Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsmC478.tmp\BI\BI.exe' { "user_ie_security_level" : "Medium-High" , "json_send_time" : "27/6/2013 16:19:41:21" , "internal_error_description" : "HttpPost result: try1- No xml response file %TEMP%\nsmC478.tmp\offer.xml; try2- No xml response file %TEMP%\nsmC478.tmp\offer.xml; try3- No xml response file %TEMP%\nsmC478.tmp\offer.xml" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "443554" , "general_status_code" : "3" , "duration_details" : " InitPluginsDir:32 initializeParams:452 load_BITool:94 send_BI_Init:140 load_DownloadACC:140 retrieveUISource:16 unpack_webappfolder:16 unpack_icon:140 RetrieveMainOfferKey:0 unpack_OpenCandyDll:468 unpack_BunndleDll:78 load_webapphost:16 unpack_ProxyInstaller:124 navigate_loadingUI:1030 navigateAsync_constMainOffer:16 BuildUserProfile:109 retrieve cid:15 callService1:30171 callService1:9890 callService1:8970 " , "phase_duration" : "" , "error_details" : "Error Parsing the offer xml response file. InternalRetryNum: 3. XMLParseErrReason: No xml response file %TEMP%\nsmC478.tmp\offer.xml" , "result" : "Error" , "user_operating_system_bits" : "32" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.0.8112.16421" , "user_default_browser_version" : "" , "user_default_browser" : "FIREFOX.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Enterprise" , "revision_number" : "3" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130801.02" , "bundle_id" : "6f1a633a-c1c9-4eba-be2d-fa8412efb74c" , "machine_user_id" : "{EDDD533F-9B9C-4F55-87C6-10F68E9EC92D}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "3123B286-5507-41A3-98ED-F0971A6D2F53" , "publisher_internal_id" : "61" , "publisher_id" : "Conduit Long Tail" , "publisher_account_id" : "ConduitLongTail" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
- '%TEMP%\nsmC478.tmp\BI\BI.exe' { "json_send_time" : "27/6/2013 16:18:49:619" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "443554" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "3" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130801.02" , "bundle_id" : "6f1a633a-c1c9-4eba-be2d-fa8412efb74c" , "machine_user_id" : "{EDDD533F-9B9C-4F55-87C6-10F68E9EC92D}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "3123B286-5507-41A3-98ED-F0971A6D2F53" , "publisher_internal_id" : "61" , "publisher_id" : "Conduit Long Tail" , "publisher_account_id" : "ConduitLongTail" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
Запускает на исполнение:
- '<SYSTEM32>\wsqmcons.exe'
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
- '<SYSTEM32>\schtasks.exe' /delete /f /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader"
- '<SYSTEM32>\sc.exe' start w32time task_started
- '<SYSTEM32>\sdclt.exe' /CONFIGNOTIFICATION
- '<SYSTEM32>\taskhost.exe' $(Arg0)
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\info_48[1]
- %TEMP%\nsmC478.tmp\xml.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\errorPageStrings[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\errorPageStrings[1]
- %TEMP%\nsmC478.tmp\offer.xml
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\bullet[2]
- %TEMP%\nss9472.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\bullet[1]
- C:\ProgramData\Microsoft\RAC\Temp\sqlBA1B.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB98E.tmp
- %TEMP%\nsx9483.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\background_gradient[2]
- %TEMP%\nsmC478.tmp\OCSetupHlp.dll
- %TEMP%\nsmC478.tmp\icon.png
- %TEMP%\nsmC478.tmp\Failed.htm
- %TEMP%\nssCBA8.tmp
- %TEMP%\nsmC478.tmp\ProxyInstallerDir\ProxyInstaller.exe
- %TEMP%\nsmC478.tmp\BunndleOfferManager.dll
- %TEMP%\nsmC478.tmp\webapphost.dll
- %TEMP%\nsmC478.tmp\System.dll
- %TEMP%\nsmC429.tmp
- %TEMP%\nsmC478.tmp\DownloadAcc\DownloadAcc.exe
- %TEMP%\nsmC478.tmp\DM_loader.gif
- %TEMP%\nsmC478.tmp\BI\BI.exe
- %TEMP%\nsmCBC8.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\443360[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\ErrorPageTemplate[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\443360[1]
- %TEMP%\nsmC478.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\443360[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\443360[1]
Удаляет следующие файлы:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\errorPageStrings[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\ErrorPageTemplate[1]
- %TEMP%\nsx9483.tmp\inetc.dll
- C:\ProgramData\Microsoft\RAC\Temp\sqlBA1B.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlB98E.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\background_gradient[2]
- %TEMP%\nsmCBC8.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\bullet[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\ErrorPageTemplate[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\info_48[1]
Сетевая активность:
Подключается к:
- 'of######.#######.distributionengine.conduit-services.com':80
- 'cm#.########tionengine.conduit-services.com':80
- 'localhost':59708
TCP:
Запросы HTTP GET:
- cm#.########tionengine.conduit-services.com//MainOffer/443360/?Cu####################################################
- cm#.########tionengine.conduit-services.com//Global/ProgressBar/443360/
- cm#.########tionengine.conduit-services.com//Global/Failed/443360/
- cm#.########tionengine.conduit-services.com//Global/Succuess/443360/
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK ti##.#indows.com
- DNS ASK of######.#######.distributionengine.conduit-services.com
- DNS ASK cm#.########tionengine.conduit-services.com
- DNS ASK ud#.###duit-data.com
Другое:
Ищет следующие окна:
- ClassName: 'CicLoaderWndClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_WebCheckMonitor' WindowName: '(null)'
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
