Trojan.Inject1.53639

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\MSDCSC\msdcsc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '<SYSTEM32>\MSDCSC\msdcsc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate2' = '%TEMP%\A3ZD3437N.EXE'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\MSDCSC\msdcsc.exe'
'%TEMP%\A3ZD3437N.exe'

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" +s +h
'<SYSTEM32>\attrib.exe' "%WINDIR%\Microsoft.NET\Framework\v2.0.50727" +s +h
'<SYSTEM32>\wscript.exe' AUNKv8O10.vbs
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'

Внедряет код в

следующие системные процессы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\done.exee.324.plaha
%TEMP%\done.exee.325.plaha
%TEMP%\done.exee.323.plaha
%TEMP%\done.exee.321.plaha
%TEMP%\done.exee.322.plaha
%TEMP%\done.exee.326.plaha
%TEMP%\done.exee.33.plaha
%TEMP%\done.exee.330.plaha
%TEMP%\done.exee.329.plaha
%TEMP%\done.exee.327.plaha
%TEMP%\done.exee.328.plaha
%TEMP%\done.exee.320.plaha
%TEMP%\done.exee.313.plaha
%TEMP%\done.exee.314.plaha
%TEMP%\done.exee.312.plaha
%TEMP%\done.exee.310.plaha
%TEMP%\done.exee.311.plaha
%TEMP%\done.exee.315.plaha
%TEMP%\done.exee.319.plaha
%TEMP%\done.exee.32.plaha
%TEMP%\done.exee.318.plaha
%TEMP%\done.exee.316.plaha
%TEMP%\done.exee.317.plaha
%TEMP%\done.exee.331.plaha
%TEMP%\done.exee.346.plaha
%TEMP%\done.exee.347.plaha
%TEMP%\done.exee.345.plaha
%TEMP%\done.exee.343.plaha
%TEMP%\done.exee.344.plaha
%TEMP%\done.exee.348.plaha
%TEMP%\done.exee.351.plaha
%TEMP%\done.exee.352.plaha
%TEMP%\done.exee.350.plaha
%TEMP%\done.exee.349.plaha
%TEMP%\done.exee.35.plaha
%TEMP%\done.exee.342.plaha
%TEMP%\done.exee.335.plaha
%TEMP%\done.exee.336.plaha
%TEMP%\done.exee.334.plaha
%TEMP%\done.exee.332.plaha
%TEMP%\done.exee.333.plaha
%TEMP%\done.exee.337.plaha
%TEMP%\done.exee.340.plaha
%TEMP%\done.exee.341.plaha
%TEMP%\done.exee.34.plaha
%TEMP%\done.exee.338.plaha
%TEMP%\done.exee.339.plaha
%TEMP%\done.exee.31.plaha
%TEMP%\done.exee.281.plaha
%TEMP%\done.exee.282.plaha
%TEMP%\done.exee.280.plaha
%TEMP%\done.exee.279.plaha
%TEMP%\done.exee.28.plaha
%TEMP%\done.exee.283.plaha
%TEMP%\done.exee.287.plaha
%TEMP%\done.exee.288.plaha
%TEMP%\done.exee.286.plaha
%TEMP%\done.exee.284.plaha
%TEMP%\done.exee.285.plaha
%TEMP%\done.exee.278.plaha
%TEMP%\done.exee.270.plaha
%TEMP%\done.exee.271.plaha
%TEMP%\done.exee.27.plaha
%TEMP%\done.exee.268.plaha
%TEMP%\done.exee.269.plaha
%TEMP%\done.exee.272.plaha
%TEMP%\done.exee.276.plaha
%TEMP%\done.exee.277.plaha
%TEMP%\done.exee.275.plaha
%TEMP%\done.exee.273.plaha
%TEMP%\done.exee.274.plaha
%TEMP%\done.exee.289.plaha
%TEMP%\done.exee.302.plaha
%TEMP%\done.exee.303.plaha
%TEMP%\done.exee.301.plaha
%TEMP%\done.exee.30.plaha
%TEMP%\done.exee.300.plaha
%TEMP%\done.exee.304.plaha
%TEMP%\done.exee.308.plaha
%TEMP%\done.exee.309.plaha
%TEMP%\done.exee.307.plaha
%TEMP%\done.exee.305.plaha
%TEMP%\done.exee.306.plaha
%TEMP%\done.exee.3.plaha
%TEMP%\done.exee.292.plaha
%TEMP%\done.exee.293.plaha
%TEMP%\done.exee.291.plaha
%TEMP%\done.exee.29.plaha
%TEMP%\done.exee.290.plaha
%TEMP%\done.exee.294.plaha
%TEMP%\done.exee.298.plaha
%TEMP%\done.exee.299.plaha
%TEMP%\done.exee.297.plaha
%TEMP%\done.exee.295.plaha
%TEMP%\done.exee.296.plaha
%TEMP%\done.exee.71.plaha
%TEMP%\done.exee.72.plaha
%TEMP%\done.exee.70.plaha
%TEMP%\done.exee.69.plaha
%TEMP%\done.exee.7.plaha
%TEMP%\done.exee.73.plaha
%TEMP%\done.exee.77.plaha
%TEMP%\done.exee.78.plaha
%TEMP%\done.exee.76.plaha
%TEMP%\done.exee.74.plaha
%TEMP%\done.exee.75.plaha
%TEMP%\done.exee.68.plaha
%TEMP%\done.exee.60.plaha
%TEMP%\done.exee.61.plaha
%TEMP%\done.exee.6.plaha
%TEMP%\done.exee.58.plaha
%TEMP%\done.exee.59.plaha
%TEMP%\done.exee.62.plaha
%TEMP%\done.exee.66.plaha
%TEMP%\done.exee.67.plaha
%TEMP%\done.exee.65.plaha
%TEMP%\done.exee.63.plaha
%TEMP%\done.exee.64.plaha
%TEMP%\done.exee.79.plaha
%TEMP%\done.exee.93.plaha
%TEMP%\done.exee.94.plaha
%TEMP%\done.exee.92.plaha
%TEMP%\done.exee.90.plaha
%TEMP%\done.exee.91.plaha
%TEMP%\done.exee.95.plaha
%TEMP%\done.exee.99.plaha
<SYSTEM32>\MSDCSC\msdcsc.exe
%TEMP%\done.exee.98.plaha
%TEMP%\done.exee.96.plaha
%TEMP%\done.exee.97.plaha
%TEMP%\done.exee.9.plaha
%TEMP%\done.exee.82.plaha
%TEMP%\done.exee.83.plaha
%TEMP%\done.exee.81.plaha
%TEMP%\done.exee.8.plaha
%TEMP%\done.exee.80.plaha
%TEMP%\done.exee.84.plaha
%TEMP%\done.exee.88.plaha
%TEMP%\done.exee.89.plaha
%TEMP%\done.exee.87.plaha
%TEMP%\done.exee.85.plaha
%TEMP%\done.exee.86.plaha
%TEMP%\done.exee.57.plaha
%TEMP%\done.exee.367.plaha
%TEMP%\done.exee.368.plaha
%TEMP%\done.exee.366.plaha
%TEMP%\done.exee.364.plaha
%TEMP%\done.exee.365.plaha
%TEMP%\done.exee.369.plaha
%TEMP%\done.exee.372.plaha
%TEMP%\done.exee.373.plaha
%TEMP%\done.exee.371.plaha
%TEMP%\done.exee.37.plaha
%TEMP%\done.exee.370.plaha
%TEMP%\done.exee.363.plaha
%TEMP%\done.exee.356.plaha
%TEMP%\done.exee.357.plaha
%TEMP%\done.exee.355.plaha
%TEMP%\done.exee.353.plaha
%TEMP%\done.exee.354.plaha
%TEMP%\done.exee.358.plaha
%TEMP%\done.exee.361.plaha
%TEMP%\done.exee.362.plaha
%TEMP%\done.exee.360.plaha
%TEMP%\done.exee.359.plaha
%TEMP%\done.exee.36.plaha
%TEMP%\done.exee.374.plaha
%TEMP%\done.exee.5.plaha
%TEMP%\done.exee.50.plaha
%TEMP%\done.exee.49.plaha
%TEMP%\done.exee.47.plaha
%TEMP%\done.exee.48.plaha
%TEMP%\done.exee.51.plaha
%TEMP%\done.exee.55.plaha
%TEMP%\done.exee.56.plaha
%TEMP%\done.exee.54.plaha
%TEMP%\done.exee.52.plaha
%TEMP%\done.exee.53.plaha
%TEMP%\done.exee.46.plaha
%TEMP%\done.exee.39.plaha
%TEMP%\done.exee.4.plaha
%TEMP%\done.exee.38.plaha
%TEMP%\done.exee.375.plaha
%TEMP%\done.exee.376.plaha
%TEMP%\done.exee.40.plaha
%TEMP%\done.exee.44.plaha
%TEMP%\done.exee.45.plaha
%TEMP%\done.exee.43.plaha
%TEMP%\done.exee.41.plaha
%TEMP%\done.exee.42.plaha
%TEMP%\done.exee.153.plaha
%TEMP%\done.exee.154.plaha
%TEMP%\done.exee.152.plaha
%TEMP%\done.exee.150.plaha
%TEMP%\done.exee.151.plaha
%TEMP%\done.exee.155.plaha
%TEMP%\done.exee.159.plaha
%TEMP%\done.exee.16.plaha
%TEMP%\done.exee.158.plaha
%TEMP%\done.exee.156.plaha
%TEMP%\done.exee.157.plaha
%TEMP%\done.exee.15.plaha
%TEMP%\done.exee.142.plaha
%TEMP%\done.exee.143.plaha
%TEMP%\done.exee.141.plaha
%TEMP%\done.exee.14.plaha
%TEMP%\done.exee.140.plaha
%TEMP%\done.exee.144.plaha
%TEMP%\done.exee.148.plaha
%TEMP%\done.exee.149.plaha
%TEMP%\done.exee.147.plaha
%TEMP%\done.exee.145.plaha
%TEMP%\done.exee.146.plaha
%TEMP%\done.exee.160.plaha
%TEMP%\done.exee.175.plaha
%TEMP%\done.exee.176.plaha
%TEMP%\done.exee.174.plaha
%TEMP%\done.exee.172.plaha
%TEMP%\done.exee.173.plaha
%TEMP%\done.exee.177.plaha
%TEMP%\done.exee.180.plaha
%TEMP%\done.exee.181.plaha
%TEMP%\done.exee.18.plaha
%TEMP%\done.exee.178.plaha
%TEMP%\done.exee.179.plaha
%TEMP%\done.exee.171.plaha
%TEMP%\done.exee.164.plaha
%TEMP%\done.exee.165.plaha
%TEMP%\done.exee.163.plaha
%TEMP%\done.exee.161.plaha
%TEMP%\done.exee.162.plaha
%TEMP%\done.exee.166.plaha
%TEMP%\done.exee.17.plaha
%TEMP%\done.exee.170.plaha
%TEMP%\done.exee.169.plaha
%TEMP%\done.exee.167.plaha
%TEMP%\done.exee.168.plaha
%TEMP%\done.exee.139.plaha
%TEMP%\done.exee.11.plaha
%TEMP%\done.exee.110.plaha
%TEMP%\done.exee.109.plaha
%TEMP%\done.exee.107.plaha
%TEMP%\done.exee.108.plaha
%TEMP%\done.exee.111.plaha
%TEMP%\done.exee.115.plaha
%TEMP%\done.exee.116.plaha
%TEMP%\done.exee.114.plaha
%TEMP%\done.exee.112.plaha
%TEMP%\done.exee.113.plaha
%TEMP%\done.exee.106.plaha
%TEMP%\done.exee.1.plaha
%TEMP%\done.exee.10.plaha
%TEMP%\AUNKv8O10.vbs
%TEMP%\5H79lAUx.bat
%TEMP%\A6QXue2c1.bat
%TEMP%\done.exee.100.plaha
%TEMP%\done.exee.104.plaha
%TEMP%\done.exee.105.plaha
%TEMP%\done.exee.103.plaha
%TEMP%\done.exee.101.plaha
%TEMP%\done.exee.102.plaha
%TEMP%\done.exee.117.plaha
%TEMP%\done.exee.131.plaha
%TEMP%\done.exee.132.plaha
%TEMP%\done.exee.130.plaha
%TEMP%\done.exee.129.plaha
%TEMP%\done.exee.13.plaha
%TEMP%\done.exee.133.plaha
%TEMP%\done.exee.137.plaha
%TEMP%\done.exee.138.plaha
%TEMP%\done.exee.136.plaha
%TEMP%\done.exee.134.plaha
%TEMP%\done.exee.135.plaha
%TEMP%\done.exee.128.plaha
%TEMP%\done.exee.120.plaha
%TEMP%\done.exee.121.plaha
%TEMP%\done.exee.12.plaha
%TEMP%\done.exee.118.plaha
%TEMP%\done.exee.119.plaha
%TEMP%\done.exee.122.plaha
%TEMP%\done.exee.126.plaha
%TEMP%\done.exee.127.plaha
%TEMP%\done.exee.125.plaha
%TEMP%\done.exee.123.plaha
%TEMP%\done.exee.124.plaha
