Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\.exe] '' = 'txtfile'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = ''
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'X:\windows\system32\userinit.exe,'
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\crash.exe
Устанавливает следующие настройки сервисов
- [<HKLM>\SYSTEM\CurrentControlSet\Services\EDriver] 'ImagePath' = '<Текущая директория>\EDriver64.sys'
Создает следующие сервисы
- 'EDriver' <Текущая директория>\EDriver64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Интерпретатора командной строки (CMD)
- Редактора реестра (RegEdit)
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = 'FFFFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im 360tray.exe
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\smss.exe
следующие пользовательские процессы:
- csrss.exe
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\edriver64.sys
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemcomn.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\svcini.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\smipi.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\smiengine.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\repdrvfs.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\poqexec.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\pkgmgr.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\oemhelpins.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mspatcha.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\msdelta.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mofinstall.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemprox.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemcore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\helpcins.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\globalinstallorder.xml
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\fastprox.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\esscli.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\drvstore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\drupdate.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\dpx.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cntrtextinstaller.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmiv2.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmitrust.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmiadapter.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mofd.dll
- x:\windows\security\logs\backup.log
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wcmtypes.xsd
- E:\windows\system32\logfiles\srt\bootstat.dat
- E:\windows\system32\logfiles\srt\bcdinfo.txt
- E:\windows\system32\logfiles\srt\disklayout.txt
- E:\windows\system32\logfiles\srt\srttrail.txt
- E:\windows\system32\logfiles\srt\srttrail.log
- E:\windows\system32\smi\store\machine\schema.dat
- E:\windows\system32\smi\store\machine\schema.dat.log1
- E:\users\default\ntuser.dat
- E:\users\default\ntuser.dat.log1
- E:\windows\system32\config\default
- E:\windows\system32\config\default.log1
- E:\windows\system32\config\security
- E:\windows\system32\config\security.log1
- E:\windows\winsxs\temp\pendingrenames\e008dc573c56ea1f08000000e802ac03.$$_system32_21f9a9c4a2f8b514.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\405fcb573c56ea1f07000000e802ac03.$$.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\e0fdc8573c56ea1f06000000e802ac03._0000000000000000.cdf-ms
- E:\windows\winsxs\manifestcache\ee9f676b8aa4122b_blobs.bin
- E:\windows\winsxs\temp\pendingrenames\4054b8573c56ea1f04000000e802ac03.$$_system32_21f9a9c4a2f8b514.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\000197573c56ea1f03000000e802ac03.$$.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\e0dc8f573c56ea1f02000000e802ac03._0000000000000000.cdf-ms
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\xmllite.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wrpint.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wmiutils.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wmicmiplugin.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wdscore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cbsmsg.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\locdrv.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cbscore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apss.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apircl.dll
- x:\windows\serviceprofiles\localservice\ntuser.dat
- x:\windows\security\database\edbres00002.jrs
- x:\windows\security\database\edbres00001.jrs
- x:\windows\security\database\edbtmp.log
- x:\windows\system32\winpeshl.log
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\localservice\ntuser.dat.log1
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\security\database\tmp.edb
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\networkservice\ntuser.dat.log1
- x:\windows\serviceprofiles\networkservice\ntuser.dat
- x:\windows\system32\microsoft\protect\s-1-5-18\user\preferred
- x:\windows\system32\microsoft\protect\s-1-5-18\user\7739708d-d2f6-474a-8635-8320a62b4dba
- x:\windows\system32\logfiles\wmi\rtbackup\etwrtubpm.etl
- x:\windows\system32\logfiles\scm\scm.evm
- E:\windows\system32\logfiles\srt\bootfailure.txt
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wcp.dll
- x:\windows\security\database\edb.chk
