Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\MRESP50] 'ImagePath' = '%CommonProgramFiles%\Motive\MRESP50.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MREMP50] 'ImagePath' = '%CommonProgramFiles%\Motive\MREMP50.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MRENDIS5] 'ImagePath' = '%CommonProgramFiles%\Motive\MRENDIS5.SYS'
- [<HKLM>\System\CurrentControlSet\Services\MREMPR5] 'ImagePath' = '%CommonProgramFiles%\Motive\MREMPR5.SYS'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService] 'ImagePath' = '"%CommonProgramFiles(x86)%\Motive\McciCMService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\McciCMService] 'Start' = '00000002'
Создает следующие сервисы
- 'MRESP50' C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS
- 'MREMP50' C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS
- 'MRENDIS5' C:\PROGRA~2\COMMON~1\Motive\MRENDIS5.SYS
- 'MREMPR5' C:\PROGRA~2\COMMON~1\Motive\MREMPR5.SYS
- 'McciCMService' "%CommonProgramFiles(x86)%\Motive\McciCMService.exe"
- 'McciCMService' %CommonProgramFiles(x86)%\Motive\McciCMService.exe
Вредоносные функции
Изменяет следующие настройки браузера Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsaf5d7.tmp
- %TEMP%\mcciexecute.exe
- %CommonProgramFiles(x86)%\motive\mcciuacmanagerx.dll
- %TEMP%\mcciuacmanagerx.dll
- %CommonProgramFiles(x86)%\motive\mrew32n55_550-1804-1_dsr.ini
- %TEMP%\mrew32n55_550-1804-1_dsr.ini
- %CommonProgramFiles(x86)%\motive\mrew32n55_550-1804-1_dsr.dll
- %TEMP%\mrew32n55_550-1804-1_dsr.dll
- %CommonProgramFiles(x86)%\motive\mresp50.sys
- %TEMP%\mresp50.sys
- %CommonProgramFiles(x86)%\motive\mresp31.vxd
- %CommonProgramFiles(x86)%\motive\mremp50.sys
- %TEMP%\motrcsrv.exe
- %TEMP%\mremp50.sys
- %CommonProgramFiles(x86)%\motive\mremp31.vxd
- %TEMP%\mremp31.vxd
- %CommonProgramFiles(x86)%\motive\mcciwirelessclientappx.dll
- %TEMP%\mcciwirelessclientappx.dll
- %CommonProgramFiles(x86)%\motive\mcciutilsx.dll
- %TEMP%\mcciutilsx.dll
- %CommonProgramFiles(x86)%\motive\mccithunk32lib_1-0-0_dsr.dll
- %TEMP%\mccithunk32lib_1-0-0_dsr.dll
- %TEMP%\mresp31.vxd
- %TEMP%\mccieventx.dll
- %ProgramFiles(x86)%\tcnz\motivevnc\motrcsrv.exe
- %CommonProgramFiles%\motive\mccicontextprocessor_dsr.dll
- %CommonProgramFiles%\motive\mccicontexthook_dsr.dll
- %CommonProgramFiles%\motive\mccicontextdetectorwin32_dsr.dll
- %CommonProgramFiles%\motive\mccicontextdetectoremail_dsr.dll
- %CommonProgramFiles%\motive\mcciconnecteddevicesx.dll
- %CommonProgramFiles%\motive\mccilogx.dll
- %CommonProgramFiles%\motive\mcciappshelper.exe
- %CommonProgramFiles%\motive\mcciappsx.dll
- %ProgramFiles%\tcnz\ssm.ico
- %TEMP%\ssm.ico
- %CommonProgramFiles(x86)%\motive\mccithunk16.dll
- %CommonProgramFiles(x86)%\motive\mcciexecute.exe
- %TEMP%\axb64.exe
- %WINDIR%\temp\uddbf7a.tmp
- %WINDIR%\temp\uddbf7b.tmp
- %CommonProgramFiles(x86)%\motive\npmotive.dll
- %TEMP%\npmotive.dll
- %ProgramFiles(x86)%\tcnz\mccibrowser.exe
- %TEMP%\mccibrowser.exe
- %ProgramFiles(x86)%\tcnz\motivevnc\plink.exe
- %TEMP%\plink.exe
- %ProgramFiles(x86)%\tcnz\motivevnc\vncclipboard.exe
- %TEMP%\nsn1f92.tmp
- %TEMP%\vncclipboard.exe
- %TEMP%\mccithunk16.dll
