Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Wdf01000] 'ImagePath' = 'System32\Drivers\wdf01000.sys'
Вредоносные функции:
Запускает на исполнение:
- '%TEMP%\Win.exe' /nobackup /overwriteoem /ER /quiet
- 'C:\39db95f7399a0210c337\update\update.exe' /nobackup /overwriteoem /ER /quiet
- '%TEMP%\WinUsb.exe' /nobackup /overwriteoem /ER /quiet
- 'C:\fe9d6f59ea422c00124dd4559a81c1\update\update.exe' /nobackup /overwriteoem /ER /quiet
Изменения в файловой системе:
Создает следующие файлы:
- C:\39db95f7399a0210c337\update\update.ver
- C:\39db95f7399a0210c337\$shtdwn$.req
- C:\39db95f7399a0210c337\update\updatebr.inf
- C:\39db95f7399a0210c337\update\update_win2k.inf
- C:\39db95f7399a0210c337\update\update_winxp.inf
- %WINDIR%\Wdf01007Inst.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\39db95f7399a0210c337\update\update_srv2k3.inf
- C:\39db95f7399a0210c337\spuninst.exe
- C:\39db95f7399a0210c337\spupdsvc.exe
- C:\39db95f7399a0210c337\spmsgxp_2k3.dll
- C:\39db95f7399a0210c337\spmsg.dll
- C:\39db95f7399a0210c337\spmsg2k.dll
- C:\39db95f7399a0210c337\wdf01000.sys
- C:\39db95f7399a0210c337\update\updspapi.dll
- C:\39db95f7399a0210c337\update\update.exe
- C:\39db95f7399a0210c337\update\kmdfcustom.dll
- C:\39db95f7399a0210c337\wdfldr.sys
- C:\39db95f7399a0210c337\update\wdf01007.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\MAPPING.VER
- %WINDIR%\Wdf01007.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- <DRIVERS>\SET6.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wdf01007.cat
- <DRIVERS>\SET5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SYSTEM
- <SYSTEM32>\spmsgXP_2k3.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\ComDb.Dat
- %TEMP%\Win.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\$shtdwn$.req
- %WINDIR%\winusb0100Inst.log
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update.ver
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_xp.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\update\updatebr.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_srv03.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\spuninst.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\spupdsvc.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\winusb.dll
- %TEMP%\WinUsb.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\spmsg.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\winusb.sys
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_2k.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\update\updspapi.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\update\winusb0100.cat
- C:\fe9d6f59ea422c00124dd4559a81c1\update\spcustom.dll
- %WINDIR%\winusb0100.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- <DRIVERS>\SET4.tmp
- <SYSTEM32>\SET3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\winusb0100.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wdf01007.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\winusb0100.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- C:\fe9d6f59ea422c00124dd4559a81c1\winusb.sys
- C:\fe9d6f59ea422c00124dd4559a81c1\spupdsvc.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\update\winusb0100.cat
- C:\fe9d6f59ea422c00124dd4559a81c1\update\updspapi.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\update\spcustom.dll
- %TEMP%\WinUsb.exe
- %WINDIR%\_000000_.tmp.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\spmsg.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\spuninst.exe
- C:\fe9d6f59ea422c00124dd4559a81c1\winusb.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update.exe
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\_000000_.tmp.dll
- %WINDIR%\_000001_.tmp.dll
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_srv03.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_2k.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update_xp.inf
- C:\fe9d6f59ea422c00124dd4559a81c1\update\update.ver
- C:\fe9d6f59ea422c00124dd4559a81c1\update\updatebr.inf
Перемещает следующие системные файлы:
- <SYSTEM32>\spmsg2.dll в <SYSTEM32>\_000000_.tmp.dll
Перемещает следующие файлы:
- %WINDIR%\Wdf01007.cat в %WINDIR%\_000000_.tmp.dll
- <DRIVERS>\SET5.tmp в <DRIVERS>\wdfldr.sys
- <DRIVERS>\SET6.tmp в <DRIVERS>\wdf01000.sys
- %WINDIR%\winusb0100.cat в %WINDIR%\_000001_.tmp.dll
- <SYSTEM32>\SET3.tmp в <SYSTEM32>\winusb.dll
- <DRIVERS>\SET4.tmp в <DRIVERS>\winusb.sys
Подменяет следующие файлы:
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
