Trojan.Siggen18.36985

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\GoToResolve_] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\GoToResolve_] 'ImagePath' = '"%ProgramFiles(x86)%\GoTo Resolve Unattended\GoToResolveProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoTo...

Создает следующие сервисы

'GoToResolve_' "%ProgramFiles(x86)%\GoTo Resolve Unattended\GoToResolveProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType "4"

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.log
%ProgramFiles(x86)%\goto resolve unattended\gotoresolvetools32.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolvetools64.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolvecrashhandler.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveui.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveloggerprocess.exe
%ProgramFiles(x86)%\goto resolve unattended\libgotoresolve.dll
%ProgramFiles(x86)%\goto resolve unattended\libcrypto-1_1.dll
%ProgramFiles(x86)%\goto resolve unattended\lmisupportm32.exe
%ProgramFiles(x86)%\goto resolve unattended\libssl-1_1.dll
%ProgramFiles(x86)%\goto resolve unattended\unattended.json
%ProgramFiles(x86)%\goto resolve unattended\mandatory.json
%ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveunattended.log
%ProgramFiles(x86)%\goto resolve unattended\pc.json
%ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveprocesschecker.log
%ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveprocesschecker.srv.log
%ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveunattended.srv.log
%ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveloggerprocess_20220818__11_55_58_981.log
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunlock32.dll
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunlock64.dll
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattendedremover.exe
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattendedui.exe
%ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.inf
%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe
%ProgramFiles(x86)%\goto resolve unattended\lmifilterhook32.dll
%ProgramFiles(x86)%\goto resolve unattended\lmifilterhook64.dll
%ProgramFiles(x86)%\goto resolve unattended\lmiinputhook32.dll
%ProgramFiles(x86)%\goto resolve unattended\lmiinputhook64.dll
%ProgramFiles(x86)%\goto resolve unattended\lmiscrhook32.dll
%ProgramFiles(x86)%\goto resolve unattended\lmiscrhook64.dll
%ProgramFiles(x86)%\goto resolve unattended\lmisupport7x32.dll
%ProgramFiles(x86)%\goto resolve unattended\.sentry-native\98ba678c-786d-4005-b342-f1a54848c817.run\session.json
<Полный путь к файлу>.cmd
%ProgramFiles(x86)%\goto resolve unattended\lmisupport7x64.dll
%ProgramFiles(x86)%\goto resolve unattended\mediaclientlib.dll
%ProgramFiles(x86)%\goto resolve unattended\passwordprivacydll.dll
%ProgramFiles(x86)%\goto resolve unattended\filemanager.dll
%ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.cat
%ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.dll
%ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.inf
%ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.cat
%ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.dll
%ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.csv
%ProgramFiles(x86)%\goto resolve unattended\lmisupportm64.exe
<SYSTEM32>\gotoresolveunlock64.dll

Удаляет следующие файлы

<Полный путь к файлу>.cmd
%ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdatercopy.csv

Перемещает следующие файлы

%ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.csv в %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdatercopy.csv

Самоудаляется.

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' -regsvc
'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe' -regsvc -starterpid 2360 -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType 4
'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe' -Service -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType "4"
'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "788" "-WtsStartingUsername" "fxfeocg\user" "-ServiceName" "GoToResolve_" "-Service"
'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveloggerprocess.exe' -HostId 29e3f22b44e52caa688e50f220225f3b -SessionType "" -InstallationId XnER6Zuy9Z -DeviceId "" -LogLevel 2
'%WINDIR%\syswow64\cmd.exe' /S /C ""<Полный путь к файлу>.cmd" "<Полный путь к файлу>""' (со скрытым окном)
'%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "788" "-WtsStartingUsername" "fxfeocg\user" "-ServiceName" "GoToResolve_" "-Service"' (со скрытым окном)

Запускает на исполнение