Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\iexplore.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "URL" /t REG_SZ /d "http://www.google.com/search?q=##################################################################################################################" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "SuggestionsURL" /t REG_SZ /d "http://cl####s5.google.com/complete/search?q=###############################################################################################################################################" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Page" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Bar" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "ShowSearchSuggestions" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "DisplayName" /t REG_SZ /d "Google" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "Version" /t REG_DWORD /d 0x00000002 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "FaviconPath" /t REG_SZ /d "http://www.google.com/favicon.ico" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "OSDFileURL" /t REG_SZ /d "http://www.ie###lery.com/en-us/AddOns/DownloadAddOn?re############" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\67C334C0-408D-4E6D-B5A7-0ADD6AFFA252" /v "FaviconURL" /t REG_SZ /d "http://www.google.com/favicon.ico" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page Redirect Cache" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' Add "HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Iexplore.exe\shell\open\command" /ve /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\TabbedBrowsing" /v "NewTabPageShow" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' Add "HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" /ve /d ""%PROGRAM_FILES% (x86)\Google\Chrome\Application\chrome.exe"" /f
- '<SYSTEM32>\taskkill.exe' /f /IM firefox.exe
- '<SYSTEM32>\reg.exe' Add "HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command" /ve /d ""%PROGRAM_FILES% (x86)\Mozilla Firefox\firefox.exe"" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Default_Search_URL" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Page" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing" /v "NewTabPageShow" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Bar" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.google.com" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "UpgradeTime" /t REG_Binary /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "ShowSearchSuggestionsGlobal" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "DownloadUpdates" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "UpgradeTime" /t REG_Binary /d "0000" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "DisplayName" /t REG_SZ /d "Google" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "Version" /t REG_DWORD /d 0x00000002 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "DownloadRetries" /t REG_DWORD /d 0x00000000 /f
- '<SYSTEM32>\taskkill.exe' /f /IM iexplore.exe
- '<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp
- '<SYSTEM32>\reg.exe' DELETE "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /F
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "DisplayQuickPick" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes" /v "DefaultScope" /t REG_SZ /d "{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "FaviconPath" /t REG_SZ /d "http://www.google.com/favicon.ico" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "DisplayQuickPick" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "DefaultScope" /t REG_SZ /d "{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "DownloadRetries" /t REG_DWORD /d 0x00000000 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "ShowSearchSuggestionsGlobal" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "DownloadUpdates" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /F
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "OSDFileURL" /t REG_SZ /d "http://www.ie###lery.com/en-us/AddOns/DownloadAddOn?re############" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "FaviconURL" /t REG_SZ /d "http://www.google.com/favicon.ico" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "ShowSearchSuggestions" /t REG_DWORD /d 0x00000001 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "URL" /t REG_SZ /d "http://www.google.com/search?q=##################################################################################################################" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" /v "SuggestionsURL" /t REG_SZ /d "http://cl####s5.google.com/complete/search?q=###############################################################################################################################################" /f
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ztmp\tmp1243.exe
- %TEMP%\ztmp\tmp4664.bat
Удаляет следующие файлы:
- %TEMP%\ztmp\tmp1243.exe
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
