Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SystemProcess' = '%APPDATA%\SystemProcess.exe'
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\systemprocess.exe
- %WINDIR%\syswow64\biocredprov.dll.enc
- %WINDIR%\syswow64\bitsadmin.exe.enc
- %WINDIR%\syswow64\bitsperf.dll.enc
- %WINDIR%\syswow64\bitsprx2.dll.enc
- %WINDIR%\syswow64\bitsprx3.dll.enc
- %WINDIR%\syswow64\bitsprx4.dll.enc
- %WINDIR%\syswow64\bitsprx5.dll.enc
- %WINDIR%\syswow64\bitsprx6.dll.enc
- %WINDIR%\syswow64\blackbox.dll.enc
- %WINDIR%\syswow64\boot.sdi.enc
- %WINDIR%\syswow64\bootcfg.exe.enc
- %WINDIR%\syswow64\authz.dll.enc
- %WINDIR%\syswow64\bootvid.dll.enc
- %WINDIR%\syswow64\browcli.dll.enc
- %WINDIR%\syswow64\browseui.dll.enc
- %WINDIR%\syswow64\bthprops.cpl.enc
- %WINDIR%\syswow64\bthudtask.exe.enc
- %WINDIR%\syswow64\btpanui.dll.enc
- %WINDIR%\syswow64\bubbles.scr.enc
- %WINDIR%\syswow64\bwcontexthandler.dll.enc
- %WINDIR%\syswow64\bwunpairelevated.dll.enc
- %WINDIR%\syswow64\cabinet.dll.enc
- %WINDIR%\syswow64\cabview.dll.enc
- %WINDIR%\syswow64\cacls.exe.enc
- %WINDIR%\syswow64\calc.exe.enc
- %WINDIR%\syswow64\bcryptprimitives.dll.enc
- %WINDIR%\syswow64\bopomofo.uce.enc
- %WINDIR%\syswow64\bidispl.dll.enc
- %WINDIR%\syswow64\bdaplgin.ax.enc
- %WINDIR%\syswow64\bcrypt.dll.enc
- %WINDIR%\syswow64\batmeter.dll.enc
- %WINDIR%\syswow64\audioeng.dll.enc
- %WINDIR%\syswow64\audiokse.dll.enc
- %WINDIR%\syswow64\audioses.dll.enc
- %WINDIR%\syswow64\auditnativesnapin.dll.enc
- %WINDIR%\syswow64\auditpol.exe.enc
- %WINDIR%\syswow64\auditpolicygpinterop.dll.enc
- %WINDIR%\syswow64\auditpolmsg.dll.enc
- %WINDIR%\syswow64\authfwcfg.dll.enc
- %WINDIR%\syswow64\authfwgp.dll.enc
- %WINDIR%\syswow64\authfwsnapin.dll.enc
- %WINDIR%\syswow64\authfwwizfwk.dll.enc
- %WINDIR%\syswow64\capiprovider.dll.enc
- %WINDIR%\syswow64\authui.dll.enc
- %WINDIR%\syswow64\atmlib.dll.enc
- %WINDIR%\syswow64\autochk.exe.enc
- %WINDIR%\syswow64\autofmt.exe.enc
- %WINDIR%\syswow64\autoplay.dll.enc
- %WINDIR%\syswow64\auxiliarydisplayapi.dll.enc
- %WINDIR%\syswow64\auxiliarydisplaycpl.dll.enc
- %WINDIR%\syswow64\avicap32.dll.enc
- %WINDIR%\syswow64\avifil32.dll.enc
- %WINDIR%\syswow64\avrt.dll.enc
- %WINDIR%\syswow64\azman.msc.enc
- %WINDIR%\syswow64\azroles.dll.enc
- %WINDIR%\syswow64\azroleui.dll.enc
- %WINDIR%\syswow64\azsqlext.dll.enc
- %WINDIR%\syswow64\attrib.exe.enc
- %WINDIR%\syswow64\basecsp.dll.enc
- %WINDIR%\syswow64\autoconv.exe.enc
- %WINDIR%\syswow64\audiodev.dll.enc
- %WINDIR%\syswow64\capisp.dll.enc
- %WINDIR%\syswow64\cca.dll.enc
- %WINDIR%\syswow64\clfsw32.dll.enc
- %WINDIR%\syswow64\cliconfg.dll.enc
- %WINDIR%\syswow64\cliconfg.exe.enc
- %WINDIR%\syswow64\cliconfg.rll.enc
- %WINDIR%\syswow64\clip.exe.enc
- %WINDIR%\syswow64\clusapi.dll.enc
- %WINDIR%\syswow64\cmcfg32.dll.enc
- %WINDIR%\syswow64\cmd.exe.enc
- %WINDIR%\syswow64\cmdial32.dll.enc
- %WINDIR%\syswow64\cmdkey.exe.enc
- %WINDIR%\syswow64\cmdl32.exe.enc
- %WINDIR%\syswow64\cmicryptinstall.dll.enc
- %WINDIR%\syswow64\cipher.exe.enc
- %WINDIR%\syswow64\cmifw.dll.enc
- %WINDIR%\syswow64\cmlua.dll.enc
- %WINDIR%\syswow64\cmmon32.exe.enc
- %WINDIR%\syswow64\cmpbk32.dll.enc
- %WINDIR%\syswow64\cmstp.exe.enc
- %WINDIR%\syswow64\cmstplua.dll.enc
- %WINDIR%\syswow64\cmutil.dll.enc
- %WINDIR%\syswow64\cngaudit.dll.enc
- %WINDIR%\syswow64\cngprovider.dll.enc
- %WINDIR%\syswow64\cnvfat.dll.enc
- %WINDIR%\syswow64\colbact.dll.enc
- %WINDIR%\syswow64\colorcnv.dll.enc
- %WINDIR%\syswow64\colorcpl.exe.enc
- %WINDIR%\syswow64\clbcatq.dll.enc
- %WINDIR%\syswow64\cleanmgr.exe.enc
- %WINDIR%\syswow64\clb.dll.enc
- %WINDIR%\syswow64\cintlgnt.ime.enc
- %WINDIR%\syswow64\api-ms-win-core-threadpool-l1-1-0.dll.enc
- %WINDIR%\syswow64\cdosys.dll.enc
- %WINDIR%\syswow64\cero.rs.enc
- %WINDIR%\syswow64\certcli.dll.enc
