Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\DriverDetective.exe'
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 34AE15ADDBA5D72292A7F142C933173C C
- '<SYSTEM32>\msiexec.exe' /V
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\isprba3e.rra
- %TEMP%\b721.rra
- %TEMP%\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isconfig.xml
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\0x0409.ini
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Driver Detective.msi
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Driver Detective.msi
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\ISSetup.dll
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Setup.INI
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\setup.isn
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Splash.bmp
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\_ISMSIDEL.INI
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Setup.INI
- %APPDATA%\DriverDetective.exe
- %TEMP%\~1.tmp
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\setup.isn
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\0x0409.ini
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isuser.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\String1033.txt
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isres.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\DialogBitmap.bmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\EULA.rtf
- %TEMP%\MSI2.tmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\ISRT.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.inx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
Удаляет следующие файлы:
- %TEMP%\MSI3.tmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
- %TEMP%\~1.tmp
- %TEMP%\MSI2.tmp
Сетевая активность:
Подключается к:
- 'cs######4-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://CS######4-crl.verisign.com/CSC3-2004.crl via cs######4-crl.verisign.com
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK cs######4-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
