Trojan.DownLoader17.35282

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%WINDIR%\explorer.exe'
'<SYSTEM32>\attrib.exe'

Внедряет код в

следующие системные процессы:

<SYSTEM32>\smss.exe
<SYSTEM32>\attrib.exe

Изменения в файловой системе:

Создает следующие файлы:

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0N63GRSJ\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y1AVEXS1\desktop.ini
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\cd381d20-a29a-4c7f-a51d-5ed201dc42f5
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\a1228617-e02a-4ed8-9e71-5559d9eb4a95
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\a0257455-0d7d-423a-8fa3-579b56df9d5e
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\0910db26-74d8-4ff5-8583-0ae52df4b9eb
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\A9W3IZCH\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
%ALLUSERSPROFILE%\Application Data\tcusyhan\esumipaq.dat
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\8c4b0ad3-fc54-4927-8f6c-59b285c3e9d3
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\1787c64d-1191-4788-9ccf-4448b912363e
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\AYVSSKDU\desktop.ini
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\9629a0a4-711a-4f19-958b-076b151be51d
C:\Documents and Settings\NetworkService\Cookies\index.dat
%WINDIR%\ykuq\osabattf.exe
%ALLUSERSPROFILE%\Application Data\Sun\eqasajan.bkp
%ALLUSERSPROFILE%\Application Data\tcusyhan\eqasajan.dat
<SYSTEM32>\Microsoft\Protect\S-1-5-18\User\8d3d2a3c-a8b4-4704-8f7b-3ba5f6912e68
%ALLUSERSPROFILE%\Application Data\tcusyhan\ngufyzyg.dat
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
%ALLUSERSPROFILE%\Application Data\Sun\umehonuk.bkp
%ALLUSERSPROFILE%\Application Data\tcusyhan\umehonuk.dat
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20\a796ea20-c60e-4f53-88d9-88c6555461a2
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20\272963f8-3daf-4029-8acc-6f782015f9fa
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Crypto\RSA\S-1-5-20\dd8c7d4588a7bad5e1907f00c4a553ce_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\S-1-5-20\Preferred
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\CREDHIST
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Protect\CREDHIST
C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect\S-1-5-19\1fef2e9a-89aa-4552-ab77-2ebb037867ad

Присваивает атрибут 'скрытый' для следующих файлов:

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0N63GRSJ\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\AYVSSKDU\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\A9W3IZCH\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y1AVEXS1\desktop.ini

Сетевая активность:

Подключается к: