Trojan.DownLoader26.9868

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}\DownloadInformation] 'CODEBASE' = 'https://juniper.net/dana-cached/setup/JuniperSetupSP1...
[<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\DownloadInformation] 'CODEBASE' = 'https://juniper.net/dana-cached/sc/JuniperSetupClient...

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\JuniperAccessService] 'ImagePath' = '"%CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\JuniperAccessService] 'Start' = '00000002'

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Juniper Networks\Logging\debuglog.log
%WINDIR%\Installer\MSIC.tmp
%CommonProgramFiles%\Juniper Networks\JUNS\versionInfo.ini
%WINDIR%\Installer\MSID.tmp
%WINDIR%\Downloaded Program Files\JuniperSetupClient.ocx
%WINDIR%\Downloaded Program Files\JuniperSetupClient.inf
%WINDIR%\Downloaded Program Files\install.log
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_ZH-CN.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_ZH.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_PL.txt
%CommonProgramFiles%\Juniper Networks\JUNS\NetMonitor.dll
%CommonProgramFiles%\Juniper Networks\JUNS\access.ini
%ProgramFiles%\Juniper Networks\Installer Service\versionInfo.ini
%CommonProgramFiles%\Juniper Networks\JUNS\uninstall.exe
%WINDIR%\Downloaded Program Files\JuniperExt.exe
%WINDIR%\Downloaded Program Files\string_ko.properties
%WINDIR%\Downloaded Program Files\string_ja.properties
%WINDIR%\Downloaded Program Files\string_fr.properties
%WINDIR%\Downloaded Program Files\string_zh.properties
%TEMP%\~DF5459.tmp
%WINDIR%\Installer\20866.msi
%WINDIR%\Downloaded Program Files\string_zh_cn.properties
%WINDIR%\Downloaded Program Files\JuniperSetup.inf
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Downloaded Program Files\JuniperSetupClientCtrlUninstaller.exe
%WINDIR%\Downloaded Program Files\JuniperSetup.ocx
%WINDIR%\Downloaded Program Files\string_es.properties
%WINDIR%\Downloaded Program Files\string_en.properties
%WINDIR%\Downloaded Program Files\string_de.properties
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSI4.tmp
%TEMP%\~DF340.tmp
%WINDIR%\Installer\MSI6.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab8.tmp
C:\Config.Msi\20865.rbs
C:\chip\Juniper\JuniperSetupServiceInstaller.msi
%TEMP%\aut1.tmp
C:\chip\Logs\Juniper Installer Service.log
C:\chip\Logs\JuniperSetupServiceInstaller.log
%WINDIR%\Installer\20864.ipi
%TEMP%\Cab2.tmp
%WINDIR%\Installer\20862.msi
%CommonProgramFiles%\Juniper Networks\JUNS\AccessMethodPS.dll
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_ES.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_EN.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_DE.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_FR.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_KO.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_JA.txt
%CommonProgramFiles%\Juniper Networks\JUNS\MessageCatalogCommon_IT.txt
%CommonProgramFiles%\Juniper Networks\JUNS\dsInstallerService.dll
%CommonProgramFiles%\Juniper Networks\JUNS\dsAccessServicePS.dll
%CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe
%CommonProgramFiles%\Juniper Networks\JUNS\dsInstallerServicePS.dll
%ProgramFiles%\Juniper Networks\Installer Service\JISUninstall.exe
%CommonProgramFiles%\Juniper Networks\JUNS\dsLogService.dll
%CommonProgramFiles%\Juniper Networks\JUNS\dsIpc.dll

Удаляет следующие файлы:

%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\MSID.tmp
C:\Config.Msi\20865.rbs
C:\chip\Juniper\JuniperSetupServiceInstaller.msi
%WINDIR%\Installer\20864.ipi
%WINDIR%\Installer\20862.msi
%WINDIR%\Installer\MSI4.tmp
%TEMP%\Cab2.tmp
%TEMP%\aut1.tmp
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSIC.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab8.tmp

Сетевая активность:

Подключается к:

'crl.verisign.com':80
'csc3-2010-crl.verisign.com':80
'wp#d':80
'download.windowsupdate.com':80

TCP:

Запросы HTTP GET:

http://crl.verisign.com/pca3.crl
http://crl.verisign.com/pca3-g5.crl
http://csc3-2010-crl.verisign.com/CSC3-2010.crl
http://11#.#11.111.1/wpad.dat via wp#d
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com

UDP:

DNS ASK crl.verisign.com
DNS ASK csc3-2010-crl.verisign.com
DNS ASK wp#d
DNS ASK www.download.windowsupdate.com

Другое:

Создает и запускает на исполнение:

'%WINDIR%\Installer\MSID.tmp' /S
'%WINDIR%\Installer\MSIF.tmp' /S
'%CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe' -start
'%CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe'

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' -Embedding C7B605465E5CF1A81F12DE38A55127D9
'<SYSTEM32>\msiexec.exe' -Embedding 2E89C27BB7E9A7AD68CFF8D722CF99F4 M Global\MSI0000
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\cmd.exe' /c msiexec /i c:\chip\Juniper\JuniperSetupServiceInstaller.msi /qn REBOOT=ReallySuppress ALLUSERS=1 /L* c:\chip\Logs\JuniperSetupServiceInstaller.log
'<SYSTEM32>\msiexec.exe' /i c:\chip\Juniper\JuniperSetupServiceInstaller.msi /qn REBOOT=ReallySuppress ALLUSERS=1 /L* c:\chip\Logs\JuniperSetupServiceInstaller.log