Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver.exe 32\IDriver.exe -Embedding
Запускает на исполнение:
- <SYSTEM32>\msiexec.exe -Embedding 851F6F515149C7B61253A481179FAD2E
- <SYSTEM32>\msiexec.exe -Embedding AFA0F378D0C18CDF23AA47BC1C342458 M Global\MSI0000
- <SYSTEM32>\msiexec.exe /V
- <SYSTEM32>\msiexec.exe -Embedding 328486DCA1A7C4CE995C5624A5D7545E C
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIC.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\23ec8.msi
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI10.tmp
- C:\Config.Msi\23eca.rbs
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSIF.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI13.tmp
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAU.sys
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\USB Susteen Remover.exe
- %WINDIR%\Installer\MSI15.tmp
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAP.inf
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAP.sys
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAU.inf
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1A.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\{F4831EF4-0B03-436A-9230-C01C182D9284}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI17.tmp
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSSMA10.sys
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\sus2pl.sys
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUS9PL.sys
- %WINDIR%\Installer\MSI14.tmp
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\USB Universal Remover.exe
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\UC_XP_2K.INF
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\USB Universal II Remover.exe
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAM.inf
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSTUCAM.sys
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSSPL.INF
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSSPL.VXD
- %PROGRAM_FILES%\Susteen\USB Drivers\Universal\SUSWPL.INF
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\ISRT.dll
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\_ISRES1033.dll
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver.exe
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\23ec7.rbs
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\objpscnv.dll
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriver2.exe
- %WINDIR%\Downloaded Installations\{01189076-DD7B-4B67-98D2-89CD1AFD1747}\USB Universal Driver.msi
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\iGdiCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IUserCnv.dll
- %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IScrCnv.dll
- %TEMP%\~2.tmp
- %TEMP%\_is1\USB Universal Driver.msi
- %TEMP%\_is1\ISScript1150.Msi
- %TEMP%\_is1\Setup.INI
- %TEMP%\_is1\_ISMSIDEL.INI
- %TEMP%\_is1\0x0409.ini
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
- %WINDIR%\Installer\23ec4.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
- %WINDIR%\Downloaded Installations\{01189076-DD7B-4B67-98D2-89CD1AFD1747}\0x0409.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\_ISRES.DLL
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\_ISUSER.DLL
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\String1033.txt
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\setup.inx
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\ISRT.DLL
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\IsConfig.INI
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\dp_logo.bmp
- %TEMP%\MSI8.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\MSI6.tmp
- %TEMP%\MSI7.tmp
- %TEMP%\{F4831EF4-0B03-436A-9230-C01C182D9284}\PreInstallDriver.dll
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\23ec8.msi
- %WINDIR%\Installer\23ec9.ipi
- %WINDIR%\Installer\MSI1B.tmp
- C:\Config.Msi\23eca.rbs
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1A.tmp
- %WINDIR%\Installer\23ec6.ipi
- %TEMP%\MSI6.tmp
- %TEMP%\MSI7.tmp
- %WINDIR%\Installer\23ec4.msi
- %TEMP%\~2.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\23ec7.rbs
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIC.tmp
- %TEMP%\MSI8.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIB.tmp
Сетевая активность:
Подключается к:
- 'cr#.#hawte.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteCodeSigningCA.crl
- cr#.#hawte.com/ThawtePremiumServerCA.crl
- wp#d/wpad.dat
UDP:
- DNS ASK cr#.#hawte.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
