Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNOTIFY.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UsoClient.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MusNotification.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdateAssistant.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINDOWS10UPGRADERAPP.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\remsh.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SIHClient.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallAgent.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaaSMedic.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaasMedicAgent.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MUSNOTIFICATIONUX.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UPFC.EXE] 'Debugger' = '*'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'ImagePath' = '%WINDIR%\F1VPIJD6\SU10Guard.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\wuauserv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WaasMedicSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\USOSVC] 'Start' = '00000002'
Создает следующие сервисы
- 'SU10Guard' %WINDIR%\F1VPIJD6\SU10Guard.exe
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Обновления системы (Windows Update)
удаляет теневые копии разделов.
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\f1vpijd6\dq6gg2h6.cfg
- %WINDIR%\f1vpijd6\rdpencom.dll
- %WINDIR%\f1vpijd6\rascustom.dll
- %WINDIR%\f1vpijd6\phonedatasync.dll
- %WINDIR%\f1vpijd6\peerdistsh.dll
- %WINDIR%\f1vpijd6\oleacc.dll
- %WINDIR%\f1vpijd6\mswsock.dll
- %WINDIR%\f1vpijd6\msihnd.dll
- %WINDIR%\f1vpijd6\msauddecmft.dll
- %WINDIR%\f1vpijd6\microsoftaccountextension.dll
- %WINDIR%\f1vpijd6\microsoft.uev.cscunpintool.exe
- %WINDIR%\f1vpijd6\dq6gg2h6.exe
- %WINDIR%\f1vpijd6\curl.exe
- %WINDIR%\f1vpijd6\cloudexperiencehost.dll
- %WINDIR%\f1vpijd6\audiokse.dll
- %WINDIR%\f1vpijd6\appidpolicyengineapi.dll
- %WINDIR%\f1vpijd6\sdds.dll
- %WINDIR%\f1vpijd6\securityhealthagent.dll
- %WINDIR%\f1vpijd6\zcmzd0s3log.txt
- %WINDIR%\f1vpijd6\settingsenvironment.desktop.dll
- %WINDIR%\f1vpijd6\zcmzd0s3.exe
- %WINDIR%\f1vpijd6\winlangdb.dll
- %WINDIR%\f1vpijd6\windows.media.devices.dll
- %WINDIR%\f1vpijd6\windows.devices.usb.dll
- %WINDIR%\f1vpijd6\wevtapi.dll
- %WINDIR%\f1vpijd6\tsmf.dll
- %WINDIR%\f1vpijd6\tracerpt.exe
- %WINDIR%\f1vpijd6\taskapis.dll
- %WINDIR%\f1vpijd6\syncinfrastructure.dll
- %WINDIR%\f1vpijd6\su10guard.exe
- %WINDIR%\f1vpijd6\stobject.dll
- %WINDIR%\f1vpijd6\sppcomapi.dll
- %WINDIR%\f1vpijd6\shrpubw.exe
- %WINDIR%\f1vpijd6\sgrmenclave.dll
- %WINDIR%\f1vpijd6\settingshandlers_useraccount.dll
- %WINDIR%\f1vpijd6\aboutsettingshandlers.dll
- %WINDIR%\f1vpijd6\searchprotocolhost.exe
- %WINDIR%\f1vpijd6\translate\wu.nat
- %WINDIR%\f1vpijd6\lang\japanese_meiryo\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\italian\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\hungarian\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\greek\wu.nat
- %WINDIR%\f1vpijd6\lang\greek\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\german\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\french\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\czech2\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\czech\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\croatian\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\chinesetraditional\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\catalan\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\bulgarian\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\brazilianportuguese\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\arabic\stopupdates10.nat
- %WINDIR%\f1vpijd6\html.iec
- %WINDIR%\f1vpijd6\lang\japanese\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\korean\stopupdates10.nat
- %WINDIR%\f1vpijd6\translate\how_to_translate.txt
- %WINDIR%\f1vpijd6\lang\polish\stopupdates10.nat
- %WINDIR%\f1vpijd6\translate\change-from-300-to-350.upd
- %WINDIR%\f1vpijd6\translate\change-from-255-to-300.upd
- %WINDIR%\f1vpijd6\translate\change-from-250-to-255.upd
- %WINDIR%\f1vpijd6\translate\change-from-234-to-250.upd
- %WINDIR%\f1vpijd6\stopupdates10_lang.ini
- %WINDIR%\f1vpijd6\stopupdates10w.ini
- %WINDIR%\f1vpijd6\stopupdates10.ini
- %WINDIR%\f1vpijd6\lang\ukrainian\wu.nat
- %WINDIR%\f1vpijd6\lang\ukrainian\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\turkish\wu.nat
- %WINDIR%\f1vpijd6\lang\turkish\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\spanish2\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\spanish\stopupdates10.nat
- %WINDIR%\f1vpijd6\lang\russian\wu.nat
- %WINDIR%\f1vpijd6\lang\russian\stopupdates10.nat
- %WINDIR%\f1vpijd6\translate\stopupdates10.nat
- %WINDIR%\f1vpijd6\su10guard.log
Удаляет следующие файлы
- %WINDIR%\f1vpijd6\su10guard.log
Подменяет следующие файлы
- %WINDIR%\f1vpijd6\su10guard.log
Другое
Создает и запускает на исполнение
- '%WINDIR%\f1vpijd6\zcmzd0s3.exe' /disable
- '%WINDIR%\f1vpijd6\su10guard.exe' -i
- '%WINDIR%\f1vpijd6\su10guard.exe'
- '%WINDIR%\f1vpijd6\dq6gg2h6.exe' /Run
- '%WINDIR%\f1vpijd6\su10guard.exe' -i' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /C ping 127.0.0.1 -n 50 && vssadmin.exe delete shadows /all /quiet
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 50
