Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program="<Полный путь к файлу>"
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\scripttemp.ini
- %WINDIR%\_temp04191314487809\otherofficeospp\slerror.xml
- %WINDIR%\_temp04191314487809\svctrigger.xml
- %WINDIR%\_temp04191314487809\office2010ospp\ospp.vbs
- %WINDIR%\_temp04191314487809\otherofficeospp\ospp.vbs
- %WINDIR%\_temp04191314487809\heu_configuration.ini
- %WINDIR%\_temp04191314487809\heu_set.ini
- %WINDIR%\_temp04191314487809\getproductkey.data
- %WINDIR%\_temp04191314487809\setupcomplete.data
- %WINDIR%\_temp04191314487809\x86\cleanospp.exe
- %WINDIR%\_temp04191314487809\heu_kms_renewal.xml
- %WINDIR%\_temp04191314487809\office2010ospp\slerror.xml
- %WINDIR%\_temp04191314487809\x64\cleanospp.exe
- %WINDIR%\_temp04191314487809\kms.exe
- %WINDIR%\_temp04191314487809\kms_x64.exe
- %WINDIR%\_temp04191314487809\x64\setacl.exe
- %WINDIR%\_temp04191314487809\x86\setacl.exe
- %WINDIR%\_temp04191314487809\x86\msvcr100.dll
- %WINDIR%\_temp04191314487809\x64\msvcr100.dll
- %WINDIR%\_temp04191314487809\x86\secopatcher.dll
- %WINDIR%\_temp04191314487809\x64\secopatcher.dll
- %WINDIR%\_temp04191314487809\x86\sppextcomobjhook.dll
- %WINDIR%\_temp04191314487809\kms-client.exe
- %WINDIR%\_temp04191314487809\kms-server.exe
- %WINDIR%\_temp04191314487809\pic\zanzhu.ico
- %WINDIR%\_temp04191314487809\pic\ver.ico
- %WINDIR%\_temp04191314487809\pic\amt.ico
- %WINDIR%\splashlogo.gif
- %TEMP%\aut4d67.tmp
- %WINDIR%\_temp04191314487809\kmsmini.7z
- %TEMP%\aut4f1e.tmp
- %WINDIR%\_temp04191314487809\digital.7z
- %TEMP%\aut4fcb.tmp
- %WINDIR%\_temp04191314487809\cert.7z
- %TEMP%\aut50b6.tmp
- %WINDIR%\_temp04191314487809\digitallicence.7z
- %TEMP%\aut5134.tmp
- %TEMP%\aut3318.tmp
- %WINDIR%\_temp04191314487809\7z.exe
- %WINDIR%\_temp04191314487809\pic\ewm_wx.jpg
- %WINDIR%\_temp04191314487809\pic\ewm_zfb.jpg
- %WINDIR%\_temp04191314487809\pic\head.jpg
- %WINDIR%\_temp04191314487809\pic\left.jpg
- %WINDIR%\_temp04191314487809\pic\office.jpg
- %WINDIR%\_temp04191314487809\pic\shuoming.jpg
- %WINDIR%\_temp04191314487809\pic\windows.jpg
- %WINDIR%\_temp04191314487809\pic\backup.bmp
- %WINDIR%\_temp04191314487809\pic\restore.bmp
- %WINDIR%\_temp04191314487809\pic\uninst.bmp
- %WINDIR%\heukmsrenewal\heu_kms_activator.exe
- %WINDIR%\_temp04191314487809\x64\sppextcomobjhook.dll
- %WINDIR%\_temp04191314487809\scriptdir.ini
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\_temp04191314487809\pic\ewm_wx.jpg
- %WINDIR%\_temp04191314487809\setupcomplete.data
- %WINDIR%\_temp04191314487809\x86\cleanospp.exe
- %WINDIR%\_temp04191314487809\x64\cleanospp.exe
- %WINDIR%\_temp04191314487809\kms-client.exe
- %WINDIR%\_temp04191314487809\kms-server.exe
- %WINDIR%\_temp04191314487809\heu_set.ini
- %WINDIR%\_temp04191314487809\getproductkey.data
- %WINDIR%\_temp04191314487809\kms.exe
- %WINDIR%\_temp04191314487809\x86\setacl.exe
- %WINDIR%\_temp04191314487809\x86\msvcr100.dll
- %WINDIR%\_temp04191314487809\x64\msvcr100.dll
- %WINDIR%\_temp04191314487809\x86\secopatcher.dll
- %WINDIR%\_temp04191314487809\x64\secopatcher.dll
- %WINDIR%\_temp04191314487809\kms_x64.exe
- %WINDIR%\_temp04191314487809\x64\setacl.exe
- %WINDIR%\_temp04191314487809\otherofficeospp\ospp.vbs
- %WINDIR%\_temp04191314487809\office2010ospp\ospp.vbs
- %WINDIR%\_temp04191314487809\svctrigger.xml
- %WINDIR%\_temp04191314487809\pic\head.jpg
- %WINDIR%\_temp04191314487809\pic\left.jpg
- %WINDIR%\_temp04191314487809\pic\office.jpg
- %WINDIR%\_temp04191314487809\pic\shuoming.jpg
- %WINDIR%\_temp04191314487809\pic\windows.jpg
- %WINDIR%\_temp04191314487809\pic\backup.bmp
- %WINDIR%\_temp04191314487809\pic\ewm_zfb.jpg
- %WINDIR%\_temp04191314487809\pic\restore.bmp
- %WINDIR%\_temp04191314487809\pic\amt.ico
- %WINDIR%\_temp04191314487809\pic\ver.ico
- %WINDIR%\_temp04191314487809\pic\zanzhu.ico
- %WINDIR%\_temp04191314487809\heu_kms_renewal.xml
- %WINDIR%\_temp04191314487809\office2010ospp\slerror.xml
- %WINDIR%\_temp04191314487809\otherofficeospp\slerror.xml
- %WINDIR%\_temp04191314487809\pic\uninst.bmp
- %WINDIR%\_temp04191314487809\x86\sppextcomobjhook.dll
- %WINDIR%\_temp04191314487809\x64\sppextcomobjhook.dll
Удаляет следующие файлы
- %TEMP%\aut3318.tmp
- %TEMP%\aut4d67.tmp
- %TEMP%\aut4f1e.tmp
- %TEMP%\aut4fcb.tmp
- %TEMP%\aut50b6.tmp
- %TEMP%\aut5134.tmp
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\_temp04191314487809\7z.exe' x %WINDIR%\_temp04191314487809\KMSmini.7z -y -o%WINDIR%\_temp04191314487809
- '%WINDIR%\_temp04191314487809\kms_x64.exe'
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp04191314487809 >>%windir%\ScriptTemp.ini' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...' (со скрытым окном)
- '%WINDIR%\_temp04191314487809\7z.exe' x %WINDIR%\_temp04191314487809\KMSmini.7z -y -o%WINDIR%\_temp04191314487809' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp04191314487809\ScriptDir.ini' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Текущая директория> >>%windir%\_temp04191314487809\ScriptDir.ini' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<Имя файла>.exe >>%windir%\_temp04191314487809\ScriptDir.ini' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp04191314487809 >>%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp04191314487809\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Текущая директория> >>%windir%\_temp04191314487809\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<Имя файла>.exe >>%windir%\_temp04191314487809\ScriptDir.ini
