Trojan.Inject6.7222

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\moderntweaker_sa.exe
%TEMP%\content\1644-3212-moderntweaker_sa.exe-08-26-08-456.dump
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\appxprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\assocprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\cbsprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dismcore.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dismcoreps.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dismhost.exe
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dismprov.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dmiprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\appxprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\assocprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\cbsprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\dismcore.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\dismprov.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\dmiprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\ffuprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\folderprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\genericprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\ibsprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\imagingprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\intlprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\logprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\msiprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\offlinesetupprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\osprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\provprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\setupplatformprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\smiprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\sysprepprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\transmogprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\unattendprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\vhdprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\en-us\wimprovider.dll.mui
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\ffuprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\folderprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\genericprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\ibsprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\imagingprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\intlprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\logprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\msiprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\offlinesetupprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\osprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\provprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\setupplatformprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\smiprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\sysprepprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\transmogprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\unattendprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\vhdprovider.dll
%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\wimprovider.dll
nul

Другое

Создает и запускает на исполнение

'%TEMP%\moderntweaker_sa.exe'
'%TEMP%\e39f9749-37b3-4c40-b2f2-d836f92b91d5\dismhost.exe' {876676AD-DEF8-479F-9B1A-07EEC4A7A1B6}

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c powercfg -l
'<SYSTEM32>\powercfg.exe' -l
'<SYSTEM32>\cmd.exe' /c DISM.exe /Online /Get-ReservedStorageState
'<SYSTEM32>\dism.exe' /Online /Get-ReservedStorageState
'<SYSTEM32>\cmd.exe' /c fsutil behavior query DisableLastAccess
'<SYSTEM32>\fsutil.exe' behavior query DisableLastAccess
'<SYSTEM32>\cmd.exe' /c fsutil behavior query DisableDeleteNotify
'<SYSTEM32>\fsutil.exe' behavior query DisableDeleteNotify
'<SYSTEM32>\cmd.exe' /c bcdedit /enum {default}
'<SYSTEM32>\bcdedit.exe' /enum {default}
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NoL -NonI -EP Bypass Set-Alias ngen ( Join-Path( [Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory() ) ngen.exe );[AppDomain]::CurrentDomain.GetAssemblies() | Where { $_.L...
'%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe' Display %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll
'<SYSTEM32>\wbem\wmiapsrv.exe'
'<SYSTEM32>\cmd.exe' /c wmic PATH Win32_videocontroller GET description
'<SYSTEM32>\wbem\wmic.exe' PATH Win32_videocontroller GET description
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' (get-appxpackage -allusers).name
'<SYSTEM32>\cmd.exe' /c "@chcp 65001 >nul & @for /f "tokens=5,6 delims=, " %a in ('compact.exe "%SystemDrive%\ProgramData\*.xml" /a /i ^| find "Professional.xml"') do @if %a%b GTR 10 (@cls & @echo true) else (@cls ...
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\cmd.exe' /c compact.exe "%ALLUSERSPROFILE%\*.xml" /a /i | find "Professional.xml"
'<SYSTEM32>\compact.exe' "%ALLUSERSPROFILE%\*.xml" /a /i
'<SYSTEM32>\find.exe' "Professional.xml"
'<SYSTEM32>\cmd.exe' /c chcp 65001 & cls & compact /compactOS:query
'<SYSTEM32>\compact.exe' /compactOS:query
'<SYSTEM32>\cmd.exe' /c "@chcp 65001 >nul & @for /f "tokens=5,6 delims=, " %a in ('compact.exe "%WINDIR%\WinSxS\*.xml" /a /i ^| find "Professional.xml"') do @if %a%b GTR 10 (@cls & @echo true) else (@cls & @echo fa...
'<SYSTEM32>\cmd.exe' /c compact.exe "%WINDIR%\WinSxS\*.xml" /a /i | find "Professional.xml"
'<SYSTEM32>\compact.exe' "%WINDIR%\WinSxS\*.xml" /a /i