Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\Installer\MSI3.tmp -q %WINDIR%\\almain.sdb
Запускает на исполнение:
- <SYSTEM32>\msiexec.exe /V
- %WINDIR%\regedit.exe /s AppLocale.reg
- <SYSTEM32>\msiexec.exe /i "%WINDIR%\Temp\AppLocale.msi" /QB
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\Temp\AppLocale.bat" "
- <SYSTEM32>\mode.com CON COLS=35 LINES=25
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\AppPatch\ALRes411.dll
- %WINDIR%\AppPatch\AppLoc.exe
- C:\Config.Msi\245fb.rbs
- %WINDIR%\AppPatch\ALRes407.dll
- %WINDIR%\AppPatch\ALRes412.dll
- %WINDIR%\AppPatch\AlLayer.dll
- %WINDIR%\AppPatch\ALRes40D.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
- %WINDIR%\Installer\MSI3.tmp
- %HOMEPATH%\Start Menu\Programs\Microsoft AppLocale\readme.lnk
- %APPDATA%\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe
- <SYSTEM32>\LocaleStart.vbs
- %WINDIR%\AppPatch\AppLoc.tmp
- %APPDATA%\Microsoft\Installer\{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_18be6784.exe
- %WINDIR%\almain.sdb
- %WINDIR%\AppPatch\ALRes404.dll
- %WINDIR%\AppPatch\ALRes409.dll
- %WINDIR%\AppPatch\ALRes804.dll
- %HOMEPATH%\Start Menu\Programs\Microsoft AppLocale\AppLocale.lnk
- %WINDIR%\AppPatch\ALRes401.dll
- %WINDIR%\AppPatch\readme.doc
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %WINDIR%\Temp\AppLocale.bat
- %WINDIR%\Temp\AppLoc.tmp
- %WINDIR%\Temp\AppLocale.msi
- %WINDIR%\Temp\LocaleStart.vbs
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
- %WINDIR%\Installer\245f8.msi
- %WINDIR%\Temp\AppLocale.reg
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
Удаляет следующие файлы:
- %WINDIR%\Temp\AppLocale.msi
- %WINDIR%\Temp\AppLoc.tmp
- %WINDIR%\Temp\AppLocale.reg
- %WINDIR%\Temp\Perflib_Perfdata_7e8.dat
- %WINDIR%\Temp\LocaleStart.vbs
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\245fb.rbs
- %WINDIR%\Installer\245fa.ipi
- %WINDIR%\Installer\245f8.msi
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/pki/crl/products/CodeSignPCA.crl
- wp#d/wpad.dat
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
