Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%UUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU
- %WINDIR%VVVVVVVVVVVVVVVVVVVVVVVVVVVV.VVV
- %WINDIR%SSSSSSSSSSSSSSSSSSSSSSSSSSSS.SSS
- %WINDIR%TTTTTTTTTTTTTTTTTTTTTTTTTTTT.TTT
- %WINDIR%YYYYYYYYYYYYYYYYYYYYYYYYYYYY.YYY
- <SYSTEM32>\dllcache\12520437.cpx.new
- %WINDIR%WWWWWWWWWWWWWWWWWWWWWWWWWWWW.WWW
- %WINDIR%XXXXXXXXXXXXXXXXXXXXXXXXXXXX.XXX
- %WINDIR%MMMMMMMMMMMMMMMMMMMMMMMMMMMM.MMM
- %WINDIR%NNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNN
- %WINDIR%KKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKK
- %WINDIR%LLLLLLLLLLLLLLLLLLLLLLLLLLLL.LLL
- %WINDIR%QQQQQQQQQQQQQQQQQQQQQQQQQQQQ.QQQ
- %WINDIR%RRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR
- %WINDIR%OOOOOOOOOOOOOOOOOOOOOOOOOOOO.OOO
- %WINDIR%PPPPPPPPPPPPPPPPPPPPPPPPPPPP.PPP
- <SYSTEM32>\dllcache\aclui.dll.new
- C:\ProgramData\09180321364\BK2_09180322107823.dlls
- <SYSTEM32>\dllcache\accwiz.exe.new
- <SYSTEM32>\dllcache\acledit.dll.new
- C:\ProgramData\09180321364\DB1_09180322108952.dlls
- C:\ProgramData\09180321364\S1_09180322101209.dlls
- C:\ProgramData\09180321364\S2_09180322104514.dlls
- C:\ProgramData\09180321364\BK1_09180322107823.dlls
- C:\RECYCLER\S-1-5-18\desktop.ini
- <SYSTEM32>\dllcache\6to4svc.dll.new
- C:\ProgramData\09180321362\091803213614.dll
- <SYSTEM32>\dllcache\12520850.cpx.new
- <SYSTEM32>\dllcache\access.cpl.new
- <SYSTEM32>\dllcache\acctres.dll.new
- C:\RECYCLER\S-1-5-18\INFO2
- <SYSTEM32>\dllcache\aaaamon.dll.new
- %WINDIR%JJJJJJJJJJJJJJJJJJJJJJJJJJJJ.JJJ
- <SYSTEM32>\acctres.dll.new
- <SYSTEM32>\accwiz.exe.new
- <SYSTEM32>\aaaamon.dll.new
- <SYSTEM32>\access.cpl.new
- C:\ProgramData\09180321364\09180321368.dlls
- C:\ProgramData\09180321364\09180321367.dlls
- <SYSTEM32>\acledit.dll.new
- <SYSTEM32>\aclui.dll.new
- C:\ProgramData\09180321363\svchost.exe
- C:\ProgramData\09180321365\svchost.exe
- C:\09180321366\howtodecryptaesfiles.htm
- <SYSTEM32>\12520850.cpx.new
- <SYSTEM32>\6to4svc.dll.new
- C:\09180321361\lsass86vl.exe
- <SYSTEM32>\12520437.cpx.new
- %WINDIR%DDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD
- %WINDIR%EEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEE
- %WINDIR%BBBBBBBBBBBBBBBBBBBBBBBBBBBB.BBB
- %WINDIR%CCCCCCCCCCCCCCCCCCCCCCCCCCCC.CCC
- %WINDIR%HHHHHHHHHHHHHHHHHHHHHHHHHHHH.HHH
- %WINDIR%IIIIIIIIIIIIIIIIIIIIIIIIIIII.III
- %WINDIR%FFFFFFFFFFFFFFFFFFFFFFFFFFFF.FFF
- %WINDIR%GGGGGGGGGGGGGGGGGGGGGGGGGGGG.GGG
- C:\ProgramData\09180321362\091803213611.bat
- %ALLUSERSPROFILE%\Desktop\091803213611.lnk
- C:\ProgramData\09180321362\091803213610.txt
- %ALLUSERSPROFILE%\Desktop\032152.lnk
- <SYSTEM32>\wblsys32vt86exkdll.dll
- %WINDIR%AAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAA
- %ALLUSERSPROFILE%\Desktop\NOT_SNT.ntuser.dat.crashlog.txt
- C:\09180321366\howtodecryptaesfiles2.htm
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSamSs] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\ProgramData\09180321365\svchost.exe' -p 20 -q "<SYSTEM32>\wblsys32vt86exkdll.dll" /accepteula
- '<SYSTEM32>\lsassw86s.exe'
- '<SYSTEM32>\lsassw86s.exe' -i
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "LogEvent" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config wscsvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' config WinDefend start= "disabled"
