Trojan.StartPage.48867

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\nss3.tmp\ns10.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
%TEMP%\nss3.tmp\ns11.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
%TEMP%\nss3.tmp\nsE.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:r
%TEMP%\nss3.tmp\nsF.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r users
%TEMP%\nss3.tmp\ns12.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r system
%TEMP%\nss3.tmp\ns15.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:r
%TEMP%\nss3.tmp\ns16.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r users
%TEMP%\nss3.tmp\ns13.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
%TEMP%\nss3.tmp\ns14.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r everyone
%TEMP%\nss3.tmp\nsD.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r everyone
%TEMP%\nss3.tmp\ns6.tmp regini.exe regini.ini
%TEMP%\nss3.tmp\ns7.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:f
%TEMP%\nss3.tmp\ns4.tmp regini.exe bak.ini
%TEMP%\nss3.tmp\ns5.tmp regedit.exe /s CHS.reg
%TEMP%\nss3.tmp\ns8.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:f
%TEMP%\nss3.tmp\nsB.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r system
%TEMP%\nss3.tmp\nsC.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%
%TEMP%\nss3.tmp\ns9.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%
%TEMP%\nss3.tmp\nsA.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%s

Запускает на исполнение:

<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:r
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r users
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:r
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r users
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r system
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r everyone
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r everyone
<SYSTEM32>\regini.exe regini.ini
<SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:f
<SYSTEM32>\regini.exe bak.ini
%WINDIR%\regedit.exe /s CHS.reg
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r system
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:f
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%