Техническая информация
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\System\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует запуск следующих системных утилит:
- Обновления системы (Windows Update)
- Центр обеспечения безопасности (Security Center)
- Системный антивирус (Защитник Windows)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\fwtsqmfile01.sqm
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop" /v "FontSmoothing" /t REG_SZ /f /d "0" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /f /d "0" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\System\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "EnableFirewall" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\System\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v "EnableFirewall" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t REG_DWORD /f /d 8 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "IncludeRecommendedUpdates" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "ElevateNonAdmins" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v "AUOptions" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= disabled
- '%WINDIR%\syswow64\sc.exe' config WSearch start= disabled
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /f /d "400" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop" /v "PaintDesktopVersion" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation" /v "DisableStartupSound" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /f /d "31" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_SZ /f /d "0" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\System\CurrentControlSet\services\W32Time\Parameters" /v "Type" /t REG_SZ /f /d "NoSync" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarSmallIcons" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarSizeMove" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= disabled
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_ShowRecentDocs" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_ShowHelp" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DisablePreviewDesktop" /t REG_DWORD /f /d 1 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop\WindowMetrics" /v "Shell Icon Size" /t REG_SZ /f /d "32" /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /f /d "0" /reg:64
- '%WINDIR%\syswow64\sc.exe' config LanmanServer start= disabled
- '%WINDIR%\syswow64\sc.exe' config TermService start= disabled
- '%WINDIR%\syswow64\sc.exe' config ehSched start= disabled
- '%WINDIR%\syswow64\sc.exe' stop W32Time
- '%WINDIR%\syswow64\sc.exe' stop RemoteAccess
- '%WINDIR%\syswow64\sc.exe' stop SSDPSRV
- '%WINDIR%\syswow64\sc.exe' stop SDRSVC
- '%WINDIR%\syswow64\sc.exe' stop TrkWks
- '%WINDIR%\syswow64\sc.exe' stop wscsvc
- '%WINDIR%\syswow64\sc.exe' stop SensrSvc
- '%WINDIR%\syswow64\sc.exe' stop CscService
- '%WINDIR%\syswow64\sc.exe' stop iphlpsvc
- '%WINDIR%\syswow64\cmd.exe' /Q /C "MD %TEMP%"
- '%WINDIR%\syswow64\cmd.exe' /Q /C "RD /S /Q %TEMP%"
- '%WINDIR%\syswow64\powercfg.exe' -H OFF
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\sc.exe' stop RemoteRegistry
- '%WINDIR%\syswow64\sc.exe' stop WMPNetworkSvc
- '%WINDIR%\syswow64\sc.exe' stop HomeGroupProvider
- '%WINDIR%\syswow64\sc.exe' stop ehSched
- '%WINDIR%\syswow64\sc.exe' config WMPNetworkSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' stop TermService
- '%WINDIR%\syswow64\sc.exe' config RemoteRegistry start= disabled
- '%WINDIR%\syswow64\sc.exe' config HomeGroupProvider start= disabled
- '%WINDIR%\syswow64\sc.exe' config W32Time start= disabled
- '%WINDIR%\syswow64\sc.exe' config RemoteAccess start= disabled
- '%WINDIR%\syswow64\sc.exe' config SSDPSRV start= disabled
- '%WINDIR%\syswow64\sc.exe' config SDRSVC start= disabled
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarGlomLevel" /t REG_DWORD /f /d 2 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "SMB1" /t REG_DWORD /f /d 0 /reg:64
- '%WINDIR%\syswow64\sc.exe' config SensrSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' config CscService start= disabled
- '%WINDIR%\syswow64\sc.exe' config iphlpsvc start= disabled
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\sc.exe' stop WSearch
- '%WINDIR%\syswow64\sc.exe' stop WinDefend
- '%WINDIR%\syswow64\sc.exe' stop LanmanServer
- '%WINDIR%\syswow64\sc.exe' config TrkWks start= disabled
- '%WINDIR%\syswow64\cmd.exe' /Q /C "RD /S /Q C:\Recovery"
