Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' 0x824 svchost.exe
- '<SYSTEM32>\cscript.exe' <LS_APPDATA>\TMA2ZWE.vbs
- '<SYSTEM32>\schtasks.exe' /Delete /tn "keepup" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\miaul\RJFC.exe\"" /SC DAILY /TN "keepup" /ST 06:54:00 /du 0024:00 /RI 10 /RL HIGHEST /f
- '<SYSTEM32>\conhost.exe' --type=renderer --disable-direct-npapi-requests --lang=en-US --disable-client-side-phishing-detection --with-feature:enhanced-autofill --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1440.1.142203921\1663184066" /prefetch:673131151
- '<SYSTEM32>\svchost.exe' 0xb14 raserver.exe
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\schtasks.exe' /pid=0xa1c /log
- '<SYSTEM32>\RAServer.exe' /offerraupdate
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\miaul\RJFC.exe\"" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /Delete /tn "9A5A8340-6B15" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%APPDATA%\Roaming\ARHome\Updater.exe\"" /SC ONIDLE /TN "9A5A8340-6B15" /I 1 /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /Delete /tn "Office" /f
- '<SYSTEM32>\schtasks.exe' /Create /TR "\"%PROGRAM_FILES%\Office\Office.exe\"" /SC DAILY /TN "Office" /ST 01:50:00 /du 0024:00 /RI 360 /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /Create /TN "Java Update" /TR "\"%PROGRAM_FILES%\Java\Java.exe\"" /SC ONSTART /DELAY 0005:00 /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /pid=0x8d8 /log
- '<SYSTEM32>\schtasks.exe' /Delete /tn "mium0d" /f
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\taskhost.exe' SYSTEM
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,2a}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,2a}'
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E11C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\BF68.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\History Provider Cache
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E70C.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E5C2.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E321.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %TEMP%\etilqs_pEifhSlyAF968PO
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\LOG
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000002
- %APPDATA%\Roaming\Opera Software\Opera Stable\DDA1.tmp
- %TEMP%\etilqs_KUh1YutpcA1pWnz
- %TEMP%\etilqs_kIV0BdYu3IJcBvS
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECCC.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EAE6.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9BC.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\7SYI4P2D50H49SJPXUDJ.temp
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.jstmp
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\user.js
- %PROGRAM_FILES%\Java\Java.exe
- <SYSTEM32>\GroupPolicy\gpt.ini
- <SYSTEM32>\Tasks\Java Update
- <SYSTEM32>\Tasks\9A5A8340-6B15
- %APPDATA%\Roaming\ARHome\Updater.zip
- %APPDATA%\Roaming\ARHome\qhnsjt.dat
- <LS_APPDATA>\TMA2ZWE.vbs
- <SYSTEM32>\Tasks\Office
- %PROGRAM_FILES%\Office\Office.exe
- %APPDATA%\Roaming\ARHome\Updater.exe
- %APPDATA%\Roaming\miaul\RJFC.exe
- %APPDATA%\Roaming\miaul\RJFC.zip
- %APPDATA%\Roaming\VolIE\onload.js
- <SYSTEM32>\Tasks\keepup
- <SYSTEM32>\Tasks\mium0d
- <Служебный элемент>
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\searchPlugins\VenteeRo.xml
- C:\ProgramData\ntuser.pol
- <SYSTEM32>\GroupPolicy\Machine\Registry.pol
- %APPDATA%\Roaming\VolIE\FoxPro_64.dll
- %APPDATA%\Roaming\VolIE\FoxPro_32.dll
- %APPDATA%\Roaming\VolIE\IE.zip
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\ProgramData\tempntuser.pol
Удаляет следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6CC.tmp~RF5e954.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9AB.tmp~RF5ea3e.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E311.tmp~RF5e4b3.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E506.tmp~RF5e61a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF5f269.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA88.tmp~RF5ec80.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECBB.tmp~RF5edd7.TMP
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js
- %APPDATA%\Roaming\VolIE\IE.zip
- %APPDATA%\Roaming\ARHome\Updater.zip
- C:\ProgramData\tempntuser.pol
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\MANIFEST-000001
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E0AE.tmp~RF5e262.TMP
- %APPDATA%\Roaming\miaul\RJFC.zip
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF59a0d.TMP
Перемещает следующие файлы:
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EAE6.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA88.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA88.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\EA88.tmp~RF5ec80.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECCC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECBB.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6CC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6CC.tmp~RF5e954.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9BC.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9AB.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9AB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E9AB.tmp~RF5ea3e.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT~RF5f269.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\DDA1.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Local State
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECBB.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\ECBB.tmp~RF5edd7.TMP
- %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\7SYI4P2D50H49SJPXUDJ.temp в %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\8548f632abe97aa3.customDestinations-ms
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension State\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E70C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E6CC.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000002.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT~RF59a0d.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\BF68.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Preferences
- %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.jstmp в %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js
- C:\ProgramData\ntuser.pol в C:\ProgramData\tempntuser.pol
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\000001.dbtmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Extension Rules\CURRENT
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E311.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E311.tmp~RF5e4b3.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E5C2.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E506.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E506.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E506.tmp~RF5e61a.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E11C.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E0AE.tmp
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E0AE.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E0AE.tmp~RF5e262.TMP
- %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E321.tmp в %APPDATA%\Roaming\Opera Software\Opera Stable\Jump List Icons\E311.tmp
Самоудаляется.
Сетевая активность:
UDP:
- DNS ASK ap#.###sys.opera.com
- DNS ASK sl####i.yandex.ru
- DNS ASK bi##.#ikimedia.org
- DNS ASK au######te.geo.opera.com
- DNS ASK en.###ipedia.org
- DNS ASK re###.opera.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK www.ic#.com
- DNS ASK si#####ck2.opera.com
- DNS ASK www.google.com
- DNS ASK i.##0.ru
- DNS ASK www.go##le.ru
- DNS ASK www.ac##ads.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Roaming\Opera Software\Opera Stable'
- ClassName: '18467-41' WindowName: ''
