Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\194490c8-36d1-4aab-8d50-2cafd83fb219-4.job
- %WINDIR%\Tasks\194490c8-36d1-4aab-8d50-2cafd83fb219-3.job
- %WINDIR%\Tasks\194490c8-36d1-4aab-8d50-2cafd83fb219-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219-11.exe' /bXjZYGJ=agxf2AdTgvnC1uF1VIkYRONhpxwjDNx/GjRak2ihWdFx62PuiO62+XSf7iWgXulSbkmaIGjf4n1AuRJ0u4b1ZgwZUY65sOZ7jbXANCMpRD8cU4lziLJKLDrS1mSTcrPbFs1AhkqzmKBOaTbLPW0GkaNMk0A/WEcEKAmmiGzfIXCrLPhHgLbsA38nReom6m7kAZLc/vdfIM30ImMa8DBH+WmkL7GkW8/1DYjTKbYIBfPqYVoO1lwons6kSw3LgF1/OD1AULM7qBYGeVGTJYIxqRBPxt+K1NA8+KBZZ9R3yEPXy2OaOLvKTk5dPzhI0id6R2JDM728dCLrrENiqO+1iXNjSYLjB7HxB4Ssz3n8OGQNbvmsx3lmSCEjsTrJ2qFK4kIQhislK/aKVBtCQeqA7BEG3Kxp33DaidUHrVsHBVZblB067KKs2p+QhbERYcDnSVy1ayrNyH23gCdo+91jO4V3RdYbhhL3+r6fLbLMAD/r1bbf/UCDUD1GQWcwQW+FAcwJNJ++UHCVGXdnCUDiAAEpoFQYEGlCdUowdDldMc03wBTF+i0VsVL44mFb4JuoyorNOs49c32kUntOyCrzkJDGA0Bcc2G6mqk6jSvqi+nnTbb6Mg0sEfFlVvuU0kM40UmMQMwvC6/KddDrLISr0va/RG+Vks/a/mcGAINOpBS2a7OBp+7X/H46wRpBFEeREia7j+qQZXNS8Eri88TWtAstZiYLEvyyFrBsn1+XXiljKzU+fVISfiMHrGsNu80tdmz3U5IYsgaXdAPy1KaiPRj3fYRU+36jLdsaj1oSgwU6dtM2fHGiLHnlQwIDtjF2WHYouViWnxGK3LldPQAWOm8BUQVn3duxz9NjLA8BKEBsdm2AHC9NgJHJWyV6a1q2zdMctgKnWPJm9tUiiB8gF7YbsoPRbHcAI7t1Ad1ZKUuAky1xfmHmJvmhv/sPuw+IsVHQBJdy2LL5L0//VxpAEnG76qZNftp/J+p0Kqhv7jqE3JRre53JpskyHM79t5pwZQRD8HLlrYyZW2dA9MsvN0WBEBIftkBKMa02D7cOcSlY9p7lvH0pUkgK1Ur7YebwkAr+jJhRRm6q7N69WY88W+SAYmsSlk/PqIIDLLVd1azZZwWL5ypJkj8aBHb+lBR/EfDYKT0NWfVu9JO07p01z+Ts71RGhZNqRLychpqxWA+JVbZEpTmBol+ex3ngQOD1ecLvxe7EsUR96umuuslMUIT8mKqw4pinEYXfddzwhLabBo0ZyUd6T9bsekLQSLZa7fVMREOBRmZHy8deVs+O/U/tDGhXBFDV/K/JwojNCbdhd0IVNuh8FSwJ336shEhDTUdOij/FzFRojANR/kMmixFZxozsS2X/vhBZED9oIMvGGFCmTlVCFytHnvAQri4YR1WtHMOsuT8lEgOpzbVR1ZzurBlKqjH6k9aQ2XEcMk3UgoMKrjdCIRYVua8G+APg/R8UpaltzRWYHjy1H9zSX0sceiDLfT8NudqCGdZb3UScUyxy3xeGMelQZgqCe4STA3pEAC3d1Vym6jTJJd4ceLu1/kbC7L7raHYd9mWUmPB9HaWwKE7W6h0zCm7lGL5qzjCsvLHVmhfudBjTNPh1cO40B04eySPpSGbvOFPhNO1JtXyMbCcxNIA6u35xq1ZFiVLiIwuX4ixkfbLBwKaiC//3RMacUt0YmxFClN/WaXNYovMC3HPBE5954LozCnCs8ATwFhEKa7WvknISOI74szU65Q/FMc5pgHEGs5wiWpXyxrmjBRLlRufB0WaoBXN++dodcTiyO1tLe/xct+wpVoTINv6Di6CwgtOFDDYvUFe6ZaKyIIs9u+PcaOTH4MwpLmWtQFLoBbOrguvnS+XSTA==
