Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Internet Name Service] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe' = '<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe:*:Enabled:Windows Internet Name Service'
Создает и запускает на исполнение:
- '%TEMP%\IPFilter.exe'
- '<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe'
- '<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\updater.exe'
- '%TEMP%\MFCSetup.exe' -s "http://fb##c.com/click/?c=#############################"
- '%TEMP%\TCChecker.exe'
- '%TEMP%\7ZipSfx.000\installer.exe'
- '%TEMP%\IPFilter.exe' (загружен из сети Интернет)
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: 'OLLYDBG' WindowName: '(null)'
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2202' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1800' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A04' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1806' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '120A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1800' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1806' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1607' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\updater.exe
- %TEMP%\IPFilter.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\IPFilter[1].exe
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-03.cache
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\click[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\click[1]
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\queries-02.cache
- %TEMP%\aut2.tmp
- %TEMP%\TCChecker.exe
- %TEMP%\aut1.tmp
- %TEMP%\MFCSetup.exe
- <SYSTEM32>\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe
- %TEMP%\7ZipSfx.000\installer.exe
- %TEMP%\7ZipSfx.000\config.txt
Удаляет следующие файлы:
- %TEMP%\7ZipSfx.000\installer.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\click[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\click[1]
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\7ZipSfx.000\config.txt
Сетевая активность:
Подключается к:
- 'tc##in.com':80
- 'localhost':1049
- 'localhost':1054
- 'localhost':1058
- 'localhost':1056
- 'localhost':1039
- 'www.th####sharing.com':80
- 'fb##c.com':80
- 'localhost':1043
- 'tc###nack.com':80
TCP:
Запросы HTTP GET:
- tc###nack.com/update.php
- tc##in.com/update.php
- www.th####sharing.com/downloads/IPFilter.exe
- fb##c.com/click/?c=#############################
Запросы HTTP POST:
- tc###nack.com/drm_check3.php
UDP:
- DNS ASK tc##in.com
- DNS ASK tc##st.com
- DNS ASK tc###nack.com
- DNS ASK www.th####sharing.com
- DNS ASK fb##c.com
- '23#.#55.255.250':1900
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
