Trojan.DownLoader44.58776

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\microsoft-windows-codeintegrity%4operational.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\registryexports\oobe.reg
%TEMP%\regcad.tmp
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\registryexports\uilanguages.reg
%TEMP%\reg6d.tmp
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\dmi8538.tmp.log.xml
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer7f7e.tmp.mdmp
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cd2.tmp.hdmp
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xml
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.wer
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\cbs\cbs.log
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\panther\setupact.log
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\microsoft-windows-user profile service%4operational.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\microsoft-windows-winlogon%4operational.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\microsoft-windows-windowsupdateclient%4operational.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\application.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\system.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\eventlogs\microsoft-windows-kernel-storemgr%4operational.evtx
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\not collected.csv
%WINDIR%\temp\troubleshooting\starttroubleshooter_latest\_quickstartdiag.txt

Удаляет следующие файлы

%TEMP%\reg6d.tmp
%TEMP%\regcad.tmp

Сетевая активность

Подключается к

'microsoft.com':80
'oc##.#tartssl.com':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV

UDP

DNS ASK microsoft.com
DNS ASK oc##.#tartssl.com
DNS ASK public-trust.com

Другое

Запускает на исполнение

'<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\UILanguages %WINDIR%\temp\Troubleshooting\StartTroubleshooter_latest\RegistryExports\\UILanguages.reg /y /reg:64
'<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE %WINDIR%\temp\Troubleshooting\StartTroubleshooter_latest\RegistryExports\\OOBE.reg /y /reg:64