Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\mfe1.tmp\FrmInst.exe' /FramePkg /OriginalFramePkg="<Полный путь к вирусу>" /Cleanup="%TEMP%\mfe1.tmp" /LOGDIR="%TEMP%\McAfeeLogs" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword=""
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding A7FC2753BAD9714D57DFBBC063F5B612
- '<SYSTEM32>\msiexec.exe' -Embedding D1AD0F3491AD2E897DDC5122BEE1D981 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe'
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_hover.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_up.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\checked.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_down.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\allow.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\bidirectional.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_disabled.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\checkmark.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\disallow.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\document.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_open_pressed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_close_normal.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_close_pressed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_open_normal.png
- %PROGRAM_FILES%\McAfee\Common Framework\UpdateSubSys.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubsystem.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UserSpace.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe
- %PROGRAM_FILES%\McAfee\Common Framework\AgentPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Agent.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayEventLog.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\advisory_dlg.ini
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\advisory_dlg.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayErrorLoggingPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McAfeeWin32GUISupportDLL.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\tray_menu_issue.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\tray_menu_okay.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\unchecked.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\trailer.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_error_medium.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_ok_medium.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_warning_medium.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayInstSupp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayInterfaceLib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayLegacySupportPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\grip.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\group_folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\inbound.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gray_checked.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\folder_open.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gradated_background.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gradated_background_with_mcafee_logo.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\main_window.ini
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\plus_sign.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\rule_folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\splashscreen.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\outbound.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\mcafee_m_small.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\minus_sign.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\no_symbol.png
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %TEMP%\mfe1.tmp\FrmInst.exe
- %TEMP%\mfe1.tmp\MFEagent.msi
- %TEMP%\mfe1.tmp\reqseckey.bin
- %TEMP%\mfe1.tmp\cleanup.exe
- %TEMP%\McAfeeLogs\FrmInst_CRNJEUFU.log
- %TEMP%\mfe1.tmp\__temp.zip
- %TEMP%\mfe1.tmp\cabinet.dll
- %TEMP%\mfe1.tmp\SiteList.xml
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\main.txt
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\mfe1.tmp\srpubkey.bin
- %TEMP%\McAfeeLogs\MFEagent.msi.2014.04.16.18.25.39.log
- %WINDIR%\Installer\2c980.msi
- C:\Config.Msi\2c983.rbs
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\sitelist.xml
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\sitelist_srpubkey.bin
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\sitelist_reqseckey.bin
- %WINDIR%\Installer\MSIB.tmp
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentUserInterface.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Genevtinf3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager.dll
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
- %PROGRAM_FILES%\McAfee\Common Framework\UpdPlug.Dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %WINDIR%\Installer\MSI6.tmp
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\reqseckey.bin
- %TEMP%\{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}\srpubkey.bin
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
Удаляет следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
