Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '<Полный путь к файлу>'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
изменяет следующие системные настройки:
- [HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'NoLogoff' = '00000001'
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'NoLogoff' = '00000001'
- [HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'NoClose' = '00000001'
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'NoClose' = '00000001'
- [HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'StartMenuLogOff' = '00000001'
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER] 'StartMenuLogOff' = '00000001'
удаляет теневые копии разделов.
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\wallpaper.bmp
- %CommonProgramFiles%\microsoft shared\ink\zh-cn\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\zh-tw\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\tr-tr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\th-th\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\uk-ua\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\sv-se\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\sk-sk\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\sl-si\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\ru-ru\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\nl-nl\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\ro-ro\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\pt-pt\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\pt-br\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\lv-lv\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\lt-lt\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\nb-no\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\msinfo\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\cultures\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\proof\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\office14\1033\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\ko-kr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\ja-jp\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\it-it\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\help\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\grphflt\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\filters\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\equation\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\euro\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\equation\1033\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\dw\readme_for_unlock.txt
- C:\perflogs\admin\readme_for_unlock.txt
- %CommonProgramFiles%\designer\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\readme_for_unlock.txt
- %CommonProgramFiles%\readme_for_unlock.txt
- %ProgramFiles%\readme_for_unlock.txt
- C:\perflogs\readme_for_unlock.txt
- C:\msocache\readme_for_unlock.txt
- C:\kms\readme_for_unlock.txt
- C:\documents and settings\readme_for_unlock.txt
- C:\readme_for_unlock.txt
- unc\127.0.0.1\pipe\srvsvc
- %CommonProgramFiles%\microsoft shared\ink\ar-sa\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\bg-bg\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\cs-cz\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\da-dk\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\hu-hu\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\hr-hr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\he-il\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fr-fr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\fi-fi\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\et-ee\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\de-de\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\es-es\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\el-gr\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\ink\hwrcustomization\readme_for_unlock.txt
- %CommonProgramFiles%\microsoft shared\smart tag\readme_for_unlock.txt
Перемещает следующие файлы
- %ProgramFiles%\java\jre1.8.0_45\copyright в %ProgramFiles%\java\jre1.8.0_45\copyright.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties в %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar в %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\currency.data в %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties в %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.crypt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa в %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.crypt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt в %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar в %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src в %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\classlist в %ProgramFiles%\java\jre1.8.0_45\lib\classlist.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties в %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.crypt
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt в %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.crypt
- %ProgramFiles%\java\jre1.8.0_45\readme.txt в %ProgramFiles%\java\jre1.8.0_45\readme.txt.crypt
- %ProgramFiles%\java\jre1.8.0_45\release в %ProgramFiles%\java\jre1.8.0_45\release.crypt
- %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt в %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.crypt
- %ProgramFiles%\java\jre1.8.0_45\license в %ProgramFiles%\java\jre1.8.0_45\license.crypt
- %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl в %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties в %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.crypt
- %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc в %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.crypt
Изменяет следующие файлы
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.manifest.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\pss10o.chm.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\pss10r.chm.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\psconfig.chm.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\pkeyconfig-office.xrm-ms.crypt
- %CommonProgramFiles%\microsoft shared\office14\1033\readme.htm.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\groovemui.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\infopathmui.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\setup.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\setup.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\excelmui.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\setup.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmuiset.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmui.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\setup.xml.crypt
- %CommonProgramFiles%\microsoft shared\office14\1033\ado210.chm.crypt
- %CommonProgramFiles%\microsoft shared\office14\muauth.cab.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.png.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.wpg.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.jpg.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.fnt.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.eps.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.cgm.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif.crypt
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.crypt
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg.crypt
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt.crypt
- %CommonProgramFiles%\microsoft shared\equation\mtextra.ttf.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\oct.chm.crypt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\officemui.xml.crypt
Изменяет множество файлов.
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
Подключается к
- '34.##9.100.209':443
- 'localhost':445
TCP
Другие
- 'localhost':445
- 'localhost':49183
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet (со скрытым окном)
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off (со скрытым окном)
