Trojan.StartPage.60005

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'safe' = '%WINDIR%\safe.vbs'

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\f5desk.exe' /pid=2460
'%WINDIR%\attrib.exe'
'%WINDIR%\f5desk.exe' "%APPDATA%\2345.COM\url.ini" /c /p everyone:f
'%WINDIR%\attrib.exe' /pid=3632
'%WINDIR%\attrib.exe' 127.0.0.1 -n 2
'%WINDIR%\attrib.exe' /pid=284
'%WINDIR%\attrib.exe' /pid=3904
'%WINDIR%\attrib.exe' /pid=300
'%WINDIR%\f5desk.exe' /pid=2712
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\url.ini" /c /p everyone:f
'%WINDIR%\attrib.exe' /pid=1520
'%WINDIR%\attrib.exe' /pid=3528
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\desk.exe" -s -h -r
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\desk.exe" +r
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\url.ini" +r
'%WINDIR%\desk.exe'
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\url.ini" -s -h -r
'%WINDIR%\f5desk.exe'
'%WINDIR%\attrib.exe' /S /D /c" echo y"
'%WINDIR%\f5desk.exe' /pid=3456
'%WINDIR%\attrib.exe' /pid=3400
'%WINDIR%\attrib.exe' "%APPDATA%\2345.COM\desk.exe" /c /p everyone:f
'%WINDIR%\attrib.exe' /pid=3300

Запускает на исполнение:

'<SYSTEM32>\ping.exe' "%APPDATA%\2345.COM\desk.exe" /c /p everyone:f
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\url.ini" -s -h -r
'<SYSTEM32>\cacls.exe' /pid=3576
'<SYSTEM32>\ping.exe' /pid=3952
'<SYSTEM32>\cacls.exe' /pid=3856
'<SYSTEM32>\cacls.exe' /pid=3736
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\desk.exe" -s -h -r
'<SYSTEM32>\cacls.exe' /S /D /c" echo y"
'<SYSTEM32>\attrib.exe'
'<SYSTEM32>\ping.exe' /pid=3516
'<SYSTEM32>\cacls.exe' /pid=3440
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\desk.exe" +r
'<SYSTEM32>\cacls.exe' /pid=3992
'<SYSTEM32>\attrib.exe' /pid=764
'<SYSTEM32>\ping.exe' /pid=3108
'<SYSTEM32>\cacls.exe'
'<SYSTEM32>\cacls.exe' /pid=1364
'<SYSTEM32>\cacls.exe' /pid=3468
'<SYSTEM32>\ping.exe' /pid=3256
'<SYSTEM32>\cacls.exe' /pid=2768
'<SYSTEM32>\ping.exe' /pid=2784
'<SYSTEM32>\ping.exe' /pid=2516
'<SYSTEM32>\attrib.exe' /pid=3032
'<SYSTEM32>\cacls.exe' /pid=3016
'<SYSTEM32>\attrib.exe' /S /D /c" echo y"
'<SYSTEM32>\attrib.exe' "%APPDATA%\2345.COM\desk.exe" +r
'<SYSTEM32>\attrib.exe' "%PROGRAM_FILES%\CoralExplorer\2345.exe" -s -h -r
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\CoralExplorer\2345.exe" /c /p everyone:f
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\DESKTOP\2345═°╓╖╡╝║╜.lnk" -s-h -r
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\╫└├ц\Internet Explorer.lnk" +r
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\╫└├ц\Internet Explorer.lnk" -s -h -r
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\╫└├ц\Internet Explorer.lnk" /c /p everyone:f
'%WINDIR%\regedit.exe' -s %WINDIR%\drivers.sys
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\sdly.bat" "
'<SYSTEM32>\wscript.exe' "%WINDIR%\sdly.vbs"
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\DESKTOP\2345═°╓╖╡╝║╜.lnk" /c /p everyone:f
'<SYSTEM32>\reg.exe' DELETE HKCR\piffile /v IsShortcut /f
'<SYSTEM32>\reg.exe' DELETE HKCR\lnkfile /v IsShortcut /f
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\╫└├ц\Internet Explorer.lnk" /c /p everyone:r
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\desk.exe" /c /p everyone:r
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\desk.exe" /c /p everyone:f
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\url.ini" /c /p everyone:r
'<SYSTEM32>\cacls.exe' /pid=2984
'<SYSTEM32>\attrib.exe' /pid=2936
'<SYSTEM32>\cacls.exe' /pid=2560
'<SYSTEM32>\attrib.exe' "c:\users\public\desktop\Internet Explorer.lnk" +r
'<SYSTEM32>\attrib.exe' "c:\users\public\desktop\Internet Explorer.lnk" -s -h -r
'<SYSTEM32>\cacls.exe' "c:\users\public\desktop\Internet Explorer.lnk" /c /p everyone:f
'<SYSTEM32>\cacls.exe' "%APPDATA%\2345.COM\url.ini" /c /p everyone:f
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
'<SYSTEM32>\cacls.exe' "c:\users\public\desktop\Internet Explorer.lnk" /c /p everyone:r