- %WINDIR%\syswow64\certcredprovider.dll.enc
- %WINDIR%\syswow64\certenc.dll.enc
- %WINDIR%\syswow64\certenroll.dll.enc
- %WINDIR%\syswow64\certenrollctrl.exe.enc
- %WINDIR%\syswow64\certenrollui.dll.enc
- %WINDIR%\syswow64\certmgr.dll.enc
- %WINDIR%\syswow64\certmgr.msc.enc
- %WINDIR%\syswow64\certpoleng.dll.enc
- %WINDIR%\syswow64\catsrv.dll.enc
- %WINDIR%\syswow64\catsrvut.dll.enc
- %WINDIR%\syswow64\catsrvps.dll.enc
- %WINDIR%\syswow64\certreq.exe.enc
- %WINDIR%\syswow64\cfgmgr32.dll.enc
- %WINDIR%\syswow64\chajei.ime.enc
- %WINDIR%\syswow64\charmap.exe.enc
- %WINDIR%\syswow64\chcp.com.enc
- %WINDIR%\syswow64\chkdsk.exe.enc
- %WINDIR%\syswow64\chkntfs.exe.enc
- %WINDIR%\syswow64\choice.exe.enc
- %WINDIR%\syswow64\chsbrkr.dll.enc
- %WINDIR%\syswow64\chtbrkr.dll.enc
- %WINDIR%\syswow64\chxreadingstringime.dll.enc
- %WINDIR%\syswow64\cic.dll.enc
- %WINDIR%\syswow64\certutil.exe.enc
- %WINDIR%\syswow64\cewmdm.dll.enc
- %WINDIR%\syswow64\cfgbkend.dll.enc
- %WINDIR%\syswow64\atmfd.dll.enc
- %WINDIR%\syswow64\atl110.dll.enc
- %WINDIR%\syswow64\atl100.dll.enc
- %WINDIR%\syswow64\adsldp.dll.enc
- %WINDIR%\syswow64\adsldpc.dll.enc
- %WINDIR%\syswow64\adsmsext.dll.enc
- %WINDIR%\syswow64\adsnt.dll.enc
- %WINDIR%\syswow64\adtschema.dll.enc
- %WINDIR%\syswow64\advapi32.dll.enc
- %WINDIR%\syswow64\advpack.dll.enc
- %WINDIR%\syswow64\aecache.dll.enc
- %WINDIR%\syswow64\aeevts.dll.enc
- %WINDIR%\syswow64\alttab.dll.enc
- %WINDIR%\syswow64\amcompat.tlb.enc
- %WINDIR%\syswow64\amstream.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-io-l1-1-0.dll.enc
- %WINDIR%\syswow64\amxread.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-console-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-datetime-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-debug-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-delayload-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-errorhandling-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-fibers-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-file-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-file-l1-2-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-file-l2-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-handle-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-heap-l1-1-0.dll.enc
- %WINDIR%\syswow64\admparse.dll.enc
- %WINDIR%\syswow64\adaptertroubleshooter.exe.enc
- %WINDIR%\syswow64\adprovider.dll.enc
- %WINDIR%\syswow64\actxprxy.dll.enc
- %WINDIR%\syswow64\activeds.tlb.enc
- %APPDATA%\ransomware_flag.txt
- %HOMEPATH%\desktop\cveuropeo.doc.enc
- %HOMEPATH%\desktop\dashborder_120.bmp.enc
- %HOMEPATH%\desktop\dashborder_96.bmp.enc
- %HOMEPATH%\desktop\default.bmp.enc
- %HOMEPATH%\desktop\desktop.ini.enc
- %HOMEPATH%\desktop\dialmap.bmp.enc
- %HOMEPATH%\desktop\fi51.doc.enc
- %HOMEPATH%\desktop\google chrome.lnk.enc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.enc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.enc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.enc
- %WINDIR%\syswow64\api-ms-win-core-interlocked-l1-1-0.dll.enc
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.enc
- %WINDIR%\syswow64\apds.dll.enc
- %HOMEPATH%\desktop\telegram.lnk.enc
- %WINDIR%\syswow64\12520437.cpx.enc
- %WINDIR%\syswow64\12520850.cpx.enc
- %WINDIR%\syswow64\aaclient.dll.enc
- %WINDIR%\syswow64\accessibilitycpl.dll.enc
- %WINDIR%\syswow64\acctres.dll.enc
- %WINDIR%\syswow64\acledit.dll.enc
- %WINDIR%\syswow64\aclui.dll.enc
- %WINDIR%\syswow64\acppage.dll.enc
- %WINDIR%\syswow64\actioncenter.dll.enc
- %WINDIR%\syswow64\actioncentercpl.dll.enc
- %WINDIR%\syswow64\activeds.dll.enc
- %HOMEPATH%\desktop\skypesetup.exe.enc
- %HOMEPATH%\desktop\contosoroot.cer.enc
- %HOMEPATH%\downloads\desktop.ini.enc
