Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\MRESP50a64] 'ImagePath' = '%CommonProgramFiles%\Motive\MRESP50a64.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MREMP50a64] 'ImagePath' = '%CommonProgramFiles%\Motive\MREMP50a64.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MRENDIS5] 'ImagePath' = '%CommonProgramFiles%\Motive\MRENDIS5.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MREMPR5] 'ImagePath' = '%CommonProgramFiles%\Motive\MREMPR5.SYS'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService64] 'ImagePath' = '"%CommonProgramFiles%\Motive\McciCMService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService64] 'Start' = '00000002'
Вредоносные функции
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsgbc81.tmp
- %TEMP%\mccihttpx.dll
- %CommonProgramFiles%\motive\mccihttpx.dll
- %TEMP%\mccinetx.dll
- %CommonProgramFiles%\motive\mccinetx.dll
- %TEMP%\mccismx.dll
- %CommonProgramFiles%\motive\mccismx.dll
- %TEMP%\mccisysdialx.dll
- %CommonProgramFiles%\motive\mccisysdialx.dll
- %TEMP%\mccisysnetx.dll
- %CommonProgramFiles%\motive\mccisysnetx.dll
- %CommonProgramFiles%\motive\mccilogx.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mcciutilsx.dll
- %CommonProgramFiles%\motive\mcciutilsx.dll
- %TEMP%\mcciwirelessclientappx.dll
- %CommonProgramFiles%\motive\mcciwirelessclientappx.dll
- %TEMP%\mrew64n55_550-1804-1_dsr.dll
- %CommonProgramFiles%\motive\mrew64n55_550-1804-1_dsr.dll
- %TEMP%\mrew64n55_550-1804-1_dsr.ini
- %CommonProgramFiles%\motive\mrew64n55_550-1804-1_dsr.ini
- %TEMP%\mcciuacmanagerx.dll
- %CommonProgramFiles%\motive\mcciuacmanagerx.dll
- %TEMP%\mccieventx.dll
- %CommonProgramFiles%\motive\mccieventx.dll
- %CommonProgramFiles%\motive\mccicontrolhost.exe
- %TEMP%\mccicontrolhost.exe
- %CommonProgramFiles%\motive\mccicontextx.dll
- %TEMP%\installhelper.exe
- %CommonProgramFiles%\motive\installhelper.exe
- %TEMP%\mccicmservice.exe
- %CommonProgramFiles%\motive\mccicmservice.exe
- %TEMP%\ssm.ico
- %ProgramFiles%\tcnz\ssm.ico
- %TEMP%\mcciappsx.dll
- %CommonProgramFiles%\motive\mcciappsx.dll
- %TEMP%\mcciappshelper.exe
- %CommonProgramFiles%\motive\mcciappshelper.exe
- %TEMP%\mcciexecute.exe
- %CommonProgramFiles%\motive\mccisysx.dll
- %TEMP%\mccilogx.dll
- %CommonProgramFiles%\motive\mcciconnecteddevicesx.dll
- %TEMP%\mccicontextdetectoremail_dsr.dll
- %CommonProgramFiles%\motive\mccicontextdetectoremail_dsr.dll
- %TEMP%\mccicontextdetectorwin32_dsr.dll
- %CommonProgramFiles%\motive\mccicontextdetectorwin32_dsr.dll
- %TEMP%\mccicontexthook_dsr.dll
- %CommonProgramFiles%\motive\mccicontexthook_dsr.dll
- %TEMP%\mccicontextprocessor_dsr.dll
- %CommonProgramFiles%\motive\mccicontextprocessor_dsr.dll
- %TEMP%\mccicontextx.dll
- %TEMP%\nsxbf51.tmp\nsisplugin.dll
- %TEMP%\mcciconnecteddevicesx.dll
- %CommonProgramFiles%\motive\mcciexecute.exe
Удаляет следующие файлы
- %TEMP%\installhelper.exe
- %TEMP%\mrew64n55_550-1804-1_dsr.ini
- %TEMP%\mrew64n55_550-1804-1_dsr.dll
- %TEMP%\mcciwirelessclientappx.dll
- %TEMP%\mcciutilsx.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mccisysnetx.dll
- %TEMP%\mccisysdialx.dll
- %TEMP%\mccismx.dll
- %TEMP%\mccinetx.dll
- %TEMP%\mccihttpx.dll
- %TEMP%\mccieventx.dll
- %TEMP%\mccicontrolhost.exe
- %TEMP%\mccicontextx.dll
- %TEMP%\mccicontextprocessor_dsr.dll
- %TEMP%\mccicontexthook_dsr.dll
- %TEMP%\mccicontextdetectorwin32_dsr.dll
- %TEMP%\mccicontextdetectoremail_dsr.dll
- %TEMP%\mcciconnecteddevicesx.dll
- %TEMP%\mccilogx.dll
- %TEMP%\mcciappshelper.exe
- %TEMP%\mcciappsx.dll
- %TEMP%\ssm.ico
- %TEMP%\mccicmservice.exe
- %TEMP%\mcciuacmanagerx.dll
- %TEMP%\mcciexecute.exe
Подменяет следующие файлы
- %TEMP%\mccisysnetx.dll
Другое
Создает и запускает на исполнение
- '%CommonProgramFiles%\motive\mccicontrolhost.exe' /RegServer
- '%CommonProgramFiles%\motive\installhelper.exe' /predefinedallaccess /Platform=X64
- '%CommonProgramFiles%\motive\installhelper.exe' /addlegacy= /Platform=X64
- '%CommonProgramFiles%\motive\installhelper.exe' /registercmservice /Platform=X64
- '%CommonProgramFiles%\motive\mccicmservice.exe' /Service
- '%CommonProgramFiles%\motive\installhelper.exe' /startcmservice /Platform=X64
- '%CommonProgramFiles%\motive\mccicmservice.exe'
- '%CommonProgramFiles%\motive\installhelper.exe' /addlegacy="%ProgramFiles%\tcnz" /Platform=X64
- '%CommonProgramFiles%\motive\installhelper.exe' /allaccessdir="%ProgramFiles%\tcnz" /Platform=X64
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciAppsX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciWirelessClientAppX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciWirelessClientAppX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUtilsX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysNetX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysNetX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysDialX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysDialX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciNetX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciNetX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciContextX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciContextX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciConnectedDevicesX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciConnectedDevicesX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciAppsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUACManagerX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciUACManagerX.dll"
