BAT.Drop.2722

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\startmbr.bat

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zs06733fe1\xls.bat
nul
%TEMP%\xls.exe
%TEMP%\e_n60005\krnln.fnr
%APPDATA%\mbr.bat
%APPDATA%\cxk-nmsl\cxk-nmsl.bat
%APPDATA%\cxk-nmsl\fuze.bat
%HOMEPATH%\desktop\google chrome.lnk.cxk_nmsl
%HOMEPATH%\desktop\notepad.exe.cxk_nmsl

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Ищет следующие окна

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\xls.exe'
'%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\CXK-NMSL\CXK-NMSL.bat" ::' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7zS06733FE1\xls.bat" "
'%WINDIR%\syswow64\certutil.exe' -encode "dashBorder_120.bmp.cxkdata" "dashBorder_120.bmp.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "dial.bmp.cxkdata" "dial.bmp.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "dialmap.bmp.cxkdata" "dialmap.bmp.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "Google Chrome.lnk.cxkdata" "Google Chrome.lnk.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "hanni_umami_chapter.doc.cxkdata" "hanni_umami_chapter.doc.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "iTunesHelpUnavailable.htm.cxkdata" "iTunesHelpUnavailable.htm.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "join.avi.cxkdata" "join.avi.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "nwfieldnotes1966.docx.cxkdata" "nwfieldnotes1966.docx.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "trivial-merge.htm.cxkdata" "trivial-merge.htm.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "pmd.cer.cxkdata" "pmd.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "pushkin.jpeg.cxkdata" "pushkin.jpeg.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "SDKSamplePrivDeveloper.cer.cxkdata" "SDKSamplePrivDeveloper.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "sdszfo.docx.cxkdata" "sdszfo.docx.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "Telegram.lnk.cxkdata" "Telegram.lnk.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "testEE.cer.cxkdata" "testEE.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "thlps_keeper_mayer_1965.docx.cxkdata" "thlps_keeper_mayer_1965.docx.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "correct.avi.cxkdata" "correct.avi.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "notepad.exe.cxkdata" "notepad.exe.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "contosoroot_1.cer.cxkdata" "contosoroot_1.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "210252809.jpeg.cxkdata" "210252809.jpeg.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -decode "%TEMP%\7zS06733FE1\xls.bat" "%TEMP%\xls.exe"
'%WINDIR%\syswow64\cmd.exe' /c %APPDATA%\CXK-NMSL\fuze.bat
'%WINDIR%\syswow64\cmd.exe' /K CXK-NMSL.bat
'%WINDIR%\syswow64\mshta.exe' vbscript:createobject("shell.application").shellexecute("""CXK-NMSL.bat""","::",,"runas",0)(window.close)
'%WINDIR%\syswow64\cmd.exe' /C "%APPDATA%\CXK-NMSL\CXK-NMSL.bat" :
'%WINDIR%\syswow64\certutil.exe' -encode "000814251_video_01.avi.cxkdata" "000814251_video_01.avi.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "2.jpeg.cxkdata" "2.jpeg.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "3.jpeg.cxkdata" "3.jpeg.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "contoso.cer.cxkdata" "contoso.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "4f0bf7ff71f28.jpg.cxkdata" "4f0bf7ff71f28.jpg.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "508softwareandos.doc.cxkdata" "508softwareandos.doc.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "about.htm.cxkdata" "about.htm.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "adadsi.html.cxkdata" "adadsi.html.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "alert.html.cxkdata" "alert.html.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "archer.avi.cxkdata" "archer.avi.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "browse.htm.cxkdata" "browse.htm.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "contosoroot.cer.cxkdata" "contosoroot.cer.cxk_nmsl"
'%WINDIR%\syswow64\certutil.exe' -encode "uep_form_786_bulletin_1726i602.doc.cxkdata" "uep_form_786_bulletin_1726i602.doc.cxk_nmsl"