- x:\windows\debug\netsetup.log
- x:\windows\security\database\edb.log
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apds.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\amd64_installed
- x:\windows\system32\wbem\repository\mapping1.map
- x:\windows\system32\wbem\repository\mapping3.map
- x:\windows\system32\wbem\repository\mapping2.map
- x:\windows\system32\wbem\repository\index.btr
- x:\windows\system32\wbem\repository\objects.data
- x:\windows\temp\disklayout.txt
- x:\windows\temp\diskcmd.txt
- x:\windows\temp\bcdinfo.txt
- x:\windows\temp\bootstat.dat
- x:\windows\temp\bootfailure.txt
- E:\windows\system32\config\components
- E:\windows\system32\config\components.log1
- E:\windows\system32\config\sam
- E:\windows\system32\config\sam.log1
- E:\windows\system32\config\software
- E:\windows\system32\config\software.log1
- E:\windows\system32\config\system
- E:\windows\system32\config\system.log1
- x:\windows\temp\startuprepair.etl
- %BOOT_VOL%\boot\bcd
- %BOOT_VOL%\boot\bcd.log
- x:\windows\inf\setupapi.app.log
- x:\windows\security\database\secedit.sdb
- E:\windows\bootstat.dat
Присваивает атрибут 'скрытый' для следующих файлов
- x:\windows\serviceprofiles\networkservice\ntuser.dat
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\localservice\ntuser.dat.log1
- x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\localservice\ntuser.dat
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
- x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
- x:\windows\serviceprofiles\networkservice\ntuser.dat.log1
- x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
- E:\users\default\ntuser.dat
Удаляет следующие файлы
- x:\windows\temp\diskcmd.txt
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mspatcha.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\oemhelpins.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\pkgmgr.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\poqexec.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\repdrvfs.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\smiengine.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\smipi.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\svcini.exe
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemcomn.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemcore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wbemprox.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wcmtypes.xsd
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wcp.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wdscore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wmicmiplugin.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wmiutils.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\wrpint.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\msdelta.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\xmllite.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mofinstall.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\locdrv.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\amd64_installed
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apds.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apircl.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\apss.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cbscore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cbsmsg.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmiadapter.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmitrust.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cmiv2.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\cntrtextinstaller.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\dpx.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\drupdate.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\drvstore.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\esscli.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\fastprox.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\globalinstallorder.xml
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\helpcins.dll
- x:\windows\temp\sss_e0fb93523c56ea1f01000000e802ac03\mofd.dll
- x:\windows\system32\logfiles\wmi\rtbackup\etwrtubpm.etl
Перемещает следующие файлы
- x:\windows\security\database\edbtmp.log в x:\windows\security\database\edb.log
- E:\windows\winsxs\temp\pendingrenames\e0fdc8573c56ea1f06000000e802ac03._0000000000000000.cdf-ms в E:\windows\winsxs\filemaps\_0000000000000000.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\405fcb573c56ea1f07000000e802ac03.$$.cdf-ms в E:\windows\winsxs\filemaps\$$.cdf-ms
- E:\windows\winsxs\temp\pendingrenames\e008dc573c56ea1f08000000e802ac03.$$_system32_21f9a9c4a2f8b514.cdf-ms в E:\windows\winsxs\filemaps\$$_system32_21f9a9c4a2f8b514.cdf-ms
Подменяет следующие файлы
- x:\windows\security\database\edbtmp.log
Другое
Ищет следующие окна
- ClassName: 'CicLoaderWndClass' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im 360tray.exe' (со скрытым окном)
- 'x:\windows\system32\cmd.exe' /c bcdedit.exe -enum all > X:\windows\TEMP\bcdinfo.txt' (со скрытым окном)
- 'x:\windows\system32\cmd.exe' /c DiskPart.exe /s X:\windows\TEMP\diskcmd.txt > X:\windows\TEMP\disklayout.txt' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\notepad.exe' %ProgramFiles%\Microsoft Office\Office14\BCSSync.exe
- '<SYSTEM32>\notepad.exe' %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Crash.exe
