Trojan.DownLoader11.48660

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ComponentUpdate' = '"%APPDATA%\Microsoft\Google Component Update.lnk"'

Вредоносные функции:

Создает и запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe' -Embedding
'%APPDATA%\setup1.exe'
'%APPDATA%\Microsoft FxCop\netscp.exe' opensesemi

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 22A79953BAD0C1C451DBDC124101ADDB C
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hhoc30tc.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\skinedd1.rra
%APPDATA%\Microsoft\Internet Explorer\LocalCash\14570305200412k.tmp
%TEMP%\MSID.tmp
%TEMP%\isdeedb1.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%TEMP%\MSI8.tmp
%TEMP%\MSI9.tmp
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\String1033.txt
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\IGdi.dll
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\license.txt
%TEMP%\MSIB.tmp
%TEMP%\MSIC.tmp
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\Ask.exe
%TEMP%\MSIA.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\_ISUSER.DLL
%TEMP%\_is2\Setup.INI
%TEMP%\_is2\_ISMSIDEL.INI
%TEMP%\~1.tmp
%TEMP%\_is2\0x0409.ini
%TEMP%\hhoc30tc.cmdline
%TEMP%\hhoc30tc.out
%TEMP%\_is2\Setup.skin
%TEMP%\hhoc30tc.0.cs
%APPDATA%\Microsoft FxCop\1.tmd
%APPDATA%\Microsoft FxCop\MainModule.dll
%APPDATA%\Microsoft FxCop\netscp.exe
%APPDATA%\Microsoft FxCop\c4febf31-f8bd-g26b.tmp
%APPDATA%\Microsoft FxCop\3.tmd
%APPDATA%\Microsoft\Google Component Update.lnk
%APPDATA%\Microsoft\Internet Explorer\SQP4H9Z2_A.tmp
%APPDATA%\Microsoft FxCop\4.tmd
%APPDATA%\setup1.exe
%TEMP%\_is2\Easy Resume Creator Pro.msi
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\_ISRES1033.dll
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver2.exe
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IScript8.dll
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\ISRT.dll
%TEMP%\hhoc30tc.dll
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\IsConfig.INI
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\_ISRES.DLL
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\setup.inx
%TEMP%\{01DCAD46-FF60-478B-88FB-8A17B1129F53}\ISRT.DLL
%TEMP%\_is2\ISScript8.Msi
%WINDIR%\Installer\2ab88.msi
%TEMP%\CSC3.tmp
%TEMP%\RES4.tmp
%WINDIR%\Installer\MSI5.tmp
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\objps8.dll
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IUser8.dll
C:\Config.Msi\2ab8b.rbs
%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe