Техническая информация
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "<Текущая директория>\32-bit\vlmcsd.exe" "vlmcsd"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is64.txt
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\msiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\osprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\smiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\transmogprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\unattendprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\wimprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismcore.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\folderprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\logprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\msiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\osprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\smiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\transmogprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\unattendprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\intlprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\logprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\folderprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dmiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dismprov.dll.mui
- %TEMP%\is64.fil
- %TEMP%\ytmp\tmp53667.bat
- %TEMP%\ytmp\tmp32647.exe
- nul
- %WINDIR%\logs\dism\dism.log
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\cbsprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\wimprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\intlprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\compatprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismhost.exe
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismprov.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dmiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\cbsprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\compatprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dismcore.dll.mui
- %TEMP%\is64.bat
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismcoreps.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\wdscore.dll
Удаляет следующие файлы
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\cbsprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\unattendprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\transmogprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\smiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\osprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\msiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\logprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\intlprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\folderprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\wimprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\unattendprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\transmogprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\smiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\osprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\wdscore.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\msiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\intlprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\folderprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dmiprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dismprov.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\dismcore.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\compatprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\cbsprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dmiprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismprov.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismhost.exe
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismcoreps.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismcore.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\compatprovider.dll
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\en-us\logprovider.dll.mui
- %TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\wimprovider.dll
Другое
Создает и запускает на исполнение
- '%TEMP%\9dc90990-f439-4354-94e6-283cfcf5e8d0\dismhost.exe' {0547FD9F-F92E-49BA-841F-BF5F1F9BBF4D}
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\cmd.exe /C %TEMP%\ytmp\tmp53667.bat "<Полный путь к файлу>"
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_Processor get AddressWidth /value
- '<SYSTEM32>\wbem\wmic.exe' path Win32_Processor get AddressWidth /value
- '<SYSTEM32>\cmd.exe' /c dism /Online /Get-CurrentEdition /English | findstr /i "Current Edition :"
- '<SYSTEM32>\dism.exe' /Online /Get-CurrentEdition /English
- '<SYSTEM32>\findstr.exe' /i "Current Edition :"
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_OperatingSystem get BuildNumber /value
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version
- '<SYSTEM32>\fltmc.exe'
- '<SYSTEM32>\cmd.exe' /C %TEMP%\ytmp\tmp53667.bat "<Полный путь к файлу>"
- '<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp32647.exe" del "%TEMP%\ytmp\tmp32647.exe"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp53667.bat" del "%TEMP%\ytmp\tmp53667.bat"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\is64.bat
- '%WINDIR%\syswow64\cmd.exe' /c echo:0>%TEMP%\is64.txt
- '%WINDIR%\syswow64\attrib.exe' +h %TEMP%\ytmp
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h %TEMP%\ytmp
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"
- '<SYSTEM32>\wbem\wmic.exe' path Win32_OperatingSystem get BuildNumber /value
- '<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<Текущая директория>\32-bit\vlmcsd.exe"
