Trojan.DownLoader23.6377

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\IDriverT] 'ImagePath' = '"%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe"'

Вредоносные функции:

Запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
'<SYSTEM32>\msiexec.exe' -Embedding 4ECED0C1C481995C56E9D40FA432659B C
'%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe'
'%WINDIR%\regedit.exe' /s 2.reg
'%TEMP%\RarSFX0\1.exe'
'<SYSTEM32>\msiexec.exe' /V

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\3dd5.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
%TEMP%\MSI8.tmp
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\_ISRES.DLL
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\IsConfig.INI
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\ISRT.DLL
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\String2052.txt
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\Eula.rtf
%TEMP%\MSI7.tmp
%TEMP%\MSI6.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%TEMP%\_is1\ISScript1150.Msi
%TEMP%\_is1\Sayatoo їЁАЧЦД»ѕ«Бй.msi
%TEMP%\_is1\2052.MST
%WINDIR%\Installer\2f265.msi
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%TEMP%\~2.tmp
%TEMP%\_is1\Setup.INI
%TEMP%\RarSFX0\2.reg
%TEMP%\RarSFX0\1.exe
%TEMP%\_is1\_ISMSIDEL.INI
%TEMP%\_is1\0x0409.ini
%TEMP%\_is1\0x0404.ini
%TEMP%\_is1\0x0804.ini
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IUserCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\objpscnv.dll
%TEMP%\{7620CA82-79A3-4018-8BA1-E9DEE9050F07}\setup.inx
%TEMP%\~DFFCCA.tmp
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver2.exe
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver.exe
%WINDIR%\Installer\MSI3.tmp
%TEMP%\~DFAFC7.tmp
%WINDIR%\Installer\2f267.ipi
C:\Config.Msi\2f268.rbs
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\_ISRES1033.dll
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\ISRT.dll
%CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe