Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Logs\SysInfo\Tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\7za a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
- '%WINDIR%\Logs\SysInfo\Tools\7za.exe' a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
- '%WINDIR%\Logs\SysInfo\Tools\SIV32X.exe' -SAVE[devices][device-ids][dimms][driver-vsn][environment][hw-status][interfaces][my-ip-address][overview][pnp-dev][processes][startup][software][system][uaa-dev]
- '%WINDIR%\Logs\SysInfo\Tools\DriverView.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.htm
- '%WINDIR%\Logs\SysInfo\Tools\InstalledDriversList.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.html
Запускает на исполнение:
- '<SYSTEM32>\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\DxDiag.txt
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Logs\SysInfo\Tools\pcmdevs.txt
- %WINDIR%\Logs\SysInfo\Tools\pcidevs.txt
- %WINDIR%\Logs\SysInfo\Tools\pnpdevs.txt
- %WINDIR%\Logs\SysInfo\Tools\wput.exe
- %WINDIR%\Logs\SysInfo\Tools\usbdevs.txt
- %WINDIR%\Logs\SysInfo\Tools\mondevs.txt
- %WINDIR%\Logs\SysInfo\Tools\WinAudit.exe
- %WINDIR%\Logs\SysInfo\Tools\WhatInStartup.exe
- %WINDIR%\Logs\SysInfo\Tools\devcon.exe
- %WINDIR%\Logs\SysInfo\Tools\hidec.exe
- %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
- %WINDIR%\Logs\SysInfo\Tools\Log.exe
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\SIV_BVNSEUHJ.txt
- %WINDIR%\Logs\SysInfo\Tools\ERROR.BUG
- %HOMEPATH%\Documents\DRP-Log\BVNSEUHJ_2015.04.15_v15.4.7z
- %WINDIR%\Logs\SysInfo\SysInfo.7z
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\setupapi.dev.log
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.htm
- %WINDIR%\Logs\SysInfo\Tools\www.SamLab.ws.url
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.html
- %WINDIR%\Logs\SysInfo\Tools\SIV_BVNSEUHJ.txt
- <DRIVERS>\SIVX32.sys
- %WINDIR%\Logs\SysInfo\Tools\SysInf.bat
- %WINDIR%\Logs\SysInfo\Tools\BoxCutter.exe
- %WINDIR%\Logs\SysInfo\Tools\BlueScreenView.exe
- %WINDIR%\Logs\SysInfo\Tools\CProcess.exe
- %WINDIR%\Logs\SysInfo\Tools\DriverView.exe
- %WINDIR%\Logs\SysInfo\Tools\DevManView.exe
- %WINDIR%\Logs\SysInfo\Tools\AppCrashView.exe
- %TEMP%\nse64DC.tmp\System.dll
- %TEMP%\nso64CB.tmp
- %TEMP%\nse64DC.tmp\modern-header.bmp
- %WINDIR%\Logs\SysInfo\Tools\7za.exe
- %TEMP%\nse64DC.tmp\nsProcess.dll
- %WINDIR%\Logs\SysInfo\Tools\SIV32X.exe
- %WINDIR%\Logs\SysInfo\Tools\SDI-drv.exe
- %WINDIR%\Logs\SysInfo\Tools\SIV64X.exe
- %WINDIR%\Logs\SysInfo\Tools\SIVX64.sys
- %WINDIR%\Logs\SysInfo\Tools\SIVX32.sys
- %WINDIR%\Logs\SysInfo\Tools\LastActivityView.exe
- %WINDIR%\Logs\SysInfo\Tools\ExecutedProgramsList.exe
- %WINDIR%\Logs\SysInfo\Tools\DriverView64.exe
- %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
- %WINDIR%\Logs\SysInfo\Tools\InstalledDriversList64.exe
- %WINDIR%\Logs\SysInfo\Tools\InstalledDriversList.exe
Удаляет следующие файлы:
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\setupapi.dev.log
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\SIV_BVNSEUHJ.txt
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.htm
- %WINDIR%\Logs\SysInfo\LOGs\BVNSEUHJ\Drivers.html
Перемещает следующие файлы:
- %WINDIR%\Logs\SysInfo\SysInfo.7z в %WINDIR%\Logs\SysInfo\BVNSEUHJ_2015.04.15_v15.4.7z
Сетевая активность:
UDP:
- DNS ASK www.microsoft.com
- DNS ASK ap#.##infodb.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK ct###.#indowsupdate.com
- DNS ASK crl.microsoft.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
