Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '{ce085a78-074e-4823-8dc1-8a721b94b76d}' = '"%ALLUSERSPROFILE%\Application Data\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe" /quiet /burn.log.append "%TEMP%\dd_vcredist_x86_20150105144906.log" /burn.runonce'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.be\vcredist_x86.exe' -q -burn.elevated BurnPipe.{23A9FCCA-D3C4-415F-8BFC-A4F269B6BA60} {DAA925C2-8D91-4A1B-860E-0C96E8A384FB} 2912
- '%TEMP%\is-8VV5Q.tmp\vcredist_x86.exe' /q
- '%TEMP%\is-1PKRP.tmp\<Имя вируса>.tmp' /SL5="$30092,14943444,56832,<Полный путь к вирусу>"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\dd_vcredist_x86_20150105144906_0_vcRuntimeMinimum_x86.log
- %WINDIR%\Installer\25b84.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76
- <SYSTEM32>\msvcp120.dll
- <SYSTEM32>\msvcr120.dll
- %WINDIR%\Installer\MSI1.tmp
- C:\Config.Msi\25b87.rbs
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\cabB3E1576D1FEFBB979E13B1A5379E0B16
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
- <SYSTEM32>\vcomp120.dll
- <SYSTEM32>\mfc120ita.dll
- <SYSTEM32>\mfc120jpn.dll
- <SYSTEM32>\mfc120esn.dll
- <SYSTEM32>\mfc120fra.dll
- <SYSTEM32>\mfc120kor.dll
- <SYSTEM32>\mfcm120.dll
- <SYSTEM32>\mfcm120u.dll
- <SYSTEM32>\mfc120rus.dll
- <SYSTEM32>\mfc120u.dll
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\25b8c.rbs
- %TEMP%\dd_vcredist_x86_20150105144906_1_vcRuntimeAdditional_x86.log
- %WINDIR%\Installer\25b89.msi
- <SYSTEM32>\mfc120.dll
- <SYSTEM32>\mfc120deu.dll
- <SYSTEM32>\mfc120enu.dll
- <SYSTEM32>\mfc120chs.dll
- <SYSTEM32>\mfc120cht.dll
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.be\vcredist_x86.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\BootstrapperApplicationData.xml
- %TEMP%\dd_vcredist_x86_20150105144906.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\is-8VV5Q.tmp\windows_authorize.dll
- %TEMP%\is-8VV5Q.tmp\vcredist_x86.exe
- %TEMP%\is-1PKRP.tmp\<Имя вируса>.tmp
- %TEMP%\is-8VV5Q.tmp\_isetup\_shfoldr.dll
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %ALLUSERSPROFILE%\Application Data\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcRuntimeMinimum_x86
- %ALLUSERSPROFILE%\Application Data\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcRuntimeAdditional_x86
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\cab54A5CABBE7274D8A22EB58060AAB7623
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
Удаляет следующие файлы:
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\BootstrapperApplicationData.xml
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.be\vcredist_x86.exe
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
- %WINDIR%\Installer\25b8b.ipi
- %WINDIR%\Installer\25b84.msi
- C:\Config.Msi\25b87.rbs
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\25b86.ipi
- %WINDIR%\Installer\25b89.msi
- C:\Config.Msi\25b8c.rbs
- %WINDIR%\Installer\MSI4.tmp
Перемещает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcRuntimeAdditional_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeAdditional_x86
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16 в %ALLUSERSPROFILE%\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\cabB3E1576D1FEFBB979E13B1A5379E0B16 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcRuntimeMinimum_x86 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\vcRuntimeMinimum_x86
- %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623 в %ALLUSERSPROFILE%\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab
- %TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\cab54A5CABBE7274D8A22EB58060AAB7623 в %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/pki/crl/products/MicCodSigPCA_08-31-2010.crl
- 20#.#6.232.182/pki/crl/products/MicrosoftTimeStampPCA.crl
- wp#d/wpad.dat
- 20#.#6.232.182/pki/crl/products/microsoftrootcert.crl
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