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeKernelFaults" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ShowUI" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeShutdownErrs" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeMicrosoftApps" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableQueue" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableArchive" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "AllOrNone" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "ForceQueue" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\sc.exe' stop SDRSVC
- '<SYSTEM32>\sc.exe' config wuauserv start= "disabled"
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config MsMpSvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop MsMpSvc
- '<SYSTEM32>\sc.exe' config SDRSVC start= "disabled"
- '<SYSTEM32>\sc.exe' stop RemoteRegistry
- '<SYSTEM32>\sc.exe' config VSS start= "disabled"
- '<SYSTEM32>\sc.exe' stop VSS
- '<SYSTEM32>\sc.exe' config winmgmt start= "disabled"
- '<SYSTEM32>\sc.exe' stop winmgmt
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= "disabled"
- '<SYSTEM32>\sc.exe' stop wercplsupport
- '<SYSTEM32>\sc.exe' config WerSvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop WerSvc
- '<SYSTEM32>\sc.exe' config SCPolicySvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop SCPolicySvc
- '<SYSTEM32>\sc.exe' config wercplsupport start= "disabled"
- '<SYSTEM32>\sc.exe' stop Acronis VSS Provider
- '<SYSTEM32>\sc.exe' config SCVSSService start= "disabled"
- '<SYSTEM32>\sc.exe' stop SCVSSService
- '<SYSTEM32>\sc.exe' config swprv start= "disabled"
- '<SYSTEM32>\sc.exe' stop swprv
- '<SYSTEM32>\sc.exe' config Acronis VSS Provider start= "disabled"
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\default2.sfx
- <SYSTEM32>\decryptaesfiles.htm
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- <SYSTEM32>\sdelete.dll
- <SYSTEM32>\wblsys32vt86exkdll.dll
- <SYSTEM32>\lsassw86s.exe
- <SYSTEM32>\cfwin32.dll
- <SYSTEM32>\btlogoffusrsmtv.bat
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\09180321361\lsass86vl.exe
- C:\RECYCLER\S-1-5-18\desktop.ini
- C:\ProgramData\09180321365\svchost.exe
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- C:\ProgramData\09180321363\svchost.exe
Удаляет следующие файлы:
- <SYSTEM32>\aclui.dll
- <SYSTEM32>\activeds.dll
- <SYSTEM32>\acelpdec.ax
- <SYSTEM32>\acledit.dll
- %WINDIR%ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
- C:\RECYCLER\S-1-5-18\desktop.ini
- C:\09180321366\howtodecryptaesfiles.htm
- C:\09180321366\howtodecryptaesfiles2.htm
- <SYSTEM32>\12520850.cpx
- <SYSTEM32>\6to4svc.dll
- <SYSTEM32>\$winnt$.inf
- <SYSTEM32>\12520437.cpx
- <SYSTEM32>\acctres.dll
- <SYSTEM32>\accwiz.exe
- <SYSTEM32>\aaaamon.dll
- <SYSTEM32>\access.cpl
Сетевая активность:
Подключается к:
- '17#.#02.38.67':3120
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'Connections Tray'
- <Служебный элемент>
- ClassName: '' WindowName: 'Tiny H-Pot v1.7'
- ClassName: '' WindowName: 'Power Meter'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'Program Manager'
- ClassName: '' WindowName: 'MS_WebcheckMonitor'
- ClassName: '' WindowName: '<SYSTEM32>\cscript.exe'
- ClassName: '' WindowName: 'CiceroUIWndFrame'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
- ClassName: '' WindowName: '<WINDOWS_KILLER>'
- ClassName: '' WindowName: '<Служебное имя>1 (x32) - build Aug 25 2014'
- ClassName: '' WindowName: '<Служебное имя>'