%TEMP%\done.exee.239.plaha
%TEMP%\done.exee.24.plaha
%TEMP%\done.exee.238.plaha
%TEMP%\done.exee.236.plaha
%TEMP%\done.exee.237.plaha
%TEMP%\done.exee.240.plaha
%TEMP%\done.exee.244.plaha
%TEMP%\done.exee.245.plaha
%TEMP%\done.exee.243.plaha
%TEMP%\done.exee.241.plaha
%TEMP%\done.exee.242.plaha
%TEMP%\done.exee.235.plaha
%TEMP%\done.exee.228.plaha
%TEMP%\done.exee.229.plaha
%TEMP%\done.exee.227.plaha
%TEMP%\done.exee.225.plaha
%TEMP%\done.exee.226.plaha
%TEMP%\done.exee.23.plaha
%TEMP%\done.exee.233.plaha
%TEMP%\done.exee.234.plaha
%TEMP%\done.exee.232.plaha
%TEMP%\done.exee.230.plaha
%TEMP%\done.exee.231.plaha
%TEMP%\done.exee.246.plaha
%TEMP%\done.exee.260.plaha
%TEMP%\done.exee.261.plaha
%TEMP%\done.exee.26.plaha
%TEMP%\done.exee.258.plaha
%TEMP%\done.exee.259.plaha
%TEMP%\done.exee.262.plaha
%TEMP%\done.exee.266.plaha
%TEMP%\done.exee.267.plaha
%TEMP%\done.exee.265.plaha
%TEMP%\done.exee.263.plaha
%TEMP%\done.exee.264.plaha
%TEMP%\done.exee.257.plaha
%TEMP%\done.exee.25.plaha
%TEMP%\done.exee.250.plaha
%TEMP%\done.exee.249.plaha
%TEMP%\done.exee.247.plaha
%TEMP%\done.exee.248.plaha
%TEMP%\done.exee.251.plaha
%TEMP%\done.exee.255.plaha
%TEMP%\done.exee.256.plaha
%TEMP%\done.exee.254.plaha
%TEMP%\done.exee.252.plaha
%TEMP%\done.exee.253.plaha
%TEMP%\done.exee.224.plaha
%TEMP%\done.exee.196.plaha
%TEMP%\done.exee.197.plaha
%TEMP%\done.exee.195.plaha
%TEMP%\done.exee.193.plaha
%TEMP%\done.exee.194.plaha
%TEMP%\done.exee.198.plaha
%TEMP%\done.exee.200.plaha
%TEMP%\done.exee.201.plaha
%TEMP%\done.exee.20.plaha
%TEMP%\done.exee.199.plaha
%TEMP%\done.exee.2.plaha
%TEMP%\done.exee.192.plaha
%TEMP%\done.exee.185.plaha
%TEMP%\done.exee.186.plaha
%TEMP%\done.exee.184.plaha
%TEMP%\done.exee.182.plaha
%TEMP%\done.exee.183.plaha
%TEMP%\done.exee.187.plaha
%TEMP%\done.exee.190.plaha
%TEMP%\done.exee.191.plaha
%TEMP%\done.exee.19.plaha
%TEMP%\done.exee.188.plaha
%TEMP%\done.exee.189.plaha
%TEMP%\done.exee.202.plaha
%TEMP%\done.exee.217.plaha
%TEMP%\done.exee.218.plaha
%TEMP%\done.exee.216.plaha
%TEMP%\done.exee.214.plaha
%TEMP%\done.exee.215.plaha
%TEMP%\done.exee.219.plaha
%TEMP%\done.exee.222.plaha
%TEMP%\done.exee.223.plaha
%TEMP%\done.exee.221.plaha
%TEMP%\done.exee.22.plaha
%TEMP%\done.exee.220.plaha
%TEMP%\done.exee.213.plaha
%TEMP%\done.exee.206.plaha
%TEMP%\done.exee.207.plaha
%TEMP%\done.exee.205.plaha
%TEMP%\done.exee.203.plaha
%TEMP%\done.exee.204.plaha
%TEMP%\done.exee.208.plaha
%TEMP%\done.exee.211.plaha
%TEMP%\done.exee.212.plaha
%TEMP%\done.exee.210.plaha
%TEMP%\done.exee.209.plaha
%TEMP%\done.exee.21.plaha

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\MSDCSC\msdcsc.exe

Перемещает следующие файлы:

%TEMP%\done.exee.1.plaha в %TEMP%\A3ZD3437N.exe

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней