Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SamSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\LmHosts] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PlugPlay] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ShellHWDetection] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanworkstation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\DcomLaunch] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Dhcp] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CryptSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\EventSystem] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanserver] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Dnscache] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Eventlog] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' config Spooler start= DEMAND
- '<SYSTEM32>\sc.exe' config SNMPTRAP start= DEMAND
- '<SYSTEM32>\sc.exe' config sppuinotify start= DEMAND
- '<SYSTEM32>\sc.exe' config sppsvc start= AUTO
- '<SYSTEM32>\sc.exe' config ShellHWDetection start= AUTO
- '<SYSTEM32>\sc.exe' config SensrSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config SENS start= DEMAND
- '<SYSTEM32>\sc.exe' config SharedAccess start= DISABLED
- '<SYSTEM32>\sc.exe' config SessionEnv start= DEMAND
- '<SYSTEM32>\sc.exe' config TapiSrv start= DEMAND
- '<SYSTEM32>\sc.exe' config TabletInputService start= DEMAND
- '<SYSTEM32>\sc.exe' /pid=1568
- '<SYSTEM32>\sc.exe' config TBS start= DEMAND
- '<SYSTEM32>\sc.exe' config SysMain start= AUTO
- '<SYSTEM32>\sc.exe' config SstpSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config SSDPSRV start= DEMAND
- '<SYSTEM32>\sc.exe' config swprv start= DEMAND
- '<SYSTEM32>\sc.exe' config stisvc start= DEMAND
- '<SYSTEM32>\sc.exe' config seclogon start= DEMAND
- '<SYSTEM32>\sc.exe' config RasAuto start= DEMAND
- '<SYSTEM32>\sc.exe' config QWAVE start= DEMAND
- '<SYSTEM32>\sc.exe' config RemoteAccess start= DISABLED
- '<SYSTEM32>\sc.exe' config RasMan start= DEMAND
- '<SYSTEM32>\sc.exe' config ProtectedStorage start= DEMAND
- '<SYSTEM32>\sc.exe' config PolicyAgent start= DEMAND
- '<SYSTEM32>\sc.exe' config PNRPsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config ProfSvc start= AUTO
- '<SYSTEM32>\sc.exe' config Power start= AUTO
- '<SYSTEM32>\sc.exe' config Schedule start= AUTO
- '<SYSTEM32>\sc.exe' config SCardSvr start= DEMAND
- '<SYSTEM32>\sc.exe' config SDRSVC start= DEMAND
- '<SYSTEM32>\sc.exe' config SCPolicySvc start= DEMAND
- '<SYSTEM32>\sc.exe' config SamSs start= AUTO
- '<SYSTEM32>\sc.exe' config RpcEptMapper start= AUTO
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= DEMAND
- '<SYSTEM32>\sc.exe' config RpcSs start= AUTO
- '<SYSTEM32>\sc.exe' config RpcLocator start= DEMAND
- '<SYSTEM32>\sc.exe' config TermService start= DEMAND
- '<SYSTEM32>\sc.exe' config Wlansvc start= AUTO
- '<SYSTEM32>\sc.exe' config WinRM start= DEMAND
- '<SYSTEM32>\sc.exe' config WMPNetworkSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config wmiApSrv start= DEMAND
- '<SYSTEM32>\sc.exe' config Winmgmt start= AUTO
- '<SYSTEM32>\sc.exe' config wercplsupport start= DEMAND
- '<SYSTEM32>\sc.exe' config Wecsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config WinHttpAutoProxySvc start= DEMAND
- '<SYSTEM32>\sc.exe' config WerSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config wudfsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config wuauserv start= DEMAND
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
- '<SYSTEM32>\sc.exe' config WwanSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config WSearch start= DISABLED
- '<SYSTEM32>\sc.exe' config WPCSvc start= DEMAND
- '<SYSTEM32>\sc.exe' /pid=1492
- '<SYSTEM32>\sc.exe' config wscsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config WPDBusEnum start= DEMAND
- '<SYSTEM32>\sc.exe' config WebClient start= DEMAND
- '<SYSTEM32>\sc.exe' config upnphost start= DEMAND
- '<SYSTEM32>\sc.exe' config UmRdpService start= DEMAND
- '<SYSTEM32>\sc.exe' config VaultSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config UxSms start= AUTO
- '<SYSTEM32>\sc.exe' config UI0Detect start= DEMAND
- '<SYSTEM32>\sc.exe' config THREADORDER start= DEMAND
- '<SYSTEM32>\sc.exe' config Themes start= AUTO
- '<SYSTEM32>\sc.exe' config TrustedInstaller start= DEMAND
- '<SYSTEM32>\sc.exe' config TrkWks start= DEMAND
- '<SYSTEM32>\sc.exe' config WcsPlugInService start= DEMAND
- '<SYSTEM32>\sc.exe' config wcncsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config WdiSystemHost start= DEMAND
