Trojan.Siggen17.41265

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\process lasso management console (gui)
<SYSTEM32>\tasks\session agent for process lasso

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\ProcessGovernor] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ProcessGovernor] 'ImagePath' = '"%ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitev...

Создает следующие сервисы

'ProcessGovernor' "%ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\processlassosetup64.exe
%ProgramFiles%\process lasso\pl_rsrc_german.dll
%ProgramFiles%\process lasso\pl_rsrc_italian.dll
%ProgramFiles%\process lasso\pl_rsrc_french.dll
%ProgramFiles%\process lasso\pl_rsrc_polish.dll
%ProgramFiles%\process lasso\pl_rsrc_slovenian.dll
%ProgramFiles%\process lasso\pl_rsrc_spanish.dll
%ProgramFiles%\process lasso\pl_rsrc_japanese.dll
%ProgramFiles%\process lasso\pl_rsrc_bulgarian.dll
%ProgramFiles%\process lasso\pl_rsrc_russian.dll
%ProgramFiles%\process lasso\start-governor.bat
%ProgramFiles%\process lasso\stop-governor.bat
%ProgramFiles%\process lasso\pl.cmd
%ProgramFiles%\process lasso\pl-update.cmd
%ProgramFiles%\process lasso\plactivate.exe
%ProgramFiles%\process lasso\licenses
%ProgramFiles%\process lasso\uninstall.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\process lasso\process lasso.lnk
C:\users\public\desktop\process lasso.lnk
%ALLUSERSPROFILE%\processlasso\logs\processlasso.log
%ProgramFiles%\process lasso\pl_rsrc_ptbr.dll
%ProgramFiles%\process lasso\prolasso.key
%ProgramFiles%\process lasso\pl_rsrc_chinese_traditional.dll
%ProgramFiles%\process lasso\pl_rsrc_finnish.dll
%TEMP%\rarsfx0\xx.exe
%TEMP%\nsm5a41.tmp
%TEMP%\nsb5a51.tmp\system.dll
%ProgramFiles%\process lasso\installhelper.exe
%ProgramFiles%\process lasso\pl_rsrc_english.dll
%ProgramFiles%\process lasso\srvstub.exe
%ProgramFiles%\process lasso\bitsumms.exe
%ProgramFiles%\process lasso\processlasso.exe
%ProgramFiles%\process lasso\processgovernor.exe
%ProgramFiles%\process lasso\bitsumsessionagent.exe
%ProgramFiles%\process lasso\tweakscheduler.exe
%ProgramFiles%\process lasso\vistammsc.exe
%ProgramFiles%\process lasso\processlassolauncher.exe
%ProgramFiles%\process lasso\quickupgrade.exe
%ProgramFiles%\process lasso\cpueater.exe
%ProgramFiles%\process lasso\testlasso.exe
%ProgramFiles%\process lasso\logviewer.exe
%ProgramFiles%\process lasso\insights.exe
%ProgramFiles%\process lasso\threadracer.exe
%ProgramFiles%\process lasso\pl_rsrc_chinese.dll
%ALLUSERSPROFILE%\processlasso\config\prolasso.ini

Удаляет следующие файлы

<SYSTEM32>\tasks\session agent for process lasso
%TEMP%\nsb5a51.tmp\system.dll
%TEMP%\rarsfx0\processlassosetup64.exe
%TEMP%\rarsfx0\xx.exe

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'ProcessLasso_Notification_Class' WindowName: ''
ClassName: 'ProcessLasso_Notification_Class' WindowName: 'ProcessLasso_Notification_Window'

Создает и запускает на исполнение

'%TEMP%\rarsfx0\processlassosetup64.exe' /S
'%TEMP%\rarsfx0\xx.exe'
'%ProgramFiles%\process lasso\processlasso.exe' /install /nodelay
'%ProgramFiles%\process lasso\installhelper.exe' /S
'%ProgramFiles%\process lasso\installhelper.exe' /enable_update_check
'%ProgramFiles%\process lasso\installhelper.exe' /env_path_install
'%ProgramFiles%\process lasso\processgovernor.exe'
'%ProgramFiles%\process lasso\srvstub.exe' "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
'%ProgramFiles%\process lasso\bitsumsessionagent.exe' ----------------------------------------------------------------
'%ProgramFiles%\process lasso\bitsumms.exe' "%ProgramFiles%\Process Lasso\processgovernor.exe" /name:ProcessGovernor "/displayname:Process Lasso Core (Process Governor)" /exitevent:Global\ProcessGovernorExitEvent
'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessLassoGovernor /remove
'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessGovernor /stop
'%ProgramFiles%\process lasso\installhelper.exe' /install
'%ProgramFiles%\process lasso\installhelper.exe' /powerinstall
'%ProgramFiles%\process lasso\installhelper.exe' /migrate
'%ProgramFiles%\process lasso\installhelper.exe' /firstinstall
'%ProgramFiles%\process lasso\installhelper.exe' /terminate
'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessGovernor /remove
'%ProgramFiles%\process lasso\bitsumsessionagent.exe' ----------------------------------------------------------------' (со скрытым окном)