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219-3.exe' /bXjZYGJ=Bd1FPpWedsQVfdKGHB5cnENFTQtK7NZZ+ZYIfl/Xgz8CgZVrbMI4YQHp86BwHzHKZfP0jlxMIilj38LJuq7QNxDCZYtb7qmMafIEhDV4OtJbJyVFwKSTVXnpF2YLbF7dkWTsVrGb1xMDai6MhfxB1i/j/YByqn5ijrktiKZQ7Q43N9y4qftMZYAmuFj9JvIgGMUO3BPkRl+IjgGJWpvQpTKyrdtKruWNA+bGrSTXASF5LWPzf1HckFWqpdwVEMy5+QPmRRyS5Fo6/2KdAe96/zlyEq7h5h3sXL74YI4gSfbBdDkESaM9ZtNtYCs3ZehrcCuLnNTzWuwbHg8oDSZ5GxueCmuGh0f47GbUmadzr+1s3yIFb66XEHjWQlLXrNQyEFUDloZ9Fc7hS7UXnCh6bnYd+FYcGmF4W2ZnuOyQMuk1IpkpufYIKyn3PPSOsMUWzyU9Bp2Dq+qEnKj6XL9qPq6K646BbhSad2Ct+JpGr8O9Gs8+UGzsiYucpYf+sLrpNgG9bZ2fPnDjnGDIlXPsI8gAcbFdH4EU1qeU9pJx3LPQbt704wjN+AXS1mO+5GP/8a1GXlstW+P8U/QDcueNAPuW5MFkpvPBJIWoWhamq7muzZB2vxXW589wAddu6B+GkDrcYd5uWLjPDEDjD33t70k9sMos9QZDUiBp0xTe+7ayF5f2PfuQDVNyx4F3kv81EHAenTccv8hl4qBr+U1T55tZSUAVDV4qbkXnyyi1Dv9YtowcYClzlOIfxF8U8gzT1+VJW4HF02CegvpqTuzmz8HJzeBb30H5RCXdgAtF8MmyqNLOgW8LqaFzbS1UsipEXM+h+k9jsvPTTcvEz3wjaSYO+ywGsv489HanBpss/w3Z6dU34xcYhZI6J+pObSsP+LbnxN5WDjpWMzxkVYjfZQ0tYYmQ3BobrKizEDZ5xp1PhEtMbcee16ijUKylj02BiM6Qg43a0JYQPwrh8JNTCFGGdPf7xI/rRmcbdNKDPxa0OOUHrAjSyb/g0GUQW9EOQQ047Dc+gLqxCVAqu4asrSyopOlNfGiDFH3BvMaycZGSkCxXVR6KHhgMAIqYrq+74eFU8tVnFuaZZgc7Hdwcsh9yxZu4ImNNZjKesUbIIeza2Z6y08dfOfKZCXooVzfmDMBb8GuUuLAnchT7De/QnGKRKxkVmx6x0KOF4DYXiz4+Uh8fDVMNkkru4ibsPUWxpE7L0TVKbprM0bw0+LSnmYZ90gh65OKMVgwYSetNXzQORlehNwWNflOMYSWauM9ml6MSdVVXwXEV5A4nGYf+D9zDxrImxgUaAAeHN17mUOKth8uAYi11QMWQgosUOzNdk5bCEWw3TbnwuTVd+hBjEQhoAEezRR3Vz7ojoiZMl0/8d5RMpwQfg9+u7Fk0Wy/lVzat/5FB+Fsz6C/A8a1+kdTSxd1+RMjDaXvhMyyV/yw0joWfkDWm7E/QeWaHre4bUCz5taYpKTxJ1widAMdbGpQb0whelvI3wgvCAbKJ5XzSDwYTA7auVpif06aD6beG
- '%TEMP%\nsq3.tmp\Grscflzairqv.exe'
- '%TEMP%\comh.389316\GoogleUpdate.exe' /silent /install "appguid={d62802fd-4afd-4c3a-aad9-d0d339ddd0d1}&appname=03a693d2-bb1b-4a9c-8c0a-8f1dc215e107&needsadmin=True&lang=en"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsh6.tmp\ExecDos.dll
- %TEMP%\Cab7.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219.crx
- %PROGRAM_FILES%\Free Video Grabber 6.6\360-57250.crx
