Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\LANEscortPicture\shell\open\command] '' = '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe /ApplyFile "%1" /Prompt'
- [<HKLM>\SOFTWARE\Classes\Self-Installing File\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\PortableWindowsSubscription\shell\open\command] '' = '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe /SubscribeFile "%1"'
- [<HKLM>\SOFTWARE\Classes\PortableWindowsScript\shell\open\command] '' = '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe /PlayScript "%1" /Prompt'
- [<HKLM>\SOFTWARE\Classes\PortableWindowsChanges\shell\open\command] '' = '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe /ApplyFile "%1" /Prompt'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 639924' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\639924'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 634893' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\634893'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Prism Deploy Client' = '"%PROGRAM_FILES%\New Boundary\Client\PTClient.exe" /Subscriber'
- [<HKLM>\SOFTWARE\Classes\PortableWindowsSubscription\shell\open\command] '' = '%ClientPath%\PTClient.exe /SubscribeFile "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe' /subscriber /system
- '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe' /Service 2858D813-4DA1-4FA0-9F84-9F68415C19EB
- '%CommonProgramFiles%\New Boundary\PrismXL\PrismXL.sys'
- '%PROGRAM_FILES%\New Boundary\Client\PTClient.exe' /Subscriber
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\msxml4.dll
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
- %WINDIR%\WinSxS\InstallTemp\634893\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat
- %WINDIR%\WinSxS\InstallTemp\634893\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat
- <SYSTEM32>\wex4962\msvcp71.dll
- <SYSTEM32>\wex4962\EMInvCliExtend.dll
- <SYSTEM32>\wex4962\msvcr71.dll
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D.manifest
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D.cat
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\CBE015B2-CF78-4963-82F6-9234AD716033.LOG
- \Device\LanmanRedirector\127.0.0.1\PIPE\wkssvc
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\29615419-C956-4E40-B6DB-DC17F6B6F7EB.LOG
- \Device\LanmanRedirector\CRNJEUFU*\MAILSLOT\NET\NETLOGON
- \Device\LanmanRedirector\WORKGROUP*\MAILSLOT\NET\NETLOGON
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\ClientLog.XML
- %WINDIR%\WinSxS\InstallTemp\639924\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
- %WINDIR%\WinSxS\InstallTemp\634893\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest
- %WINDIR%\WinSxS\InstallTemp\639924\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.cat
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\.LOG
- %WINDIR%\WinSxS\InstallTemp\639924\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.Manifest
- <SYSTEM32>\wex4962\EMClient.dll
- %PROGRAM_FILES%\New Boundary\Client\nbtlm2x.exe
- %PROGRAM_FILES%\New Boundary\Client\nbtlm2x.dll
- %PROGRAM_FILES%\New Boundary\Client\NbtPower.exe
- %PROGRAM_FILES%\New Boundary\Client\nbtpwr2x.exe
- %PROGRAM_FILES%\New Boundary\Client\nbtpwr.exe
- %PROGRAM_FILES%\New Boundary\Client\nbtlm.exe
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\UNAPPLY\<Имя вируса>.PWR
- %PROGRAM_FILES%\New Boundary\Client\PTClient.exe
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\UNAPPLY\<Имя вируса> 1.PWR
- %PROGRAM_FILES%\New Boundary\Client\nbtlm.dll
- %PROGRAM_FILES%\New Boundary\Client\EMInvCli.exe
- <SYSTEM32>\msxml4a.dll
- <SYSTEM32>\msxml4.dll
- <SYSTEM32>\msxml4r.dll
- <SYSTEM32>\wex4962\dbghelp.dll
- <SYSTEM32>\wex4962\atl71.dll
- <SYSTEM32>\capicom.dll
- %PROGRAM_FILES%\New Boundary\Client\scan.bat
- %PROGRAM_FILES%\New Boundary\Client\ptclient.chm
- %CommonProgramFiles%\New Boundary\PrismXL\PrismXL.sys
- %CommonProgramFiles%\New Boundary\PrismXL\ptshlext64.dll
- %CommonProgramFiles%\New Boundary\PrismXL\ptshlext.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\wex4962\msvcr71.dll
- <SYSTEM32>\wex4962\msvcp71.dll
- <SYSTEM32>\wex4962\dbghelp.dll
Удаляет следующие файлы:
- %CommonProgramFiles%\New Boundary\PrismXL\ptshlext64.dll
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\29615419-C956-4E40-B6DB-DC17F6B6F7EB.LOG
- %ALLUSERSPROFILE%\Application Data\Prism Deploy\PrismXL\CBE015B2-CF78-4963-82F6-9234AD716033.LOG
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\msxml4.dll
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D.manifest
- %TEMP%\NBT000\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8FF50C5D.cat
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest
- %TEMP%\NBT000\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat
Перемещает следующие файлы:
- %WINDIR%\WinSxS\InstallTemp\639924\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.cat в %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.cat
- %WINDIR%\WinSxS\InstallTemp\639924\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.Manifest в %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.Manifest
- %WINDIR%\WinSxS\InstallTemp\634893\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat в %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat
- %WINDIR%\WinSxS\InstallTemp\634893\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest в %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest
Сетевая активность:
Подключается к:
- 'localhost':445
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Prism Deploy Client'
- ClassName: '(null)' WindowName: 'New Boundary Client'
