Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\DownloadInformation] 'CODEBASE' = 'https://juniper.net/dana-cached/sc/JuniperSetupClient.cab'
- [<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}\DownloadInformation] 'CODEBASE' = 'https://juniper.net/dana-cached/setup/JuniperSetupSP1.cab'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\JuniperAccessService] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- %CommonProgramFiles%\Juniper Networks\JUNS\JuniperSetupClientOCX.exe /S
- %CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe -regserver
- %CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe
- %TEMP%\JuniperSetupServiceInstallerAdmin.exe
- %PROGRAM_FILES%\Juniper Networks\Installer Service\AccessServiceComponent.exe /S
- %CommonProgramFiles%\Juniper Networks\JUNS\JuniperSetupOCX.exe /S
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'LowIcon' = 'inetcpl.cpl#005424'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'PMDisplayName' = 'Trusted sites [Protected Mode]'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A02' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A03' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A06' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1E05' = '00030000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00030000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180B' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1408' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180C' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180D' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1207' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust not to damage your computer or data.'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000043'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1806' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1807' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1808' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1605' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1800' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Downloaded Program Files\string_zh.properties
- %WINDIR%\Downloaded Program Files\string_ko.properties
- %WINDIR%\Downloaded Program Files\string_ja.properties
- %WINDIR%\Downloaded Program Files\JuniperSetupClient.inf
- %CommonProgramFiles%\Juniper Networks\JUNS\JuniperSetupClientOCX.exe
- %WINDIR%\Downloaded Program Files\string_zh_cn.properties
- %WINDIR%\Downloaded Program Files\string_de.properties
- %WINDIR%\Downloaded Program Files\JuniperSetup.ocx
- %WINDIR%\Downloaded Program Files\JuniperSetup.inf
- %WINDIR%\Downloaded Program Files\string_fr.properties
- %WINDIR%\Downloaded Program Files\string_es.properties
- %WINDIR%\Downloaded Program Files\string_en.properties
- %CommonProgramFiles%\Juniper Networks\JUNS\access.ini
- %CommonProgramFiles%\Juniper Networks\JUNS\dsLogService.dll
- %CommonProgramFiles%\Juniper Networks\JUNS\Uninstall.exe
- %CommonProgramFiles%\Juniper Networks\JSCDT\jnprShare.tmp
- %ALLUSERSPROFILE%\Application Data\Juniper Networks\Logging\debuglog.log
- %WINDIR%\Downloaded Program Files\JuniperSetupClientCtrlUninstaller.exe
- %WINDIR%\Downloaded Program Files\JuniperExt.exe
- %WINDIR%\Downloaded Program Files\JuniperSetupClient.ocx
- %CommonProgramFiles%\Juniper Networks\JUNS\Uninstall.exe.manifest
- %CommonProgramFiles%\Juniper Networks\JUNS\versionInfo.ini
- %ALLUSERSPROFILE%\Application Data\NeoterisSetup.ocx
- %CommonProgramFiles%\Juniper Networks\JUNS\JuniperSetupOCX.exe
- %TEMP%\JuniperSetupServiceInstallerAdmin.exe
- %TEMP%\dsInstallerClient.dll
- %TEMP%\dsLogService.dll
- %PROGRAM_FILES%\Juniper Networks\Installer Service\install.log
- %CommonProgramFiles%\Juniper Networks\JSCDT\jnprShare.dll
- %TEMP%\nsw7.tmp\UserInfo.dll
- %TEMP%\GLG4.tmp
- %TEMP%\GLK2.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\nsv6.tmp
- %TEMP%\~GLH0001.TMP
- C:\~GLH0000.TMP
- %TEMP%\nsbB.tmp\System.dll
- %CommonProgramFiles%\Juniper Networks\JUNS\install.log
- %CommonProgramFiles%\Juniper Networks\JSCDT\jnprShare.log
- %CommonProgramFiles%\Juniper Networks\JUNS\dsInstallerService.dll
- %CommonProgramFiles%\Juniper Networks\JUNS\dsAccessService.exe
- %TEMP%\nsbB.tmp\FindProcDLL.dll
- %PROGRAM_FILES%\Juniper Networks\Installer Service\Uninstall.exe
- %PROGRAM_FILES%\Juniper Networks\Installer Service\AccessServiceComponent.exe
- %PROGRAM_FILES%\Juniper Networks\Installer Service\versionInfo.ini
- %TEMP%\nsk9.tmp\jnprShare.dll
- %TEMP%\jis.tmp
- %PROGRAM_FILES%\Juniper Networks\Installer Service\jis.dep
Удаляет следующие файлы:
- %TEMP%\nsk9.tmp\jnprShare.dll
- %TEMP%\dsInstallerClient.dll
- %TEMP%\dsLogService.dll
- %TEMP%\JuniperSetupServiceInstallerAdmin.exe
- %TEMP%\nsbB.tmp\FindProcDLL.dll
- %TEMP%\nsbB.tmp\System.dll
Перемещает следующие файлы:
- %CommonProgramFiles%\Juniper Networks\JSCDT\jnprShare.tmp в %CommonProgramFiles%\Juniper Networks\JSCDT\jnprShare.txt
- %TEMP%\~GLH0001.TMP в %TEMP%\JuniperSetupServiceInstaller.exe
- C:\~GLH0000.TMP в C:\UNWISE.EXE
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
