Trojan.Siggen19.16460

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\SYSTEM\ControlSet001\Services\fltsrv] 'ImagePath' = 'System32\DRIVERS\fltsrv.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\fltsrv] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\fltsrv] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\fltsrv] 'ImagePath' = 'System32\DRIVERS\fltsrv.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\snapman] 'ImagePath' = 'System32\DRIVERS\snapman.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\snapman] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\snapman] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\snapman] 'ImagePath' = 'System32\DRIVERS\snapman.sys'

Создает следующие сервисы

'fltsrv' System32\DRIVERS\fltsrv.sys
'snapman' System32\DRIVERS\snapman.sys

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\install.cmd
%TEMP%\7zipsfx.000\vccorlib120.dll
%TEMP%\7zipsfx.000\ulxmlrpcpp.dll
%TEMP%\7zipsfx.000\trueimage.exe
%TEMP%\7zipsfx.000\tib_mounter.dll
%TEMP%\7zipsfx.000\tib_api.dll
%TEMP%\7zipsfx.000\thread_pool.dll
%TEMP%\7zipsfx.000\snapman.sys
%TEMP%\7zipsfx.000\snapapi.dll
%TEMP%\7zipsfx.000\rpc_client.dll
%TEMP%\7zipsfx.000\resource.dll
<DRIVERS>\snapman.sys
%TEMP%\7zipsfx.000\oem_doc_source.dll
%TEMP%\7zipsfx.000\msvcp120.dll
%TEMP%\7zipsfx.000\logging.dll
%TEMP%\7zipsfx.000\libssl10.dll
%TEMP%\7zipsfx.000\libcrypto10.dll
%TEMP%\7zipsfx.000\kb_link.dll
%TEMP%\7zipsfx.000\icudt38.dll
%TEMP%\7zipsfx.000\icu38.dll
%TEMP%\7zipsfx.000\fox.dll
%TEMP%\7zipsfx.000\fltsrv.sys
%TEMP%\7zipsfx.000\expat.dll
%TEMP%\7zipsfx.000\msvcr120.dll
<DRIVERS>\fltsrv.sys

Другое

Ищет следующие окна

ClassName: 'TRUEIMAGE_DUMMY_APPLICATION_WINDOW' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\trueimage.exe'
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "rpc_client.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\rpc_client.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "resource.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\resource.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "thread_pool.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\thread_pool.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "libcrypto10.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\libcrypto10.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "libssl10.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\libssl10.dll"
'<SYSTEM32>\reg.exe' Add HKLM\Software\Acronis\TrueImage /v "standard" /t REG_SZ /d " 12 98 20109108109 19 3120 23 15 96108 25 25109103120 27 96 24 96 96 30 7 4120 20 99 12 22 23 4 24 30120 18103108 4102 16 ...
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "icu38.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\icu38.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "auto_reactivate.bin" /T REG_SZ /D "%TEMP%\7ZipSfx.000\auto_reactivate.bin"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "ulxmlrpcpp.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\ulxmlrpcpp.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "expat.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\expat.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "mspack.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\mspack.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "tib_api.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\tib_api.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "tib_mounter.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\tib_mounter.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "auto_reactivate64.bin" /T REG_SZ /D "%TEMP%\7ZipSfx.000\auto_reactivate64.bin"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "kb_link.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\kb_link.dll"
'<SYSTEM32>\net1.exe' start snapman
'<SYSTEM32>\net.exe' start snapman
'<SYSTEM32>\sc.exe' create snapman type= kernel start= boot binpath= "System32\DRIVERS\snapman.sys"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "DisplayName" /T REG_SZ /D "Acronis Storage Filter Management"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Group" /T REG_SZ /D "Filter"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\fltsrv.sys"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Start" /T REG_DWORD /D "0"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Type" /T REG_DWORD /D "1"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Tag" /T REG_DWORD /D "2"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ErrorControl" /T REG_DWORD /D "0"
'<SYSTEM32>\sc.exe' create fltsrv type= kernel start= boot binpath= "System32\DRIVERS\fltsrv.sys"
'<SYSTEM32>\net1.exe' start fltsrv
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "DisplayName" /T REG_SZ /D "Acronis Snapshots Manager"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ErrorControl" /T REG_DWORD /D "1"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\snapman.sys"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Start" /T REG_DWORD /D "0"
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Type" /T REG_DWORD /D "1"
'<SYSTEM32>\net.exe' start fltsrv
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "oem_doc_source.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\oem_doc_source.dll"
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\TrueImageHome\Settings /f /v "ServiceDir" /T REG_SZ /D "%TEMP%\7ZipSfx.000\