Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Users\Public\Desktop\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Users\Public\Desktop\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe", "C:\Users\Public\Desktop\iexplore.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\explorer.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\explorer.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe", "C:\Users\Public\Desktop\iexplore.exe", "C:\MSOCach...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\System.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\System.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%WINDIR%\Globalization\Sorting\lsm.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%WINDIR%\Globalization\Sorting\lsm.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ChainServerComponentfont' = '"C:\ChainServerComponentfont.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'ChainServerComponentfont' = '"C:\ChainServerComponentfont.exe"'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\chainservercomponentfontc
- <SYSTEM32>\tasks\chainservercomponentfont
Изменения в файловой системе
Создает следующие файлы
- C:\1.bat
- %HOMEPATH%\desktop\oxqhxhmo.log
- %HOMEPATH%\desktop\hdfyodnw.log
- nul
- %TEMP%\kf7hza2cf7.bat
- %TEMP%\tjbbrml4ap
- %TEMP%\khvh51au.out
- %TEMP%\khvh51au.cmdline
- %TEMP%\khvh51au.0.cs
- %ProgramFiles(x86)%\internet explorer\signup\101b941d020240
- %ProgramFiles(x86)%\internet explorer\signup\lsm.exe
- C:\users\public\desktop\9db6e019d4f04e
- C:\users\public\desktop\iexplore.exe
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\7a0fd90576e088
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\explorer.exe
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\27d1bcfc3c54e0
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\system.exe
- %WINDIR%\globalization\sorting\101b941d020240
- %WINDIR%\globalization\sorting\lsm.exe
- C:\89ebe55430fdd5
- %HOMEPATH%\desktop\iotnnrvu.log
- %HOMEPATH%\desktop\rxmdxtbb.log
- %HOMEPATH%\desktop\dmaioabc.log
- %HOMEPATH%\desktop\elijsfcn.log
- C:\chainservercomponentfont.exe
- C:\chainservercomponentfont.sfx.exe
- %HOMEPATH%\desktop\gtisnowh.log
- %HOMEPATH%\desktop\feyxkzmk.log
Удаляет следующие файлы
- %TEMP%\khvh51au.cmdline
- %TEMP%\khvh51au.out
- %TEMP%\khvh51au.0.cs
- %TEMP%\tjbbrml4ap
Перемещает следующие файлы
- %ProgramFiles%\microsoft office\office14\bcssync.exe в %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Сетевая активность
Подключается к
- 'ot##l.top':80
TCP
Запросы HTTP POST
- http://ot##l.top/ExternalPipePollProcessormultitrafficWp.php
UDP
- DNS ASK ot##l.top
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- 'C:\chainservercomponentfont.sfx.exe' -p1234
- 'C:\chainservercomponentfont.exe'
- '%WINDIR%\globalization\sorting\lsm.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""C:\1.bat" "
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Kf7Hza2cf7.bat" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "ChainServerComponentfontC" /sc MINUTE /mo 6 /tr "'C:\ChainServerComponentfont.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "ChainServerComponentfont" /sc ONLOGON /tr "'C:\ChainServerComponentfont.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "ChainServerComponentfontC" /sc MINUTE /mo 10 /tr "'C:\ChainServerComponentfont.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'%WINDIR%\Globalization\Sorting\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%WINDIR%\Globalization\Sorting\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 7 /tr "'%WINDIR%\Globalization\Sorting\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Public\Desktop\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\iexplore.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\khvh51au.cmdline" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Internet Explorer\SIGNUP\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\ping.exe' -n 10 localhost
