Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineCore.job
- %WINDIR%\Tasks\globalUpdateUpdateTaskMachineUA.job
- %WINDIR%\Tasks\ef5937cf-3303-4935-ad62-5ba58491aa66-4.job
- %WINDIR%\Tasks\ef5937cf-3303-4935-ad62-5ba58491aa66-3.job
- %WINDIR%\Tasks\ef5937cf-3303-4935-ad62-5ba58491aa66-11.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\globalUpdate] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66-11.exe' /tSwlxNC=RYy9ajtOUJS8K76FdC58CNc1Gjy2i4HWeSoq12qOFUqD0Pw+QJEHorSJSi8+/qHDUVKxwwwVG6qRdxi62OK4Wvx+sPgYu+EeU/5huwJSfCqQGXSNcolGxqHFELppk63lRtI02yQxydjeXzAwLpHPNs3NdYq/JuHQwtW2ZSlVkJNclo+ReMI8wdjGiS9C8ZJBUYhvfMyJzl0kgFgTRmrmYoo/vukV3nqUdh2h3xPWlmuiBdWLeneHCzeoZKy9D0hL1umi01T5dhMmnNDZ17F1ZsZzUxMbcozb48JBCp4x7xzixHf1L9fqD+I7I2plzxhhMnkdvDplphFylBPRnf/jHi+thQcAzNZyPdBr6AO8M2LsAx5/Ax1R3caE16yvmvRU80bRtywrfB2iYRRaAiiysqfnLd4WqTO+SbE/3a/hrpo5gxaQLD1uKWA9G8IcCNT97Bk38gsjV5bNk3mye9n65WHCEf68zfbGyuChvomTxtykagF1ebuRYQNMAiFapaAGkT8pf9y4ce+d8Io2BM8Fo++0+Hd6fRE0PD2Sn+T6HwoeC5vqH0j4erDmHU/K40pVZnJtAjDBpuIVt4DMwakwDd2AiM/CW6v1hVASSlaLIesqskHZ7fdnmwgPXNEbSTq+Z5V4l7V3njjadajQ4Sv6mjfPEonAymQ9Mbhh47QwQaCQ8xNHhmw8r/8fMp2/5HHWubxHlfYal76IN2EeFK5tUsxoTjzJR5TT85bECJqlGGMD25yZIc+FFAsmg1AD4soh39K7axyUb+KDlou1xilBHvrDJglYN4EFnMNnSYAdIqMiFxsUi8lTsey96GVTCSMgPuD2upOY8mFwriQ+3J9lBLhu781gRdiO0+E0MsZ4b9FOm0tZPoVLAirqJUZxW5tnrZfKCp4ak19Oia390d/oZZqr6JVTnAz7tcIr9rX7B8s5Bye5woxz4qU1R5/RQbOoDP3WuiXSfJaMuNh7OeEVmk3jVRIMAGsD4Sich/20u56GuhgdGO8GPHb518ZFk6PPdSoEKRlIMrhmLDfyBGAZUszRM4zX+TrcGhMHaM7OtCeltauZ9CYFka9cCwbPjcABRLtPjHNRpVWaiYHdEJYQSUb+cGSu+lv6AheQS9j49+O/LlK4rhJw/21Ww2k3UM59E4VQqU8iV7R9s868NKffChFM3FYuep1e7yB1qEvtm93EQIjfRiTTvZXVZ/fiklGg2RavuoJ7WdOTfWwW8+iEzObUJprBI4sAgAnBCrpZEBA3ulkmsPwEWIv+YwjBMT/pRnd+PEhDYKq7KRQmZu7VGb6rLEU5zHXx2HCXWKmuRk/vA3av3jgyDLuw9PBNb3k5fa2Yg7ppDCDroJQuiVq7JW37uSGc5wiBl2qPP5OTFhalakVHNSmEjXqzrqmQ89CytG4QyHnCVRPZ2MSs7+wEC/gQY7+v2lPabdYISEiIWlDKZY6XazRRnq3dzirZYf4W2eYYL7I0Qz0kgKXilfF4txJ9N0LDpPMBfV2fWF8/LYArloa9CHeHPkVeOHLIEn5ePwIkG9kWkUTHboip3sKa05XE+/tUks9Tw2Y0u6e3FOboaIvWxcasCCOYtV3sZ4vaphvaZYZMCiaWjcqdGKW5CmcVVbakjCTLeSvAkM7o3gHcROqZcHJvhm3bjN+YGUZ/a326oAw0Sob3FZ9zeimXsgPvnwmHelURsiof9GeGpf5lOFdtXFC6eoLrjuvi/HsLAQdAavngv949+Mm1cm9676A1dJv25mxwm40kv/sSTO255B4afYQCaJndUp4V/h2ME7h00ay0nY0bd+lseiptHnrEg0CrX6NLUokMUDejQf9uMuErYxEatMUdNeqME/S0mJS4v2cB1yhh98+CMP2Twg==
- '%PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe' /regsvc
- '%PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66-3.exe' /tSwlxNC=AcLK21mAbMA1WScUCKM+hHLI29N2Esr6yB/aA9fdwRtYtpVzqdFSF1InIz215+GvS6J/7SZdUFQlGpnbYebwCf2SmhcfzvNVhiE/lPUZeNAFqi6ZEB8e0yGuVNohJuVuPSEiwejoRvBnBLcR0HZnduLiLjIoWL3N5Rm35qoaV2QVWpALMcvD8qTj74FMVYDVWjOW1DdUBjosFBByp4k0wMJ7tIminQpwZofyokiDjUlt2mTgZTanJjPjOAAmcu38jUpCEJwbGpopkQ+lCU3Wfor8h3dCbjvUy4+k8K/eQeSFaMYurk42PN9fHrxD0rikXBJSxvNXSHmaXby0q5lqQhqDEkPoiCYEQdJKc9t0DKul3nm/IAdeZPQHNDCK3Co1336RI/7CPVvAxKzLVZpajdwwt4pg4cqyvECg7TKhzn7RsALCHkq18s3vDeAFYGR4ii2z/U5vD1EVt8dYzrDqCxDhzVh+Jov6FzCJKLOJo1d2mBYQ5528ysFFx0m65WiGV1YgGRVatsC3688cEQTjuL2zANr55VQawzVmR/VQR1HVpJWC8P/2EnEcD9RblNvnWg3JV0lYUXyYr2Qnb2nZQi57c35x4CoucjEhaVPFI9svN75/Y4wTcQs2R8v7rY4hMjLeDZRdwrS9LX077HUekjj9o/JA07PwZVXXEnvAozOrg8mt7jE6X5UWdgx0owbNYTNMuW8Aa1OwY9TAPXLyZyHyDG++B7aeU37fMDOEhb4cHbXLt0ZAvMEEL5V2dafoPLbJhVbK611WffVvLvwCy2IDb2mXBkvrVcHc7cepJWGcTqBO46U+7NJAe0OeU9RrUPWwZ9pzs8iYIBlL2X1sRwplmDciRfYlFR6BhM02svGuqjDuM3Q2AB9NW0NX6smnT3EeG8Bfbjby5qBXkQQ9d9gZBp60CJFM+MMxGF0hAE06V/50l8EXUuMPtjQyX1BEOToF7KZm+5dwhMyxpWSYDTqIfO+O6A7yQlgjTsvynL6cto38AeGa7ax6nppNaWw/FoAa5x1bXJp4KN6d05gABrz06bKO3uP1XWTls3eOT+05/Zi0/wrI9o+nheTBEobda7PfM/EXKT4NyHf82WxX/uHE2apLtELcHMaU8pQyfZJSDXNIDE8DrTj0X++RNUccUDRoBhpKP83vvtaWpipBgchQ1ywt4jz+grBEiq2sUStnFcL5RLfS8CqW/FhCfaNTPKzK7BhVmxXdf3qgJHwdoYuWBPuSDoj8ikTZVzR0psubhuAh9NdLSkztM4fIo44L1iRN7Dabu39ce6iTraxTHIAOuu/N/2VYJF1/4kx/mGS827XMXgjH9j0r19J3dAgClLxY1nq1BDNuf4wDbhZqlWPN+PbChQ6GjzYel8UELYEGC3k6UTqrXNPGR/B+xXFyWs6zcHZICDJfeUfTfOezBHrc+gHVRPRFSuufQJ8dTKFNrfcxeLvQ7Szch5W0YURWoQKKim5Pkg9k783k/l8BpfC2Vk/eYE0Yx06R7MH3LAle22dQ7/9b0qaD+Msl6QKy
- '%TEMP%\nsx2.tmp\Wfhqugdwrhs.exe'
- '%TEMP%\comh.222137\GoogleUpdate.exe' /silent /install "appguid={20bd8347-ceea-43ba-8a18-4e6ad741ba68}&appname=f2967c61-0532-4700-b234-91b3e6c09907&needsadmin=True&lang=en"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Завершает или пытается завершить
следующие пользовательские процессы:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\C3E814D1CB223AFCD58214D14C3B7EAB
- %TEMP%\nsy5.tmp\ExecDos.dll
- %PROGRAM_FILES%\Cinema-Plus-1.2c\1293297481.mxaddon
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66.crx
- %PROGRAM_FILES%\Cinema-Plus-1.2c\b79e3d31-4954-4ccd-a026-7e97139560c6.crx
- %TEMP%\Cab6.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\Cinema-Plus-1.2c\d50dfecf-3e71-40c3-a48c-84b02d931f52.crx
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdate.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66-3.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll
- %PROGRAM_FILES%\globalUpdate\Update\GoogleUpdate.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66-4.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66.xpi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\psuser.dll
- %TEMP%\Cab8.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA
- %PROGRAM_FILES%\Cinema-Plus-1.2c\ef5937cf-3303-4935-ad62-5ba58491aa66-11.exe
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\goopdateres_en.dll
- %TEMP%\CabA.tmp
- %PROGRAM_FILES%\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe
- %TEMP%\nsy5.tmp\nsisos.dll
- %TEMP%\nsy5.tmp\InstallerUtils2.dll
- %TEMP%\nsy5.tmp\InstallerUtils.dll
- %TEMP%\nsy5.tmp\md5dll.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].json
- %TEMP%\nsy5.tmp\inetc.dll
- %TEMP%\nsy5.tmp\UserInfo.dll
- %TEMP%\nsy5.tmp\System.dll
- %TEMP%\nsx2.tmp\WrapperUtils.dll
- %TEMP%\nsx2.tmp\Bjlzhcd.tmp
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\nsx2.tmp\Wfhqugdwrhs.exe
- %TEMP%\nsy5.tmp\StdUtils.dll
- %TEMP%\nsd4.tmp
- %TEMP%\nsx2.tmp\StdUtils.dll
- %TEMP%\comh.222137\goopdate.dll
- %TEMP%\comh.222137\GoogleUpdateOnDemand.exe
- %TEMP%\comh.222137\GoogleUpdateHelper.msi
- %TEMP%\comh.222137\goopdateres_en.dll
- %TEMP%\comh.222137\psuser.dll
- %TEMP%\comh.222137\psmachine.dll
- %TEMP%\comh.222137\npGoogleUpdate4.dll
- %TEMP%\comh.222137\GoogleUpdateBroker.exe
- %TEMP%\nsy5.tmp\158761
- %PROGRAM_FILES%\Cinema-Plus-1.2c\utils.exe
- %TEMP%\nsy5.tmp\update.json
- %TEMP%\nsy5.tmp\151828
- %TEMP%\comh.222137\GoogleUpdate.exe
- %TEMP%\comh.222137\GoogleCrashHandler.exe
- %PROGRAM_FILES%\Cinema-Plus-1.2c\Uninstall.exe
Удаляет следующие файлы:
- %TEMP%\Cab8.tmp
- %TEMP%\CabA.tmp
- %TEMP%\nsy5.tmp\151828
- %TEMP%\Cab6.tmp
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'cr#.#hawte.com':80
- 'ts####.ws.symantec.com':80
- 'lo##.##fodatacloud.com':80
- 'up####.#nfodatacloud.com':80
- 'er####.#nfodatacloud.com':80
- 'st###.#nfodatacloud.com':80
TCP:
Запросы HTTP GET:
- cr#.#hawte.com/ThawteTimestampingCA.crl
- ts####.ws.symantec.com/tss-ca-g2.crl
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- up####.#nfodatacloud.com/installer_updates/001906/update.json
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
- DNS ASK ts####.ws.symantec.com
- DNS ASK lo##.##fodatacloud.com
- DNS ASK up####.#nfodatacloud.com
- DNS ASK er####.#nfodatacloud.com
- DNS ASK st###.#nfodatacloud.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
