Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'CTS' = '%WINDIR%\CTS.exe'
Заражает следующие исполняемые файлы
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\delegate_execute.exe
- %HOMEPATH%\desktop\calc.exe
- %APPDATA%\telegram desktop\updater.exe
- %APPDATA%\telegram desktop\unins000.exe
- %APPDATA%\telegram desktop\telegram.exe
- %TEMP%\content\1872-3492-powershell.exe-18-46-18-318.dump
- %LOCALAPPDATA%\microsoft\onedrive\onedrivestandaloneupdater.exe
- %LOCALAPPDATA%\microsoft\onedrive\onedrive.exe
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\onedrivesetup.exe
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\filesyncconfig.exe
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\filecoauth.exe
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
- <Имя диска съемного носителя>:\notepad.exe
- <Имя диска съемного носителя>:\calc.exe
- %LOCALAPPDATA%\google\chrome\application\chrome.exe
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl64.exe
- <Имя диска съемного носителя>:\skypesetup.exe
- <Имя диска съемного носителя>:\tcm851ax32.exe
- <Имя диска съемного носителя>:\chromesetup.exe
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\setup.exe
- <Имя диска съемного носителя>:\winmine.exe
- <Имя диска съемного носителя>:\dotnetfx45_full_setup.exe
- <Имя диска съемного носителя>:\jre-7u75-windows-i586-iftw.exe
- <Имя диска съемного носителя>:\wrar520.exe
- %HOMEPATH%\desktop\skypesetup.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\5tju8fg0tvyr25w.exe
- %TEMP%\7zs8deba7ac\core\platform.ini
- %TEMP%\7zs8deba7ac\core\pingsender.exe
- %TEMP%\7zs8deba7ac\core\omni.ja
- %TEMP%\7zs8deba7ac\core\nssdbm3.dll
- %TEMP%\7zs8deba7ac\core\nssdbm3.chk
- %TEMP%\7zs8deba7ac\core\nssckbi.dll
- %TEMP%\7zs8deba7ac\core\nss3.dll
- %TEMP%\7zs8deba7ac\core\msvcp140.dll
- %TEMP%\7zs8deba7ac\core\mozglue.dll
- %TEMP%\7zs8deba7ac\core\mozavutil.dll
- %TEMP%\7zs8deba7ac\core\mozavcodec.dll
- %TEMP%\7zs8deba7ac\core\minidump-analyzer.exe
- %TEMP%\7zs8deba7ac\core\maintenanceservice_installer.exe
- %TEMP%\7zs8deba7ac\core\dependentlibs.list
- %TEMP%\7zs8deba7ac\core\maintenanceservice.exe
- %TEMP%\7zs8deba7ac\core\libegl.dll
- %TEMP%\7zs8deba7ac\core\lgpllibs.dll
- %TEMP%\7zs8deba7ac\core\ia2marshal.dll
- %TEMP%\7zs8deba7ac\core\gmp-clearkey\0.1\manifest.json
- %TEMP%\7zs8deba7ac\core\gmp-clearkey\0.1\clearkey.dll.sig
- %TEMP%\7zs8deba7ac\core\gmp-clearkey\0.1\clearkey.dll
- %TEMP%\7zs8deba7ac\core\freebl3.dll
- %TEMP%\7zs8deba7ac\core\freebl3.chk
- %TEMP%\7zs8deba7ac\core\fonts\twemojimozilla.ttf
- %TEMP%\7zs8deba7ac\core\firefox.visualelementsmanifest.xml
- %TEMP%\7zs8deba7ac\core\firefox.exe.sig
- %TEMP%\7zs8deba7ac\core\firefox.exe
- %TEMP%\7zs8deba7ac\core\dictionaries\en-us.dic
- %TEMP%\7zs8deba7ac\core\libglesv2.dll
- %TEMP%\7zs8deba7ac\core\dictionaries\en-us.aff
- %TEMP%\7zs8deba7ac\core\plugin-container.exe
- %TEMP%\nstfb10.tmp\system.dll
- %WINDIR%\softwaredistribution\sls\855e8a7c-ecb4-4ca3-b045-1dfa50104289\tmpc10f.tmp
- %WINDIR%\softwaredistribution\sls\855e8a7c-ecb4-4ca3-b045-1dfa50104289\sls.cab
- %WINDIR%\softwaredistribution\sls\9482f4b4-e343-43b6-b170-9a65bc822c77\tmpbcb9.tmp
- %WINDIR%\softwaredistribution\sls\9482f4b4-e343-43b6-b170-9a65bc822c77\sls.cab
- %TEMP%\nstfb10.tmp\modern-header.bmp
- %TEMP%\nstfb10.tmp\modern-wizard.bmp