- %CommonProgramFiles(x86)%\motive\mccisysx.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mcciappsx.dll
- %TEMP%\mcciconnecteddevicesx.dll
- %CommonProgramFiles(x86)%\motive\ipworksssl8.dll
- %TEMP%\ipworksssl8.dll
- %CommonProgramFiles(x86)%\motive\ipworks8.dll
- %TEMP%\ipworks8.dll
- %CommonProgramFiles(x86)%\motive\mccilogx.dll
- %TEMP%\mccilogx.dll
- %CommonProgramFiles(x86)%\motive\mcciappshelper.exe
- %TEMP%\mcciappshelper.exe
- %CommonProgramFiles%\motive\mccicontextx.dll
- %TEMP%\mccicontextdetectoremail_dsr.dll
- %CommonProgramFiles(x86)%\motive\mccicmservice.exe
- %CommonProgramFiles(x86)%\motive\installhelper.exe
- %TEMP%\nss6e0.tmp\nsisplugin.dll
- %TEMP%\nsc6cf.tmp
- %TEMP%\axb.exe
- %CommonProgramFiles%\motive\mccicmservice.exe
- %TEMP%\mccicmservice.exe
- %CommonProgramFiles%\motive\installhelper.exe
- %TEMP%\installhelper.exe
- %TEMP%\nsgf6e2.tmp\nsisplugin.dll
- %CommonProgramFiles(x86)%\motive\mcciappsx.dll
- %TEMP%\nsy1fd2.tmp\nsisplugin.dll
- %CommonProgramFiles(x86)%\motive\mccicontextdetectoremail_dsr.dll
- %TEMP%\mccicontexthook_dsr.dll
- %TEMP%\mccicontextdetectorwin32_dsr.dll
- %CommonProgramFiles(x86)%\motive\mccisysnetx.dll
- %TEMP%\mccisysnetx.dll
- %CommonProgramFiles(x86)%\motive\mccisysdialx.dll
- %TEMP%\mccisysdialx.dll
- %CommonProgramFiles(x86)%\motive\mccismx.dll
- %TEMP%\mccismx.dll
- %CommonProgramFiles(x86)%\motive\mccinetx.dll
- %TEMP%\mccinetx.dll
- %CommonProgramFiles(x86)%\motive\mccihttpx.dll
- %CommonProgramFiles(x86)%\motive\mccicontextdetectorwin32_dsr.dll
- %TEMP%\mccihttpx.dll
- %CommonProgramFiles(x86)%\motive\mcciconnecteddevicesx.dll
- %CommonProgramFiles(x86)%\motive\mccicontrolhost.exe
- %TEMP%\mccicontrolhost.exe
- %CommonProgramFiles(x86)%\motive\mccicontexthookshim.exe
- %TEMP%\mccicontexthookshim.exe
- %CommonProgramFiles(x86)%\motive\mccicontextx.dll
- %TEMP%\mccicontextx.dll
- %CommonProgramFiles(x86)%\motive\mccicontextprocessor_dsr.dll
- %TEMP%\mccicontextprocessor_dsr.dll
- %CommonProgramFiles(x86)%\motive\mccicontexthook_dsr.dll
- %CommonProgramFiles(x86)%\motive\mccieventx.dll
- %CommonProgramFiles%\motive\mccicontrolhost.exe
Удаляет следующие файлы
- %TEMP%\installhelper.exe
- %TEMP%\mcciwirelessclientappx.dll
- %TEMP%\mremp31.vxd
- %TEMP%\mremp50.sys
- %TEMP%\mresp31.vxd
- %TEMP%\mresp50.sys
- %TEMP%\mrew32n55_550-1804-1_dsr.dll
- %TEMP%\mrew32n55_550-1804-1_dsr.ini
- %TEMP%\mccithunk32lib_1-0-0_dsr.dll
- %TEMP%\mcciutilsx.dll
- %TEMP%\mcciuacmanagerx.dll
- %TEMP%\vncclipboard.exe
- %TEMP%\plink.exe
- %TEMP%\mccibrowser.exe
- %WINDIR%\temp\uddbf7b.tmp
- %WINDIR%\temp\uddbf7a.tmp
- %TEMP%\npmotive.dll
- %TEMP%\nss6e0.tmp\nsisplugin.dll
- %TEMP%\mcciexecute.exe
- %TEMP%\motrcsrv.exe
- %TEMP%\mccithunk16.dll
- %TEMP%\mccisysx.dll
- %TEMP%\mccisysnetx.dll
- %TEMP%\mcciappsx.dll
- %TEMP%\mcciappshelper.exe
- %TEMP%\mccilogx.dll
- %TEMP%\ipworks8.dll
- %TEMP%\ipworksssl8.dll
- %TEMP%\mcciconnecteddevicesx.dll
- %TEMP%\mccicontextdetectoremail_dsr.dll
- %TEMP%\mccicontextdetectorwin32_dsr.dll
- %TEMP%\mccicmservice.exe
- %TEMP%\mccicontexthook_dsr.dll
- %TEMP%\mccicontextx.dll
- %TEMP%\mccicontexthookshim.exe
