Trojan.DownLoader11.34110

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' hwids *CC_01* *Raid*
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find hid*
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find =net
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find hdaudio*
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find usb*
'%WINDIR%\Logs\SysInfo\Tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\7za a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
'%WINDIR%\Logs\SysInfo\Tools\7za.exe' a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find acpi*
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' status *
'%WINDIR%\Logs\SysInfo\Tools\DevManView.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Devices.htm
'%WINDIR%\Logs\SysInfo\Tools\AppCrashView.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Crashes.htm
'%WINDIR%\Logs\SysInfo\Tools\SIV32X.exe' -SAVE[devices][device-ids][dimms][driver-vsn][environment][hw-status][interfaces][my-ip-address][overview][pnp-dev][processes][startup][software][system][uaa-dev]
'%WINDIR%\Logs\SysInfo\Tools\DriverView.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Drivers.htm
'%WINDIR%\Logs\SysInfo\Tools\BlueScreenView.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\!BSOD!.htm
'%WINDIR%\Logs\SysInfo\Tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
'%WINDIR%\Logs\SysInfo\Tools\devcon.exe' find pci*
'%WINDIR%\Logs\SysInfo\Tools\WhatInStartup.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Startup.htm
'%WINDIR%\Logs\SysInfo\Tools\WinAudit.exe' /r=gz /o=HTML

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
'<SYSTEM32>\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\DxDiag.txt

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Devices.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Drivers.htm
%TEMP%\Cab4.tmp
%WINDIR%\Logs\SysInfo\Tools\wput.exe
%WINDIR%\Logs\SysInfo\Tools\usbdevs.txt
%WINDIR%\Logs\SysInfo\Tools\pnpdevs.txt
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%WINDIR%\Logs\SysInfo\Tools\SIV_CRNJEUFU.txt
<SYSTEM32>\d3d9caps.dat
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\CRNJEUFU.html
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\HWIDs.txt
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\setupapi.log
%HOMEPATH%\My Documents\DRP-Log\CRNJEUFU_2014.09.23_r416.7z
%WINDIR%\Logs\SysInfo\SysInfo.7z
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\SIV_CRNJEUFU.txt
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Startup.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\!BSOD!.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Crashes.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\DxDiag.txt
%WINDIR%\Logs\SysInfo\Tools\HWIDs.txt
%WINDIR%\Logs\SysInfo\Tools\CRNJEUFU.html
%WINDIR%\Logs\SysInfo\Tools\pcmdevs.txt
%WINDIR%\Logs\SysInfo\Tools\DevManView.exe
%WINDIR%\Logs\SysInfo\Tools\CProcess.exe
%WINDIR%\Logs\SysInfo\Tools\BlueScreenView.exe
%WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
%WINDIR%\Logs\SysInfo\Tools\DriverView64.exe
%WINDIR%\Logs\SysInfo\Tools\DriverView.exe
%TEMP%\nsl3.tmp\modern-header.bmp
%TEMP%\nsl3.tmp\System.dll
%TEMP%\nsq2.tmp
%WINDIR%\Logs\SysInfo\Tools\AppCrashView.exe
%WINDIR%\Logs\SysInfo\Tools\7za.exe
%TEMP%\nsl3.tmp\nsProcess.dll
%WINDIR%\Logs\SysInfo\Tools\devcon.exe
%WINDIR%\Logs\SysInfo\Tools\boxcutter.exe
%WINDIR%\Logs\SysInfo\Tools\WinAudit.exe
%WINDIR%\Logs\SysInfo\Tools\pcidevs.txt
%WINDIR%\Logs\SysInfo\Tools\mondevs.txt
%WINDIR%\Logs\SysInfo\Tools\hidec.exe
%WINDIR%\Logs\SysInfo\Tools\SIV32X.exe
%WINDIR%\Logs\SysInfo\Tools\SDI-drv.exe
%WINDIR%\Logs\SysInfo\Tools\LastActivityView.exe
%WINDIR%\Logs\SysInfo\Tools\WhatInStartup.exe
%WINDIR%\Logs\SysInfo\Tools\SysInf.bat
%WINDIR%\Logs\SysInfo\Tools\SIV64X.exe

Удаляет следующие файлы:

%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\HWIDs.txt
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\DxDiag.txt
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Drivers.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Startup.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\SIV_CRNJEUFU.txt
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\setupapi.log
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\!BSOD!.htm
%TEMP%\Cab4.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip-city[1]
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Devices.htm
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\CRNJEUFU.html
%WINDIR%\Logs\SysInfo\LOGs\CRNJEUFU\Crashes.htm

Перемещает следующие файлы:

%WINDIR%\Logs\SysInfo\SysInfo.7z в %WINDIR%\Logs\SysInfo\CRNJEUFU_2014.09.23_r416.7z

Сетевая активность:

Подключается к:

'www.download.windowsupdate.com':80
'ap#.##infodb.com':80

TCP:

Запросы HTTP GET:

www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
ap#.##infodb.com/v3/ip-city?fo#############################################################################

UDP: