Trojan.StartPage.45185

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%APPDATA%\lrepair.exe'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\Open" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CURRENT_USER\SessionInformation" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\D" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\ShellFolder" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\DefaultIcon" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\Open\Command" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\D\Command" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE966A4A-CA47-4BEB-B4F2-A1181237D512}\ProxyStubClsid32" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE966A4A-CA47-4BEB-B4F2-A1181237D512}\TypeLib" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE966A4A-CA47-4BEB-B4F2-A1181237D512}\ProxyStubClsid" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE966A4A-CA47-4BEB-B4F2-A1181237D512}" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{86AEFBE8-763F-0647-899C-A93278894D8E}" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HK4D8E}" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D30380A7-B720-4DCF-ACE4-2B99B3CB4D34}\1.0" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"
<SYSTEM32>\Sbilel.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" -ot reg -actn ace -ace "n:Everyone;m:deny;p:set_val,create_subkey,create_link,write_dacl,write_owner,delete;i:so"

Запускает на исполнение:

<SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %WINDIR%\temp\Refreshicon.inf
<SYSTEM32>\attrib.exe -s -h -r "%HOMEPATH%\桌面\Internet Explorer.lnk"
<SYSTEM32>\grpconv.exe -o
<SYSTEM32>\runonce.exe -r
<SYSTEM32>\attrib.exe -s -h -r "%ALLUSERSPROFILE%\桌面\Internet Explorer.lnk"
<SYSTEM32>\cacls.exe "%APPDATA%\lrepair.exe" /p everyone:r
<SYSTEM32>\attrib.exe +h +s +r "%APPDATA%\lrepair.exe"
<SYSTEM32>\cacls.exe "%HOMEPATH%\桌面\Internet Explorer.lnk" /p everyone:f
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\桌面\Internet Explorer.lnk" /p everyone:f

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы: