Trojan.KillProc.18658

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

Запускает на исполнение:

<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v item /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v inimapping /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v key /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v <Имя диска съемного носителя>:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v C:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v hkey /f
<SYSTEM32>\attrib.exe -s -h H:\rvhost*
<SYSTEM32>\attrib.exe -s -h G:\rvhost*
<SYSTEM32>\attrib.exe -s -h I:\rvhost*
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo Messengger /v command /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "Yahoo Messengger" /f
<SYSTEM32>\attrib.exe -s -h %WINDIR%\ravmon*
<SYSTEM32>\taskkill.exe /f /im ravmon*
<SYSTEM32>\attrib.exe -s -h %WINDIR%\Prefetch\ravmon*
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\ravmon*
<SYSTEM32>\attrib.exe -s -h C:\ravmon*
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v J:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v F:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v E:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v G:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v I:\rvhost.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v H:\rvhost.exe /f
<SYSTEM32>\attrib.exe -s -h H:\TOPUI*
<SYSTEM32>\attrib.exe -s -h G:\TOPUI*
<SYSTEM32>\attrib.exe -s -h C:\HistoryJMTi*
<SYSTEM32>\attrib.exe -s -h E:\HistoryJMTi*
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\HistoryJMTi*
<SYSTEM32>\attrib.exe -s -h F:\TOPUI*
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\autorun.inf
<SYSTEM32>\attrib.exe -s -h %WINDIR%\Prefetch\msagent.exe
<SYSTEM32>\attrib.exe -s -h C:\TOPUI*
<SYSTEM32>\attrib.exe -s -h E:\TOPUI*
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\TOPUI*
<SYSTEM32>\attrib.exe -s -h %WINDIR%\rvhost.exe
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\RVHOST.exe
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\rvhost*
<SYSTEM32>\attrib.exe -s -h F:\rvhost*
<SYSTEM32>\attrib.exe -s -h E:\rvhost*
<SYSTEM32>\attrib.exe -s -h C:\rvhost*
<SYSTEM32>\attrib.exe -s -h G:\HistoryJMTi*
<SYSTEM32>\attrib.exe -s -h F:\HistoryJMTi*
<SYSTEM32>\attrib.exe -s -h H:\HistoryJMTi*
<SYSTEM32>\taskkill.exe /f /im rvhost.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msagent /f
<SYSTEM32>\attrib.exe -s -h E:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h F:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h H:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h G:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\My_Heart.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MS32DLL /f
<SYSTEM32>\attrib.exe -s -h K:\autorun.inf
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v winboot /f
<SYSTEM32>\taskkill.exe /f /im My_Heart.exe
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Window Title" /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MS32DL /f
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d <SYSTEM32>\userinit.exe, /f
<SYSTEM32>\taskkill.exe /im explorer.exe /f
<SYSTEM32>\notepad.exe C:\0k.txt
%WINDIR%\explorer.exe
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\killvbs.vbs
<SYSTEM32>\attrib.exe -s -h J:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h I:\My_Heart.exe
<SYSTEM32>\attrib.exe -s -h K:\My_Heart.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v My_HeartMy_Heart /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v My_Heart /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache /v %WINDIR%\ravmone.exe /f
<SYSTEM32>\attrib.exe -s -h K:\ravmon*
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RavAV /f
<SYSTEM32>\attrib.exe -s -h C:\.MS32DLL.dll.vbs
<SYSTEM32>\taskkill.exe /f /im wscript.exe
<SYSTEM32>\attrib.exe -s -h J:\ravmon*
<SYSTEM32>\attrib.exe -s -h F:\ravmon*
<SYSTEM32>\attrib.exe -s -h E:\ravmon*
<SYSTEM32>\attrib.exe -s -h G:\ravmon*
<SYSTEM32>\attrib.exe -s -h I:\ravmon*
<SYSTEM32>\attrib.exe -s -h H:\ravmon*
<SYSTEM32>\attrib.exe -s -h I:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h H:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h J:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h C:\autorun.inf
<SYSTEM32>\attrib.exe -s -h K:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h G:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h %WINDIR%\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h %WINDIR%\boot.ini
<SYSTEM32>\attrib.exe -s -h <Имя диска съемного носителя>:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h F:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h E:\.MS32DLL.dll.vbs
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\HistoryJMTi.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMyMusic /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyPictures /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuNetworkPlaces /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuNetworkPlaces /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyDocs /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyPicturess /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMMyDocs /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMyMusic /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogoff /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogoff /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule /v AtTaskMaxHours /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayItemsDisplay /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayItemsDisplay /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v SuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d Explorer.exe /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /f
<SYSTEM32>\reg.exe delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v Disabletaskmgr /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {20D04FE0-3AEA-1069-A2D8-08002B30309D} /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {20D04FE0-3AEA-1069-A2D8-08002B30309D} /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideClock /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /f
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /f
<SYSTEM32>\attrib.exe -S -H E:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H <Имя диска съемного носителя>:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H F:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H H:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H G:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H J:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H E:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H <Имя диска съемного носителя>:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H G:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H I:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H H:\AUTORUN.INF
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\TOPUI.exe
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\TOPUI.exe
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\TOPUI.exe
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\HistoryJMTi.exe
<SYSTEM32>\attrib.exe -s -h %WINDIR%\security\Database\regedit.exe
<SYSTEM32>\taskkill.exe /f /im mm32.dll
<SYSTEM32>\attrib.exe -S -H J:\tokwan.exe
<SYSTEM32>\attrib.exe -S -H I:\tokwan.exe
<SYSTEM32>\taskkill.exe /f /im HistoryJMTi.exe
<SYSTEM32>\taskkill.exe /f /im Proposal_FYP.exe
<SYSTEM32>\taskkill.exe /f /im TOPUI.exe
<SYSTEM32>\taskkill.exe /f /im haha.exe
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\jub0.exe
<SYSTEM32>\taskkill.exe /f /im msagent.exe
<SYSTEM32>\taskkill.exe /f /im meow.exe
<SYSTEM32>\taskkill.exe /f /im regedit.exe
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\ssms.exe
<SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Tok-Cirrhatus /f
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Bron-Spizaetus /f
<SYSTEM32>\taskkill.exe /f /im ssms.exe
<SYSTEM32>\taskkill.exe /f /im Dato-K.exe
<SYSTEM32>\taskkill.exe /f /im jub0.exe
<SYSTEM32>\taskkill.exe /f /im svch0st.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ccctp /f
<SYSTEM32>\taskkill.exe /f /im tokwan*
<SYSTEM32>\attrib.exe -S -H F:\AUTORUN.INF
<SYSTEM32>\attrib.exe -S -H <SYSTEM32>\svch0st.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v regedit /f
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\haha.exe
<SYSTEM32>\attrib.exe -s -h %WINDIR%\help\Tours\autorun.inf
<SYSTEM32>\attrib.exe -s -h <SYSTEM32>\haha.exe
<SYSTEM32>\reg.exe delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v haha /f
<SYSTEM32>\attrib.exe -s -h %WINDIR%\security\Database\msagent.exe

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\Explorer.EXE

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000000'

Изменения в файловой системе:

Создает следующие файлы:

C:\0k.txt
%TEMP%\bt3277.bat

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\bt3277.bat

Удаляет следующие файлы:

%TEMP%\bt3277.bat

Другое:

Ищет следующие окна:

ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: 'CSCHiddenWindow' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'BaseBar' WindowName: 'ChanApp'
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней