRU – BKSevil19.txt, BKSevil20.pdf;

bam – notepad.exe, tasklist.exe, mmc.exe;

bam – query.exe, powershell.exe, fsutil.exe;

RecentDocs - 3test.txt, 3test.pdf, 3test.zip;

RecentDocs - 11test.txt, 11test.pdf, 11test.zip;

RunMRU – eventvwr.msc, services.msc;

RunMRU – secpol.msc, conmpmgmtlauncher;

WordWheelQuery - C:\Temp\evil3\evil\evil3.txt.

WordWheelQuery - C:\Temp\evil11\evil\evil11.txt.

4

CompName – BKScomp4;

12

CompName – BKScomp12;

Time Zone – UTC +04:00;

Time Zone – UTC +12:00;

DefaultUserName – BKSstud4;

DefaultUserName – BKSstud912;

DefaultPassword – qwerty4;

DefaultPassword – qwerty12;

Run - "FullPath\telegram.exe* /backgroud";

Run - "FullPath\ Npcap.exe* /backgroud";

Shimcache - telegram.exe, taskkill.exe, msconfig.exe +

Shimcache – PktMon.exe, RecoveryDrive.exe,

2 на выбор;

net.exe+ 2 на выбор;

Schedule Task - запуск telegram в опр. время;

Schedule Task – запуск Npcap.exe в опр. время;

OpenSavePidlMRU – BKSevil7.txt, BKSevil8.pdf;

OpenSavePidlMRU – BKSevil21.txt, BKSevil22.pdf;

bam – telegram.exe, taskkill.exe, msconfig.exe;

bam – PktMon.exe, RecoveryDrive.exe, net.exe;

RecentDocs - 4test.txt, 4test.pdf, 4test.zip;

RecentDocs - 12test.txt, 12test.pdf, 12test.zip;

RunMRU – gpedit.msc, calc;

RunMRU – control userpasswords2, calc;

WordWheelQuery - C:\Temp\evil4\evil\evil4.txt.

WordWheelQuery - C:\Temp\evil12\evil\evil12.txt.

5

CompName – BKScomp5;

13

CompName – BKScomp13;

Time Zone – UTC +05:00;

Time Zone – UTC +13:00;

DefaultUserName – BKSstud5;

DefaultUserName – BKSstud13;

DefaultPassword – qwerty5;

DefaultPassword – qwerty13;

Run - "FullPath\Edge.exe* /backgroud";

Run - "FullPath\ wireshark.exe /backgroud";

Shimcache – msinfo32.exe, taskkill.exe, msconfig.exe

Shimcache – netstat.exe, discord.exe, google.exe+ 2 на

+ 2 на выбор;

выбор;

Schedule Task - запуск telegram в опр. время;

Schedule Task – запуск wireshark.exe в опр. время;

OpenSavePidlMRU – BKSevil7.txt, BKSevil8.pdf;

OpenSavePidlMRU – BKSevil23.txt, BKSevil24.pdf;

bam – telegram.exe, net.exe, netsh.exe;

bam – netstat.exe, discord.exe, google.exe;

RecentDocs - 5test.txt, 5test.pdf, 5test.zip;

RecentDocs - 13test.txt, 13test.pdf, 13test.zip;

RunMRU – firewall.cpl, cmd;

RunMRU – mmc, winevt;

WordWheelQuery - C:\Temp\evil5\evil\evil5.txt.

WordWheelQuery - C:\Temp\evil13\evil\evil13.txt.

6

CompName – BKScomp6;

14

CompName – BKScomp14;

Time Zone – UTC +06:00;

Time Zone – UTC +14:00;

DefaultUserName – BKSstud6;

DefaultUserName – BKSstud14;

DefaultPassword – qwerty6;

DefaultPassword – qwerty14;

Run - "FullPath\Zoom.exe* /backgroud";

Run - "FullPath\ dataspell64.exe * /backgroud";

Shimcache – nslookup.exe, OptionalFeatures.exe,

Shimcache – nltest.exe, notepad.exe, ping.exe + 2 на

osc.exe + 2 на выбор;

выбор;

Schedule Task - запуск Zoom в опр. время;

Schedule Task – запуск dataspell64.exe в опр. время;

OpenSavePidlMRU – BKSevil9.txt, BKSevil10.pdf;

OpenSavePidlMRU – BKSevil25.txt, BKSevil26.pdf;

bam – nslookup.exe, OptionalFeatures.exe, osc.exe;

bam – nltest.exe, notepad.exe, ping.exe;

RecentDocs - 6test.txt, 6test.pdf, 6test.zip;

RecentDocs - 14test.txt, 14test.pdf, 14test.zip;

RunMRU – control panel, config;

RunMRU – mstsc.exe, perfmon;

WordWheelQuery - C:\Temp\evil6\evil\evil6.txt.

WordWheelQuery - C:\Temp\evil14\evil\evil14.txt.

7

CompName – BKScomp7;

15

CompName – BKScomp15;

Time Zone – UTC +07:00;

Time Zone – UTC -05:00;

DefaultUserName – BKSstud7;

DefaultUserName – BKSstud15;

DefaultPassword – qwerty7;

DefaultPassword – qwerty15;

Run - "FullPath\osc.exe* /backgroud";

Run - "FullPath\ Intercepter-NG.exe * /backgroud";

Shimcache – query.exe, sc.exe, at.exe + 2 на выбор;

Shimcache – userinit.exe, netsh.exe, cmd.exe + 2 на

Schedule Task – запуск osc.exe в опр. время;

выбор;

OpenSavePidlMRU – BKSevil11.txt, BKSevil12.pdf;

Schedule Task – запуск Intercepter-NG.exe в опр.

bam – query.exe, sc.exe, at.exe;

время;

RecentDocs - 7test.txt, 7test.pdf, 7test.zip;

OpenSavePidlMRU – BKSevil27.txt, BKSevil28.pdf;

RunMRU – conmpmgmtlauncher, shell:startup;

bam – userinit.exe, netsh.exe, cmd.exe;

WordWheelQuery - C:\Temp\evil7\evil\evil7.txt.

RecentDocs - 15test.txt, 15test.pdf, 15test.zip;

RunMRU – regedit, control panel;

WordWheelQuery - C:\Temp\evil15\evil\evil15.txt.

№

Уровень

Название

Описание

Способ (способы)

уязвимости

опасности

уязвимости

уязвимости

устранения

выявленной

уязвимости

1

…

…

…

…

…

…

…

…

…