Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe] 'Debugger' = 'SppExtComObjPatcher.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe] 'Debugger' = 'SppExtComObjPatcher.exe'
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\net.exe' stop ""osppsvc"" /y
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\d24c.tmp\install.cmd
- nul
Удаляет следующие файлы
- %TEMP%\d24c.tmp\install.cmd
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\D24C.tmp\install.cmd" "<Полный путь к файлу>""' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\D24C.tmp\install.cmd" "<Полный путь к файлу>""
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Office2010" /t REG_SZ /d "Random"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\55c92734-d682-4d71-983e-d6ec3f16059f /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\0ff1ce15-a989-479d-af46-f275c6370663 /f
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /value
- '<SYSTEM32>\findstr.exe' /i "Office"
- '<SYSTEM32>\findstr.exe' /i "Windows"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Office2013" /t REG_SZ /d "Random"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"\59a52881-a989-479d-af46-f275c6370663 /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Debugger"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_ActivationInterval"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_RenewalInterval"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Office2010"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"\0ff1ce15-a989-479d-af46-f275c6370663 /f
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%') get Name
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Debugger" /t REG_SZ /d "SppExtComObjPatcher.exe"
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_Processor get AddressWidth /value
- '<SYSTEM32>\wbem\wmic.exe' path Win32_Processor get AddressWidth /value
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_OperatingSystem get BuildNumber /value
- '<SYSTEM32>\wbem\wmic.exe' path Win32_OperatingSystem get BuildNumber /value
- '<SYSTEM32>\sc.exe' query ""sppsvc""
- '<SYSTEM32>\findstr.exe' /i "STOPPED"
- '<SYSTEM32>\sc.exe' query ""osppsvc""
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version
- '<SYSTEM32>\net1.exe' stop ""osppsvc"" /y
- '<SYSTEM32>\xcopy.exe' "64-bit\SppExtComObjHook.dll" "<SYSTEM32>\" /y /q
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Debugger" /t REG_SZ /d "SppExtComObjPatcher.exe"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Office2013" /t REG_SZ /d "Random"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Windows" /t REG_SZ /d "Random"
- '<SYSTEM32>\xcopy.exe' "64-bit\SppExtComObjPatcher.exe" "<SYSTEM32>\" /y /q
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Office2013"
- '<SYSTEM32>\sc.exe' start sppsvc trigger=timer;sessionid=0
