Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|AgentCustomInstallAction.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|System.Management.Automation.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|WindowsServiceManager.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|WindowsServiceManager.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Agent|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|System.Management.Automation.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|System.Management.Automation.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|WindowsServiceManager.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|AgentCustomInstallAction.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV4|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV4|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV3|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV4|StartAgent.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Utopic|UAgentService.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Utopic|UtopicAgent.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV4|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Utopic|UAgentCustomInstallAction.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV3|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|Utopic.Server.ServiceHost.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|AgentCustomInstallAction.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|System.Management.Automation.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV3|StartAgent.exe" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|UtopicV3|Utopic.Server.Contracts.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|Utopic.Server.Services.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic|WindowsServiceManager.dll" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\Installer\Assemblies\C:|Program Files|Utopic Software|Utopic Agent|AgentCustomInstallAction.dll" /f
- '<SYSTEM32>\net1.exe' stop "Utopic Agent Version 2"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Agent Version 2" /f
- '<SYSTEM32>\net1.exe' stop "Utopic Agent"
- '<SYSTEM32>\net.exe' stop "Utopic Agent Version 2"
- '<SYSTEM32>\sc.exe' DELETE "Utopic Agent"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Service Host" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Agent Version 2"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Agent" /f
- '<SYSTEM32>\net.exe' stop "Utopic Agent"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 4 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v ScheduledInstallDay /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\batchfile.bat" "
- '<SYSTEM32>\mode.com' con: cols=75 lines=40
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings" /f
- '<SYSTEM32>\taskkill.exe' /f /im "iexplore.exe"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v ScheduledInstallTime /t REG_DWORD /d 4 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v IncludeRecommendedUpdates /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Policy Publisher Version 2" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Policy Publisher Version 2"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Handler Version 2" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Handler Version 2"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Policy Publisher Service" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Policy Publisher Service"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Policy Publisher" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Policy Publisher"
- '<SYSTEM32>\sc.exe' DELETE "Utopic Handler Service"
- '<SYSTEM32>\sc.exe' DELETE "Utopic Agent Service"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Handler" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Service Host"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Agent Service" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Handler 2"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Handler Service" /f
- '<SYSTEM32>\sc.exe' DELETE "Utopic Handler"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Utopic Handler 2" /f
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\batchfile.bat
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