- %TEMP%\mccicontrolhost.exe
- %TEMP%\mccieventx.dll
- %TEMP%\mccihttpx.dll
- %TEMP%\mccinetx.dll
- %TEMP%\mccismx.dll
- %TEMP%\mccisysdialx.dll
- %TEMP%\mccicontextprocessor_dsr.dll
- %TEMP%\axb.exe
- %TEMP%\ssm.ico
Подменяет следующие файлы
- %TEMP%\installhelper.exe
- %TEMP%\mccicmservice.exe
- %TEMP%\mcciappsx.dll
- %TEMP%\mcciappshelper.exe
- %TEMP%\mccilogx.dll
- %TEMP%\mcciconnecteddevicesx.dll
- %TEMP%\mccicontextdetectoremail_dsr.dll
- %TEMP%\mccicontextdetectorwin32_dsr.dll
- %TEMP%\mccicontexthook_dsr.dll
- %TEMP%\mccicontextprocessor_dsr.dll
- %TEMP%\mccicontextx.dll
- %TEMP%\mccicontrolhost.exe
Другое
Создает и запускает на исполнение
- '%TEMP%\axb.exe' /S
- '%CommonProgramFiles(x86)%\motive\mccicontrolhost.exe' /RegServer
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /predefinedallaccess /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /addlegacy= /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /registercmservice /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\mccicmservice.exe' /Service
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /startcmservice /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\mccicmservice.exe'
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /addlegacy="%ProgramFiles(x86)%\tcnz" /Platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /allaccessdir="%ProgramFiles(x86)%\tcnz" /Platform=WIN32
- '%TEMP%\axb64.exe' /S /embeddedinstaller=true
- '%CommonProgramFiles%\motive\installhelper.exe' /isadmin /Platform=X64
- '%CommonProgramFiles%\motive\mccicontrolhost.exe' /RegServer
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciAppsX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSMX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciNetX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciNetX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciHTTPX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciEventX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciContextX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciContextX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciConnectedDevicesX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciConnectedDevicesX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysDialX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciAppsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\npMotive.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciUACManagerX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciWirelessClientAppX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSysX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSysNetX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSysDialX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciNetX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciContextX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciConnectedDevicesX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\McciLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciAppsX.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%CommonProgramFiles%\Motive\McciSysDialX.dll"