- %PROGRAM_FILES%\Free Video Grabber 6.6\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Free Video Grabber 6.6\57250.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219-4.exe
- %PROGRAM_FILES%\Free Video Grabber 6.6\57250.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %TEMP%\Cab9.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\Free Video Grabber 6.6\194490c8-36d1-4aab-8d50-2cafd83fb219-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabB.tmp
- %TEMP%\nsh6.tmp\InstallerUtils2.dll
- %TEMP%\nsh6.tmp\InstallerUtils.dll
- %TEMP%\nsh6.tmp\System.dll
- %TEMP%\nsh6.tmp\nsisos.dll
- %TEMP%\nsh6.tmp\inetc.dll
- %TEMP%\nsh6.tmp\UserInfo.dll
- %TEMP%\nsh6.tmp\md5dll.dll
- %TEMP%\nsh6.tmp\StdUtils.dll
- %TEMP%\nsq3.tmp\Ymmzqvgcqzzr.tmp
- %TEMP%\nsq3.tmp\System.dll
- %TEMP%\nsl2.tmp
- %TEMP%\nsq3.tmp\WrapperUtils.dll
- %TEMP%\nsg5.tmp
- %TEMP%\nsq3.tmp\StdUtils.dll
- %TEMP%\nsq3.tmp\Grscflzairqv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\comh.389316\goopdate.dll
- %TEMP%\comh.389316\GoogleUpdateOnDemand.exe
- %TEMP%\comh.389316\GoogleUpdateHelper.msi
- %TEMP%\comh.389316\goopdateres_en.dll
- %TEMP%\comh.389316\psuser.dll
- %TEMP%\comh.389316\psmachine.dll
- %TEMP%\comh.389316\npGoogleUpdate4.dll
- %TEMP%\comh.389316\GoogleUpdateBroker.exe
- %TEMP%\nsh6.tmp\397286
- %PROGRAM_FILES%\Free Video Grabber 6.6\utils.exe
- %TEMP%\nsh6.tmp\update.json
- %TEMP%\nsh6.tmp\453963
- %TEMP%\comh.389316\GoogleUpdate.exe
- %TEMP%\comh.389316\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Free Video Grabber 6.6\Uninstall.exe
Удаляет следующие файлы:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsh6.tmp\453963
- %TEMP%\Cab7.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##moclientnet.com':80
- 'up####.#emoclientnet.com':80
- 'er####.#emoclientnet.com':80
- 'st###.#emoclientnet.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#emoclientnet.com/installer_updates/001527/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##moclientnet.com
- DNS ASK up####.#emoclientnet.com
- DNS ASK er####.#emoclientnet.com
- DNS ASK st###.#emoclientnet.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
