Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\ScreensaverHDSaison.scr'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v NoBrowserOptions /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /t REG_BINARY /d 460000007b000000030000000a000000302e302e302e303a3830b1000...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /t REG_SZ /d "*.microsoft.com;*.sgvf.sgcf;*.sgcf-asia.com;118.143.43.116;*.sgvf.com.vn;221.1...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v LAN Connection /t REG_BINARY /d 4600000007000000030000000a000000302e302e302e303a3830b10...
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /t REG_SZ /d "*.microsoft.com;*.sgvf.sgcf;*.sgcf-asia.com;118.143.43.116;*.sgvf.com.v...
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d "0.0.0.0:80" /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v MenuShowDelay /t REG_DWORD /d 20 /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ThumbnailLivePreviewHoverTime /t REG_DWORD /d 200 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v MenuShowDelay /t REG_DWORD /d 20 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ThumbnailLivePreviewHoverTime /t REG_DWORD /d 200 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_BINARY /d 460000001e000000030000000a000000302e302e302e303a383...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v NoBrowserOptions /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v LAN Connection /t REG_BINARY /d 4600000007000000030000000a000000302e302e302e303a3830b10000002a...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d "0.0.0.0:80" /f
- '%HOMEPATH%\UpdateSIP\UpdateAll01.exe'
- '%WINDIR%\regedit.exe' /s "%HOMEPATH%\export.reg"
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d 600 /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
- '%HOMEPATH%\UpdateSIP\rxrepl.exe' -a --nobackup -D "%HOMEPATH%/AppData/Local/Microsoft/Windows Mail/Local Folders/" -I *.oeaccount -s sgvf.com.vn -r hdfinance.com.vn
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%\UpdateSIP\init.bat" "
- '%HOMEPATH%\UpdateSIP\rxrepl.exe' -a --nobackup -D "%HOMEPATH%/" -I export.reg -s sgvf.com.vn -r hdfinance.com.vn
- '%WINDIR%\regedit.exe' /e "%HOMEPATH%\export.reg" "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "<SYSTEM32>\ScreensaverHDSaison.scr" /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /t REG_BINARY /d 460000007b000000030000000a000000302e302e302e303a38...
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_BINARY /d 460000001e000000030000000a000000302e302e302e...
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "<SYSTEM32>\ScreensaverHDSaison.scr" /f
- '<SYSTEM32>\cmd.exe' /c Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d 600 /f
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '0.0.0.0:80'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '*.microsoft.com;*.sgvf.sgcf;*.sgcf-asia.com;118.143.43.116;*.sgvf.com.vn;221.133.24.58;123.30.82.198;*.hd...
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\UpdateSIP\Nhap hop dong 2.bat
- %HOMEPATH%\UpdateSIP\Nhap hop dong 2.lnk
- %HOMEPATH%\UpdateSIP\LUU Y QUAN TRONG.txt
- %HOMEPATH%\UpdateSIP\UpdateAll01.exe
- %HOMEPATH%\UpdateSIP\Xoa Cookies.lnk
- %HOMEPATH%\UpdateSIP\Huong Dan Cac Cach Dang Nhap INDUS.pdf
- %HOMEPATH%\export.reg
- %HOMEPATH%\export.reg.tmp
- %HOMEPATH%\UpdateSIP\ScreensaverHDSaison.scr
- %HOMEPATH%\UpdateSIP\los1.hdsaison.com.vn.RDP
- %HOMEPATH%\UpdateSIP\los2.hdsaison.com.vn.RDP
- %HOMEPATH%\UpdateSIP\Xoa Cookies.bat
- %HOMEPATH%\UpdateSIP\Nhap hop dong.lnk
- %HOMEPATH%\UpdateSIP\rxrepl.exe
- %HOMEPATH%\UpdateSIP\Nhap hop dong.bat
- %HOMEPATH%\UpdateSIP\Nhap hop dong (VPN).bat
- %HOMEPATH%\UpdateSIP\Nhap hop dong (VPN).lnk
- %HOMEPATH%\UpdateSIP\start.bat
- %HOMEPATH%\UpdateSIP\SIP Mail HDFinance.lnk
- %HOMEPATH%\UpdateSIP\Hotline ho tro POS.txt
- %HOMEPATH%\UpdateSIP\SIP Mail HDFinance.bat
- %HOMEPATH%\UpdateSIP\init.bat
- %HOMEPATH%\UpdateSIP\Time_Update_Daily_Pos.exe
Удаляет следующие файлы:
- %HOMEPATH%\UpdateSIP\rxrepl.exe
- %HOMEPATH%\export.reg
Подменяет следующие файлы:
- %HOMEPATH%\export.reg
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