- '<SYSTEM32>\sc.exe' config WdiServiceHost start= DEMAND
- '<SYSTEM32>\sc.exe' config WbioSrvc start= DEMAND
- '<SYSTEM32>\sc.exe' config VSS start= DEMAND
- '<SYSTEM32>\sc.exe' config vds start= DEMAND
- '<SYSTEM32>\sc.exe' config wbengine start= DEMAND
- '<SYSTEM32>\sc.exe' config W32Time start= DEMAND
- '<SYSTEM32>\sc.exe' config Dnscache start= AUTO
- '<SYSTEM32>\sc.exe' config Dhcp start= AUTO
- '<SYSTEM32>\sc.exe' config DPS start= DEMAND
- '<SYSTEM32>\sc.exe' config dot3svc start= DEMAND
- '<SYSTEM32>\sc.exe' config defragsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config CryptSvc start= AUTO
- '<SYSTEM32>\sc.exe' config COMSysApp start= DEMAND
- '<SYSTEM32>\sc.exe' config DcomLaunch start= AUTO
- '<SYSTEM32>\sc.exe' config CscService start= DEMAND
- '<SYSTEM32>\sc.exe' config Fax start= DEMAND
- '<SYSTEM32>\sc.exe' config EventSystem start= AUTO
- '<SYSTEM32>\sc.exe' config FDResPub start= DEMAND
- '<SYSTEM32>\sc.exe' config fdPHost start= DEMAND
- '<SYSTEM32>\sc.exe' config eventlog start= AUTO
- '<SYSTEM32>\sc.exe' config EFS start= DEMAND
- '<SYSTEM32>\sc.exe' config EapHost start= DEMAND
- '<SYSTEM32>\sc.exe' config ehSched start= DEMAND
- '<SYSTEM32>\sc.exe' config ehRecvr start= DEMAND
- '<SYSTEM32>\sc.exe' config clr_optimization_v2.0.50727_64 start= DEMAND
- '<SYSTEM32>\sc.exe' config Appinfo start= DEMAND
- '<SYSTEM32>\sc.exe' config AppIDSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config AudioEndpointBuilder start= AUTO
- '<SYSTEM32>\sc.exe' config AppMgmt start= DEMAND
- '<SYSTEM32>\sc.exe' config ALG start= DEMAND
- '<SYSTEM32>\powercfg.exe' -h off
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\deskrun.bat
- '<SYSTEM32>\sc.exe' config AeLookupSvc start= DEMAND
- '<SYSTEM32>\reg.exe' DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend /f
- '<SYSTEM32>\sc.exe' config bthserv start= DEMAND
- '<SYSTEM32>\sc.exe' config Browser start= DEMAND
- '<SYSTEM32>\sc.exe' config clr_optimization_v2.0.50727_32 start= DEMAND
- '<SYSTEM32>\sc.exe' config CertPropSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config BITS start= DEMAND
- '<SYSTEM32>\sc.exe' config AxInstSV start= DEMAND
- '<SYSTEM32>\sc.exe' config AudioSrv start= AUTO
- '<SYSTEM32>\sc.exe' config BFE start= AUTO
- '<SYSTEM32>\sc.exe' config BDESVC start= DEMAND
- '<SYSTEM32>\sc.exe' config FontCache start= DEMAND
- '<SYSTEM32>\sc.exe' config netprofm start= DEMAND
- '<SYSTEM32>\sc.exe' config Netman start= DEMAND
- '<SYSTEM32>\sc.exe' config NlaSvc start= AUTO
- '<SYSTEM32>\sc.exe' config NetTcpPortSharing start= DISABLED
- '<SYSTEM32>\sc.exe' config Netlogon start= DEMAND
- '<SYSTEM32>\sc.exe' config MSiSCSI start= DEMAND
- '<SYSTEM32>\sc.exe' config MSDTC start= DEMAND
- '<SYSTEM32>\sc.exe' config napagent start= DEMAND
- '<SYSTEM32>\sc.exe' config msiserver start= DEMAND
- '<SYSTEM32>\sc.exe' config pla start= DEMAND
- '<SYSTEM32>\sc.exe' config PerfHost start= DEMAND
- '<SYSTEM32>\sc.exe' config PNRPAutoReg start= DEMAND
- '<SYSTEM32>\sc.exe' config PlugPlay start= AUTO
- '<SYSTEM32>\sc.exe' config PeerDistSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config p2pimsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config nsi start= AUTO
- '<SYSTEM32>\sc.exe' config PcaSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config p2psvc start= DEMAND
- '<SYSTEM32>\sc.exe' config MpsSvc start= AUTO
- '<SYSTEM32>\sc.exe' config idsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config HomeGroupProvider start= DEMAND
- '<SYSTEM32>\sc.exe' config IPBusEnum start= DEMAND
- '<SYSTEM32>\sc.exe' config IKEEXT start= DEMAND
- '<SYSTEM32>\sc.exe' config HomeGroupListener start= DEMAND
- '<SYSTEM32>\sc.exe' config gpsvc start= AUTO
- '<SYSTEM32>\sc.exe' config FontCache3.0.0.0 start= DEMAND
- '<SYSTEM32>\sc.exe' config hkmsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config hidserv start= DEMAND
- '<SYSTEM32>\sc.exe' config lmhosts start= AUTO
- '<SYSTEM32>\sc.exe' config lltdsvc start= DEMAND
- '<SYSTEM32>\sc.exe' config MMCSS start= AUTO
- '<SYSTEM32>\sc.exe' config Mcx2Svc start= DISABLED
- '<SYSTEM32>\sc.exe' config LanmanWorkstation start= AUTO
- '<SYSTEM32>\sc.exe' config KeyIso start= DEMAND
- '<SYSTEM32>\sc.exe' config iphlpsvc start= DISABLED
- '<SYSTEM32>\sc.exe' config LanmanServer start= AUTO
- '<SYSTEM32>\sc.exe' config KtmRm start= DEMAND
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\sc.exe
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\deskrun.bat
- %TEMP%\aut1.tmp
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