- %WINDIR%\syswow64\admtmpl.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-libraryloader-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-time-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-eventing-provider-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-security-base-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-security-lsalookup-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-security-sddl-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-service-core-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-service-management-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-service-management-l2-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-service-winsvc-l1-1-0.dll.enc
- %WINDIR%\syswow64\apilogen.dll.enc
- %WINDIR%\syswow64\apircl.dll.enc
- %WINDIR%\syswow64\apisetschema.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-string-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-localization-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-utility-l1-1-0.dll.enc
- %WINDIR%\syswow64\apphelp.dll.enc
- %WINDIR%\syswow64\appmgmts.dll.enc
- %WINDIR%\syswow64\appmgr.dll.enc
- %WINDIR%\syswow64\appwiz.cpl.enc
- %WINDIR%\syswow64\apss.dll.enc
- %WINDIR%\syswow64\arp.exe.enc
- %WINDIR%\syswow64\asferror.dll.enc
- %WINDIR%\syswow64\aspnet_counters.dll.enc
- %WINDIR%\syswow64\asycfilt.dll.enc
- %WINDIR%\syswow64\at.exe.enc
- %WINDIR%\syswow64\atbroker.exe.enc
- %WINDIR%\syswow64\atl.dll.enc
- %WINDIR%\syswow64\apphlpdm.dll.enc
- %WINDIR%\syswow64\appidapi.dll.enc
- %WINDIR%\syswow64\appidpolicyengineapi.dll.enc
- %WINDIR%\syswow64\cmipnpinstall.dll.enc
- %WINDIR%\syswow64\colorui.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-process-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-localregistry-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-memory-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-misc-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-namedpipe-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-processenvironment-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-processthreads-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-processthreads-l1-1-1.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-profile-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-rtlsupport-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-string-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-synch-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-synch-l1-2-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-runtime-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-stdio-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-sysinfo-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-util-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-xstate-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-xstate-l2-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-conio-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-convert-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-environment-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-filesystem-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-heap-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-locale-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-math-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-multibyte-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-crt-private-l1-1-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-localization-l1-2-0.dll.enc
- %WINDIR%\syswow64\api-ms-win-core-timezone-l1-1-0.dll.enc
- %WINDIR%\syswow64\comcat.dll.enc
Удаляет следующие файлы
- %WINDIR%\syswow64\aspnet_counters.dll
- %WINDIR%\syswow64\atl100.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\concrt140d.dll
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
