Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\microsoft\windows\autochk\proxy
- <SYSTEM32>\tasks\microsoft\windows\location\notifications
- <SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
- <SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
- <SYSTEM32>\tasks\microsoft\windows\media center\registersearch
- <SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
- <SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
- <SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
- <SYSTEM32>\tasks\microsoft\windows\clean\cleans temporal directories
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Центр обеспечения безопасности (Security Center)
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\4c0d.tmp\4c0e.bat
Другое
Ищет следующие окна
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\4C0D.tmp\4C0E.bat <Полный путь к файлу>"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\AitAgent" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Autochk\Proxy" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Diagnosis\Scheduled" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Location\Notifications" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Maintenance\WinSat" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Media Center\ActivateWindowsSearch" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Media Center\ConfigureInternetTimeService" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Media Center\RegisterSearch" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Media Center\ReindexSearchRoot" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Media Center\mcupdate" /Disable
- '<SYSTEM32>\xcopy.exe' /Y /Q %WINDIR%\Temp\Clean\* %WINDIR%\Clean\
- '<SYSTEM32>\sc.exe' config wscsvc start= Disabled
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= Disabled
- '<SYSTEM32>\sc.exe' config Fax start= disabled
- '<SYSTEM32>\sc.exe' config SCardSvr start= Disabled
- '<SYSTEM32>\sc.exe' config SCPolicySvc start= Disabled
- '<SYSTEM32>\sc.exe' config PcaSvc start= Disabled
- '<SYSTEM32>\sc.exe' config BDESVC start= Disabled
- '<SYSTEM32>\sc.exe' config WSearch start= Demand
- '<SYSTEM32>\sc.exe' config WbioSrvc start= Disabled
- '<SYSTEM32>\sc.exe' delete DiagTrack
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Media Sharing\UpdateLibrary" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WDI\ResolutionHost" /Disable
- '<SYSTEM32>\schtasks.exe' /create /TN "\Microsoft\Windows\Clean\Cleans temporal directories" /RL HIGHEST /TR "%WINDIR%\Clean\CleanTemp.vbs" /SC ONLOGON
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AIT" /v "AITEnable" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\InvAgent" /v "Maintenance" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\CIT" /v "Nightly" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "DisableEnterpriseAuthProxy" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DisableOSUpgrade" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v "DOMaxUploadBandwidth" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableUAR" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisablePCA" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Audio" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\Appraiser" /v "Nightly" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser/Operational" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Inventory" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Problem-Steps-Recorder" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{eef54e71-0661-422d-9a98-82fd4940b820}" /v "EnableProperty" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Telemetry" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{eef54e71-0661-422d-9a98-82fd4940b820}" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{eef54e71-0661-422d-9a98-82fd4940b820}" /v "EnableProperty" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{eef54e71-0661-422d-9a98-82fd4940b820}" /v "Enabled" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NtfsLog" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AvStatus" /v "Nightly" /t REG_DWORD /d "0" /f
- '%WINDIR%\regedit.exe' /s "%WINDIR%\Temp\Tweak.reg" /f
