Trojan.MulDrop16.10699

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\Adaptec Event Monitor] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Adaptec Event Monitor] 'ImagePath' = '%ProgramFiles%\Adaptec\Adaptec Event Monitor\EventMonitor.exe'

Создает следующие сервисы

'Adaptec Event Monitor' %ProgramFiles%\Adaptec\Adaptec Event Monitor\EventMonitor.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\tempexe.exe
%TEMP%\{0395d415-0ebe-4129-a985-fbd32442015e}\isconfig.ini
%TEMP%\_is60b6.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe
%TEMP%\_is650b.tmp
%TEMP%\{f35c2a23-728c-420a-87df-740904bf5a4e}\isconfig.ini
%ProgramFiles%\adaptec\adaptec event monitor\afaapi.dll
%ProgramFiles%\adaptec\adaptec event monitor\arcconf.exe
%ProgramFiles%\adaptec\adaptec event monitor\driverupdate.exe
%ProgramFiles%\adaptec\adaptec event monitor\msvcp110.dll
%ProgramFiles%\adaptec\adaptec event monitor\msvcr110.dll
%ProgramFiles%\adaptec\adaptec event monitor\storarc.dll
%ProgramFiles%\adaptec\adaptec event monitor\miniagentlogmsg.dll
%ProgramFiles%\adaptec\adaptec event monitor\nrmconfig.ini
%ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe
%ProgramFiles%\adaptec\adaptec event monitor\raidnls.properties
%ProgramFiles%\adaptec\adaptec event monitor\nrmfsa.dll
%TEMP%\_is7283.tmp
%TEMP%\{e826d1cc-cb2b-49e4-b1a0-3c35adbd2ceb}\isconfig.ini
%TEMP%\_is7736.tmp
%TEMP%\{41337259-0a23-4e78-9c69-fda74285ff01}\isconfig.ini
%WINDIR%\installer\{50b11c9f-4717-43ae-90e5-941b90a558e1}\serveraid_manager_65002fb472c845f2a944d0f0c11d9b40.exe
C:\pmcs\logs\nrmfsadebug.log
C:\pmcs\logs\arcerror.txt
C:\pmcs\logs\arcconfig.xml
C:\pmcs\logs\raidmonitor_install.log
%TEMP%\_is6086.tmp
C:\pmcs\logs\adaptec.log
%TEMP%\{50b11c9f-4717-43ae-90e5-941b90a558e1}\writeproperty.jar
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\string1033.txt
%TEMP%\_is4eac.tmp
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\setup.ini
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\_ismsidel.ini
%TEMP%\_is4ff4.tmp
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\0x0409.ini
%TEMP%\_is5341.tmp
%TEMP%\~5330.tmp
%TEMP%\_is5342.tmp
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\adaptec event monitor.msi
%TEMP%\iss5a35.tmp
%TEMP%\_is5a55.tmp
%TEMP%\{ad84f42b-c01b-499a-8e16-7b1eda97983d}\isconfig.ini
%TEMP%\_is5a66.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\setup.inx
%TEMP%\_is5aa5.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isrt.dll
%TEMP%\_is5ae5.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewx64.exe
%TEMP%\_is5b05.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewi64.exe
%TEMP%\_is5b25.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\_isres_0x0409.dll
%TEMP%\_is5b64.tmp
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isconfig.ini
%TEMP%\_is5b65.tmp
%TEMP%\adaptec.log
%ProgramFiles%\adaptec\adaptec event monitor\nrmfsaconfig.xml

Удаляет следующие файлы

%TEMP%\_is4eac.tmp
%TEMP%\_is7283.tmp
%TEMP%\{e826d1cc-cb2b-49e4-b1a0-3c35adbd2ceb}\isconfig.ini
%TEMP%\_is7736.tmp
%TEMP%\{41337259-0a23-4e78-9c69-fda74285ff01}\isconfig.ini
%TEMP%\{50b11c9f-4717-43ae-90e5-941b90a558e1}\writeproperty.jar
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\0x0409.ini
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\_isres_0x0409.dll
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\adaptec event monitor.msi
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewi64.exe
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewx64.exe
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isconfig.ini
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isrt.dll
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\setup.ini
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\setup.inx
%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\string1033.txt
%TEMP%\{f35c2a23-728c-420a-87df-740904bf5a4e}\isconfig.ini
%TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\_ismsidel.ini
%TEMP%\_is650b.tmp
%TEMP%\{0395d415-0ebe-4129-a985-fbd32442015e}\isconfig.ini
%TEMP%\_is4ff4.tmp
%TEMP%\_is5341.tmp
%TEMP%\~5330.tmp
%TEMP%\_is5342.tmp
%TEMP%\_is5a55.tmp
%TEMP%\_is5a66.tmp
%TEMP%\_is5aa5.tmp
%TEMP%\_is5ae5.tmp
%TEMP%\_is5b05.tmp
%TEMP%\_is5b25.tmp
%TEMP%\_is5b64.tmp
%TEMP%\_is5b65.tmp
%TEMP%\{ad84f42b-c01b-499a-8e16-7b1eda97983d}\isconfig.ini
%TEMP%\iss5a35.tmp
%TEMP%\_is6086.tmp
%TEMP%\_is60b6.tmp
%TEMP%\tempexe.exe

Другое

Ищет следующие окна

ClassName: 'MsiDialogCloseClass' WindowName: ''
ClassName: '#32770' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\tempexe.exe' /s /v" /qn ADDLOCAL=all /log %TEMP%\adaptec.log INSTALLDIR=\"%ProgramFiles%\Adaptec\Adaptec Event Monitor\"
'%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A0E7538-600D-4578-87F7-BCC99EF95B75}
'%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45FD6222-82C9-49E5-85D1-E2433C262FE2}
'%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C5E448F-AFEC-4479-8130-B08AE2729CC1}
'%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16EE7FCA-7AB9-4EBA-BF32-DF59D54FFC33}
'%ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe' -i
'%ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c MsiExec.exe /X{50B11C9F-4717-43AE-90E5-941B90A558E1} /qn
'<SYSTEM32>\msiexec.exe' /X{50B11C9F-4717-43AE-90E5-941B90A558E1} /qn
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\{F266824B-A6AA-4DB5-B6DC-770A2E342AA1}\Adaptec Event Monitor.msi" /qn ADDLOCAL=all /log %TEMP%\adaptec.log INSTALLDIR="%ProgramFiles%\Adaptec\Adaptec Event Monitor" SETUPEXEDIR="%L...