Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Вредоносные функции
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{051D2801-6EDE-4B2A-B4A0-5331B46F7B9C}User\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInform...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000002'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\aut2afa.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\wimprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\unattendprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\transmogprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\smiprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\osprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\msiprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\logprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\intlprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\wdscore.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\folderprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\unattendprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\transmogprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\smiprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\osprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\msiprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\logprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\intlprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\folderprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\wimprovider.dll.mui
- C:\policy\manifest.xml
- C:\policy\{562ee~1\backup.xml
- C:\policy\{562ee~1\bkupinfo.xml
- %WINDIR%\security\database\tmp.edb
- %WINDIR%\security\database\edb.log
- %WINDIR%\security\database\edbres00002.jrs
- %WINDIR%\security\database\edbres00001.jrs
- %WINDIR%\security\database\edbtmp.log
- %TEMP%\gptcf0b.tmp
- <SYSTEM32>\grouppolicy\machine\microsoft\windows nt\audit\audit.csv
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- C:\policy\{562ee~1\domain~1\gpo\user\prefer~1\registry\registry.xml
- C:\policy\{562ee~1\domain~1\gpo\user\registry.pol
- C:\policy\{562ee~1\domain~1\gpo\user\comment.cmtx
- C:\policy\{562ee~1\domain~1\gpo\machine\prefer~1\registry\registry.xml
- C:\policy\{562ee~1\domain~1\gpo\machine\micros~1\window~1\secedit\gpttmpl.inf
- C:\policy\{562ee~1\domain~1\gpo\machine\micros~1\window~1\audit\audit.csv
- C:\policy\{562ee~1\domain~1\gpo\machine\registry.pol
- C:\policy\{562ee~1\domain~1\gpo\machine\comment.cmtx
- C:\policy\{562ee~1\domain~1\gpo\groupp~1\gpe.ini
- C:\policy\{562ee~1\domain~1\gpo\gpo.cmt
- C:\policy\{562ee~1\gpreport.xml
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dmiprovider.dll.mui
- %WINDIR%\security\database\edb.chk
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dismprov.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\compatprovider.dll.mui
- %TEMP%\aut3302.tmp
- %TEMP%\policy.zip
- %TEMP%\aut3235.tmp
- %TEMP%\lgpo.exe
- %TEMP%\aut315a.tmp
- %TEMP%\disablesmb1_enablesmb2.ps1
- %TEMP%\aut305f.tmp
- %TEMP%\interactive_bitlocker_custom_inventory_v1.3.ps1
- %TEMP%\removeapps.ps1
- %TEMP%\aut2f83.tmp
- %TEMP%\aut2e98.tmp
- %TEMP%\emsites.xml
- %TEMP%\aut2dbc.tmp
- %TEMP%\deployment.properties
- %TEMP%\aut2cff.tmp
- %TEMP%\defaultapps.xml
- %TEMP%\aut2c24.tmp
- %TEMP%\ameriprise outlook add-in.msi
- %TEMP%\inport.cmd
- %TEMP%\aut33ce.tmp
- %TEMP%\setup.exe
- %TEMP%\aut3584.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\cbsprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dmiprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismprov.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismhost.exe
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismcoreps.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismcore.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\compatprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\cbsprovider.dll
- %WINDIR%\logs\dism\dism.log
- %PROGRAMDATA%\defaultappsfield\defaultapps.xml
- %TEMP%\visualbasicpowerpackssetup.exe
- %TEMP%\aut4b04.tmp
- %TEMP%\unzip.ps1
- %TEMP%\aut4854.tmp
- %TEMP%\smartofficedesktopintegrations.msi
- %TEMP%\aut376b.tmp
- %TEMP%\smartbinderolplugin.dll
- %TEMP%\aut36ae.tmp
- %TEMP%\smartanalyzer8.msi
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dismcore.dll.mui
- %TEMP%\gptcf0a.tmp
Присваивает атрибут 'скрытый' для следующих файлов
- C:\policy\manifest.xml
- C:\policy\{562ee~1\bkupinfo.xml
Удаляет следующие файлы
- %TEMP%\aut2afa.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\folderprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\intlprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\logprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\msiprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\osprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\smiprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\transmogprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\unattendprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\wimprovider.dll.mui
- %TEMP%\aut36ae.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\folderprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\logprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\msiprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\osprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\smiprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\transmogprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\unattendprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\wdscore.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\wimprovider.dll
- %TEMP%\gptcf0a.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dismprov.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dmiprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\dismcore.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\compatprovider.dll.mui
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\en-us\cbsprovider.dll.mui
- %TEMP%\aut2cff.tmp
- %TEMP%\aut2dbc.tmp
- %TEMP%\aut2e98.tmp
- %TEMP%\aut2f83.tmp
- %TEMP%\aut305f.tmp
- %TEMP%\aut315a.tmp
- %TEMP%\aut3235.tmp
- %TEMP%\aut3302.tmp
- %TEMP%\aut33ce.tmp
- %TEMP%\gptcf0b.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\intlprovider.dll
- %TEMP%\aut3584.tmp
- %TEMP%\aut4854.tmp
- %TEMP%\aut4b04.tmp
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\cbsprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\compatprovider.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismcore.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismcoreps.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismhost.exe
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismprov.dll
- %TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dmiprovider.dll
- %TEMP%\aut2c24.tmp
- %TEMP%\aut376b.tmp
- C:\policy.zip
Перемещает следующие файлы
- %TEMP%\policy.zip в C:\policy.zip
- %WINDIR%\security\database\edbtmp.log в %WINDIR%\security\database\edb.log
Подменяет следующие файлы
- %HOMEPATH%\ntuser.pol
- %PROGRAMDATA%\ntuser.pol
- %WINDIR%\security\database\edbtmp.log
- %HOMEPATH%\tempntuser.pol
- %PROGRAMDATA%\tempntuser.pol
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File %TEMP%\RemoveApps.ps1
- '%TEMP%\e9206d37-bc6d-48c7-8536-46d2f51eaee2\dismhost.exe' {D34140C1-CA76-4446-B232-407A37297D46}
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -File "%TEMP%\Unzip.ps1"
- '%TEMP%\lgpo.exe' /e zone /g c:\policy /v
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File %TEMP%\RemoveApps.ps1' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c %TEMP%\inport.cmd' (со скрытым окном)
- '<SYSTEM32>\auditpol.exe' /clear /y' (со скрытым окном)
- '<SYSTEM32>\auditpol.exe' /restore /file:"c:\policy\{562EE1FD-C51A-4838-B21E-FB596302588B}\DomainSysvol\GPO\Machine\microsoft\windows nt\Audit\audit.csv"' (со скрытым окном)
- '<SYSTEM32>\secedit.exe' /configure /db "%TEMP%\GPTCF0A.tmp" /cfg "c:\policy\{562EE1FD-C51A-4838-B21E-FB596302588B}\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf" /log "%TEMP%\GPTCF0B.tmp" /overwrit...' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c %TEMP%\inport.cmd
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noprofile -command "Set-ExecutionPolicy RemoteSigned"
- '<SYSTEM32>\xcopy.exe' "%TEMP%\DefaultApps.xml" "%PROGRAMDATA%\DefaultAppsField\" /y /i
- '<SYSTEM32>\dism.exe' /online /Import-DefaultAppAssociations:%PROGRAMDATA%\DefaultAppsField\Defaultapps.xml
- '<SYSTEM32>\cmd.exe' /c powershell.exe -File "%TEMP%\Unzip.ps1"
- '<SYSTEM32>\auditpol.exe' /clear /y
- '<SYSTEM32>\auditpol.exe' /restore /file:"c:\policy\{562EE1FD-C51A-4838-B21E-FB596302588B}\DomainSysvol\GPO\Machine\microsoft\windows nt\Audit\audit.csv"
- '<SYSTEM32>\secedit.exe' /configure /db "%TEMP%\GPTCF0A.tmp" /cfg "c:\policy\{562EE1FD-C51A-4838-B21E-FB596302588B}\DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf" /log "%TEMP%\GPTCF0B.tmp" /overwrit...
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\raserver.exe' /offerraupdate