- %TEMP%\nstfb10.tmp\installoptions.dll
- %TEMP%\nstfb10.tmp\iospecial.ini
- %TEMP%\nstfb10.tmp\summary.ini
- %TEMP%\nstfb10.tmp\extensions.ini
- %TEMP%\nstfb10.tmp\components.ini
- %TEMP%\nstfb10.tmp\shortcuts.ini
- %TEMP%\nstfb10.tmp\options.ini
- %TEMP%\7zs8deba7ac\core\plugin-hang-ui.exe
- %TEMP%\7zs8deba7ac\core\plugin-container.exe.sig
- %TEMP%\7zs8deba7ac\setup.exe
- %TEMP%\7zs8deba7ac\core\xul.dll.sig
- %TEMP%\7zs8deba7ac\core\xul.dll
- %TEMP%\7zs8deba7ac\core\vcruntime140.dll
- %TEMP%\7zs8deba7ac\core\updater.ini
- %TEMP%\7zs8deba7ac\core\updater.exe
- %TEMP%\7zs8deba7ac\core\update-settings.ini
- %TEMP%\7zs8deba7ac\core\uninstall\helper.exe
- %TEMP%\7zs8deba7ac\core\ucrtbase.dll
- %TEMP%\7zs8deba7ac\core\softokn3.dll
- %TEMP%\7zs8deba7ac\core\softokn3.chk
- %TEMP%\7zs8deba7ac\core\qipcap.dll
- %TEMP%\7zs8deba7ac\core\precomplete
- %TEMP%\nstfb10.tmp\uac.dll
- %TEMP%\7zs8deba7ac\core\defaults\pref\channel-prefs.js
- %TEMP%\7zs8deba7ac\core\d3dcompiler_47.dll
- %TEMP%\7zs8deba7ac\core\crashreporter.ini
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\accessiblemarshal.dll
- %TEMP%\7zs8deba7ac\core\accessiblehandler.dll
- %TEMP%\7zs8deba7ac\core\accessible.tlb
- %WINDIR%\cts.exe
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\crashreporter.exe
- %TEMP%\7zs8deba7ac\core\browser\blocklist.xml
- %TEMP%\7zs8deba7ac\core\browser\visualelements\visualelements_70.png
- %TEMP%\7zs8deba7ac\core\browser\visualelements\visualelements_150.png
- %TEMP%\7zs8deba7ac\core\browser\omni.ja
- %TEMP%\7zs8deba7ac\core\browser\features\webcompat@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\webcompat-reporter@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\screenshots@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\onboarding@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\formautofill@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\followonsearch@mozilla.com.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\firefox@getpocket.com.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\aushelper@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\features\activity-stream@mozilla.org.xpi
- %TEMP%\7zs8deba7ac\core\browser\crashreporter-override.ini
- %TEMP%\7zs8deba7ac\core\breakpadinjector.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\application.ini
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\7zs8deba7ac\core\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\softwaredistribution\sls\8b24b027-1dee-babb-9a95-3517dfb9c552\sls.cab
- %WINDIR%\softwaredistribution\sls\8b24b027-1dee-babb-9a95-3517dfb9c552\tmpc854.tmp
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\powershell.exe.log
- %TEMP%\content\1872-3492-powershell.exe-18-46-16-723.dump
- %TEMP%\content\1872-3492-powershell.exe-18-46-17-493.dump
- %TEMP%\content\1872-3492-powershell.exe-18-46-17-749.dump
- %TEMP%\content\1872-3492-powershell.exe-18-46-17-869.dump
- %TEMP%\content\1872-3492-powershell.exe-18-46-18-017.dump
- %TEMP%\content\1872-3492-powershell.exe-18-46-18-672.dump
- %TEMP%\content\2916-844-powershell.exe-18-42-13-077.dump
- %TEMP%\content\2916-844-powershell.exe-18-42-13-561.dump
Сетевая активность
UDP
- DNS ASK settings-win.data.microsoft.com
Другое
Создает и запускает на исполнение
- '%TEMP%\5tju8fg0tvyr25w.exe'
- '%WINDIR%\cts.exe'
- '%TEMP%\7zs8deba7ac\setup.exe'
