Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\2d74a540-89fe-4873-9e09-f84a18750f6b-4.job
- %WINDIR%\Tasks\2d74a540-89fe-4873-9e09-f84a18750f6b-3.job
- %WINDIR%\Tasks\2d74a540-89fe-4873-9e09-f84a18750f6b-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b-11.exe' /GVZdjyfdB=KgsWSaTL0zjCs8XDSY0p9JpfqPjRYlnmnKDFPLxBIFtwpdUAZpH3Dn03BWMwpaLZvT2UR6jZZ57VsL3UIrpiqmqhB75MG8gLDgiXZ1OCZzjY4PUH5McYb2d56m/FrOn0YD1o4JqlkB73FojPwXNR9TKRXQ9KCMLIHRDmWWdmalsVxOITXNgjdnrLKiSpP3Z+2Z26gCu0TfEwg9029RnSF8W58FgKGldOyy45uIxPQ/c8R7Pabd2iyupa3/fSf/AricQKZt67UCYtdZv2l/FCvhxhK2Y8YtjXc8FyUNLAgjvXKabgwXrb0IQiPxtKsLk2aa1pvH9V3HGOd+tHp57jQQsJQ3zFvBMnWNpLeBzPrnVgx/D5yLVP3/YYpcF8PKUKc0l5nl0RjP0EhrW5SpEwk4LeIGqVPJMBz/ngSpyCbg/FXGzfhhG5A6063s42VGE6pXFFgz0dOCV1vbJuu0l7qqBBgg8fcgHeX2/53co13Ke0YpWAxJbI3Fe/nw4OOmVbiZObJOpUfTpkDlhmmrfmPY3k5MoQ2GQ+y8KiIdep3GHf26xltBjpLe7Z410zuA6Z7ngkVnq0AYNR04n5iGZxSqwXUZKXF41Vx6XIVjhtgJeKXINEu4hU2kaU7OixQYjgeOwUMs2ebilpVnbGQZW8q+S6sp5CJNfTiO/8rD+nhN9CGtWBiA7J0PKSLQHOpOLRzQygyLpd51KZIZ+JNASw/Kalomj9V6gYJ/TNO06tlLz4ychSN9IdAsnsiRSxenhjtizYKpyRFdDc7P5vmwc6LbvuDdOy9r80ofh+nWmF8iYitCTt6rmZ+kk0D8gQafC3WEgijaLReU34M5wXqHgfW2d89uYn/KG9Tg+lrGs9dOV9geUUAmvv+Z1jQDLXjaM/KVRpwBP37p0aBfAtSRodhrJEd75bCM3tklz3xnQ3jI2zCf/OW/AfMSqd5vKnAL0Gl+i4mp/IW62yvIosHgfMyF68m4cFpjgSmv8pezLDEOo//Xya37b6xVV/Ol6tVwpypn4EH0jXw2PIH35e4SRYnOrZsdRaeoC6r3/A+2fCLVBlVZDLEYj8xuhoFYpYp5sgilMGzOEd4qwEJTvZ4eu2dlbhXTpsIgRpFHeuJ2QStxhx9I1t9sEONDeikVsCyVvAFv9dumTuxm0VEv6FvEPP3EV+BJFMNf2238dgrbD7fm+ucA4IFpfw/loUsRxkldFmLvOQN3Sk0pIvtUKKlxAv/a/XD9PkM2F6J/cbzuGhgMFjELHpq33JASWpeUJIuxYxqaBYuxJc97Gwyn2BEWlrwVcKn80SJdLw2B6zJIRCm+hxFpyhuw3DDa/+GfXOl/FoG4cmhV3xwawsx6+CXSBBCnKs6t1VGGrMS6cn4U5C0LqQ4B+mPf73CLgOc7VTuVqADj8RFI21ZQOBaQq/CD/gHQTXa06n4a5VCg+JHFDKsoxoHjkdyTcUssDn0B8eZl81kpIv0e17QKsHMazk+vuJNNWpdJpnHWpPHM5M+8kLF8MckkmNBwoEiYJmhsIfROLFcaJBJfhaG8dF8yrFXG5migt+hGy3EyZ+SlPiHyMGghTfJC3vzj0eUzrBqTvf51Wc20Oklqv9W1FKdVRg1uVgGgjdBTELryuQVlhG4PN0IsGKJ/coIBwZEM/bp2iyu1R05NFZxIJPNDzgsnqujEfFAyDuBlg+tMM7RMPVwX1PUuU=
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b-3.exe' /GVZdjyfdB=KZqzlDpOSbZN9gvJwF0tmDkOBR3reUCS9qccdg2RvWGJohRTg8+BRc6XwA72FG7i6XRKEVn+/BnuzP6E5H7K1OEXJK7Ju+W4zloZd4vK/UGi4R0dUb6McxhXVmWL2DtYLMkH/nw+TL9IIRyerxsy+86YlCg4rGxpKuQQQMW3Asw6oDJ07zguoW7grhl1znCl9aI3iQX9rNEB3S0lChGKGrLguX7guYDk0ecDjB42JbYnTki/QE1UX87Vw1AofoONYd5zMPVOfQLbIZMiJti6Im+KTpnhE65ShGSbxf3Z/+8xouWYLqFgykE/TaPthrZU2zZ1u5RwDpN2yT76EXBweiQBVRZ9m5K+QPfuuHtU71dK7vNRVUgAjVMDLikn+oW4sCBgWpftf+iTa3mB5kuiqkvDeb1xmJ1Emaw0HFud/TjQo4iM9jaPQz32ouFqFlUPT87SfkmU2QoI96U29/esmx0ODApFoqGPxZOhen0OT2JO0cM0d5L4pskc78krErZ6YcySGvVuNBXvgS29ZJjfu27Bdmu5HkuHvOD+/fKySzRJeK51tWWqcIUvnODnNHGMWZc1aCLwKNtSh9AP1QQW5l4dJqycwemGV9Jn5nmuQLg9JAWTgOQ64yBoyyNSwCKsbBVa9zdXvwoduPMLLzMDV7qg7TAOkN4AnHHFLQwuZ20rH1wuesjJfW5yGykd2nyN9PRmjI8q3JgQuChqt4+EFvjR9a08y6ea3zsJFlvU5W2MPxcYZpJWyg5tPkLmU+SJnY/ET3wcHd3Siifda4MdXiJY5aTOqFcti/URUX7dzEnt/ORP6W2GGf/caRLm3WbsnRKJpQeTsOWEJof8zpFJx8cue/xzN7C58BjH03P6EKxMlWZT4zv3QbnpUJrt5b49jtIZgulOOWyDFygpKNMo0qp3lry2NMdtyDvEdz14qkLTg9xppyQKkEDdeGSKRRoj56dp7pdLfNfjCPLaBUKLqKYPRl3wYnhfQG2Rg+JdP2EnElXFN0pzgAovw37jj4BnoQLQjaeGYiPpPS+thyiDPIWPCNs+1n7yo+G+6IUdN0II7jQ4vX7eESkQUYAgvkCwmMuF4/GL4ADmcuB1aoMRESewLnvH9dsCeHLxIzKfZfqVw6Xmdi3gKCEnGxp7PI5yUYPOsDrEWVdPUtdy6d9r70xb4tVmY/+TfWPwcR8k3Z9JPVbtOOixuLw/9D+gSxb7O7QfDz6ycZpEE48oBd6BK2bicl4ZuUeLm/z84WqW6y1OkE7Yi5GaqOBNnocVHggFK2PrtyLcORUL8YrLwMxD/N84Yyf+w9kPXAfnzYCljIp6m4L8k+3IcnKhSVAKz0LSl3saGhhO2zV+eI3YHLOLYQ2xzBAn/p3RtOYoH80BIMBjIa/aJs4bTiprXQNd01OKWsJOrWMMX+UnTmPB4+BfBIj5E33PMn3E/d5cAPYVgGqW1n7UMXzNsb6ocoXzNfS2p116ecYhmpYP2tVdzC9G7kkuTEqjcxjZqn1zjH4hy8zQEI9bc55xJemdtbuzrxGq
- '%TEMP%\nsj3.tmp\Rvoklxcgiezdbc.exe'
- '%TEMP%\comh.398886\GoogleUpdate.exe' /silent /install "appguid={5222f4ef-038d-494f-ac22-6e703f55b0f8}&appname=1334ae76-a46d-4585-8958-e6836dbff499&needsadmin=True&lang=en"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsj6.tmp\ExecDos.dll
- %TEMP%\Cab7.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b.crx
- %PROGRAM_FILES%\free__ven\2126cf68-efb3-4435-9cd9-f813fcd5e406.crx
- %PROGRAM_FILES%\free__ven\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\free__ven\58a6b77b-4731-4f0b-bfd1-14d6849ae7ab.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b-3.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b-4.exe
- %PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %TEMP%\Cab9.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\free__ven\2d74a540-89fe-4873-9e09-f84a18750f6b-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabB.tmp
- %TEMP%\nsj6.tmp\InstallerUtils2.dll
- %TEMP%\nsj6.tmp\InstallerUtils.dll
- %TEMP%\nsj6.tmp\System.dll
- %TEMP%\nsj6.tmp\nsisos.dll
- %TEMP%\nsj6.tmp\inetc.dll
- %TEMP%\nsj6.tmp\UserInfo.dll
- %TEMP%\nsj6.tmp\md5dll.dll
- %TEMP%\nsj6.tmp\StdUtils.dll
- %TEMP%\nsj3.tmp\Hkklxbdppmih.tmp
- %TEMP%\nsj3.tmp\System.dll
- %TEMP%\nse2.tmp
- %TEMP%\nsj3.tmp\WrapperUtils.dll
- %TEMP%\nsz5.tmp
- %TEMP%\nsj3.tmp\StdUtils.dll
- %TEMP%\nsj3.tmp\Rvoklxcgiezdbc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\comh.398886\goopdate.dll
- %TEMP%\comh.398886\GoogleUpdateOnDemand.exe
- %TEMP%\comh.398886\GoogleUpdateHelper.msi
- %TEMP%\comh.398886\goopdateres_en.dll
- %TEMP%\comh.398886\psuser.dll
- %TEMP%\comh.398886\psmachine.dll
- %TEMP%\comh.398886\npGoogleUpdate4.dll
- %TEMP%\comh.398886\GoogleUpdateBroker.exe
- %TEMP%\nsj6.tmp\419696
- %PROGRAM_FILES%\free__ven\utils.exe
- %TEMP%\nsj6.tmp\update.json
- %TEMP%\nsj6.tmp\93647
- %TEMP%\comh.398886\GoogleUpdate.exe
- %TEMP%\comh.398886\GoogleCrashHandler.exe
- %PROGRAM_FILES%\free__ven\Uninstall.exe
Удаляет следующие файлы:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsj6.tmp\93647
- %TEMP%\Cab7.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##fogenservice.com':80
- 'up####.#nfogenservice.com':80
- 'er####.#nfogenservice.com':80
- 'st###.##fogenservice.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nfogenservice.com/installer_updates/001082/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##fogenservice.com
- DNS ASK up####.#nfogenservice.com
- DNS ASK er####.#nfogenservice.com
- DNS ASK st###.##fogenservice.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
