Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UniversalCommunicationServer] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe "%PROGRAM_FILES%\BERNINA\UCS\UcsHistory.txt"
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe "%PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.exe"
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe "%PROGRAM_FILES%\BERNINA\UCS\UcsApplication.exe"
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe "%PROGRAM_FILES%\BERNINA\UCS\MultiThreading.dll"
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe "%PROGRAM_FILES%\BERNINA\UCS\TraceEnvironment.dll"
Запускает на исполнение:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe "%PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.exe"
- <SYSTEM32>\net1.exe start UniversalCommunicationServer
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe "%PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.exe" /u
- <SYSTEM32>\net.exe stop UniversalCommunicationServer
- <SYSTEM32>\net1.exe stop UniversalCommunicationServer
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\layoe872.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\dataeac3.rra
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %PROGRAM_FILES%\BERNINA\UCS\Univ95c9.rra
- %PROGRAM_FILES%\BERNINA\UCS\UcsA8742.rra
- %PROGRAM_FILES%\BERNINA\UCS\UcsH92bb.rra
- %PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.InstallState
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.InstallLog
- %PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.InstallLog
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuee3e.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuecf6.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\dataeb40.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuec1b.rra
- %PROGRAM_FILES%\BERNINA\UCS\Mult53ce.rra
- %PROGRAM_FILES%\BERNINA\UCS\Trac7ddc.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.ibt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\cb59fca1-022b-4f7e-b861-6a5367268625
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\set4.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp3.tmp\temp.000
- %TEMP%\_se8.tmp
- %TEMP%\isp5.tmp\temp.000
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp6.tmp\temp.000
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\f25c33317e3cdc057eb0c62bb9a9e940_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\igd7.tmp
- %TEMP%\bye1.tmp\Disk1\engine32.cab
- %TEMP%\bye1.tmp\Disk1\layout.bin
- %TEMP%\bye1.tmp\Disk1\data1.hdr
- %TEMP%\ISPackFiles.ini
- %TEMP%\bye1.tmp\Disk1\data1.cab
- %TEMP%\bye1.tmp\Disk1\setup.inx
- %TEMP%\iss2.tmp\setup.ini
- %TEMP%\bye1.tmp\Disk1\setup.ini
- %TEMP%\bye1.tmp\Disk1\setup.exe
- %TEMP%\bye1.tmp\Disk1\setup.ibt
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iKe9.tmp
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\defa7dd1.rra
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\_IsR7f09.rra
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\isrt79d9.rra
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\Font7739.rra
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\Stri77c6.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iusD.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iscC.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotA.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\ctoB.tmp
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setu71ea.rra
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\core75a3.rra
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
- %CommonProgramFiles%\InstallShield\Professional\RunTime\iKernel.rgs
Удаляет следующие файлы:
- %CommonProgramFiles%\InstallShield\Professional\RunTime\IsPE.tmp
- %PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.InstallState
- %TEMP%\_se8.tmp
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\set4.tmp
- %TEMP%\igd7.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\dataeac3.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\dataeb40.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\data1.cab
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuec1b.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\layoe872.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\layout.bin
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\isrt79d9.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\isrt.dll
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\defa7dd1.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\default.pal
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\_IsR7f09.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\_IsRes.dll
- %PROGRAM_FILES%\BERNINA\UCS\UcsA8742.rra в %PROGRAM_FILES%\BERNINA\UCS\UcsApplication.exe
- %PROGRAM_FILES%\BERNINA\UCS\UcsH92bb.rra в %PROGRAM_FILES%\BERNINA\UCS\UcsHistory.txt
- %PROGRAM_FILES%\BERNINA\UCS\Univ95c9.rra в %PROGRAM_FILES%\BERNINA\UCS\UniversalCommunicationServer.exe
- %PROGRAM_FILES%\BERNINA\UCS\Trac7ddc.rra в %PROGRAM_FILES%\BERNINA\UCS\TraceEnvironment.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuecf6.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.inx
- %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setuee3e.rra в %PROGRAM_FILES%\InstallShield Installation Information\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.ini
- %PROGRAM_FILES%\BERNINA\UCS\Mult53ce.rra в %PROGRAM_FILES%\BERNINA\UCS\MultiThreading.dll
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\Stri77c6.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\StringTable-0009-English.ips
- %TEMP%\isp5.tmp\temp.000 в %TEMP%\isp5.tmp\_Setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iKe9.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotA.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp6.tmp\IGdi.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp3.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp3.tmp\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp3.tmp\setup.dll в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp6.tmp\temp.000 в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\isp6.tmp\IGdi.dll
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setu71ea.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\setup.inx
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\core75a3.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\corecomp.ini
- %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\Font7739.rra в %TEMP%\{4162D09D-F77B-4EA1-AD89-EB2F434D4B18}\{CF27C964-3902-4CA3-9C71-B0EAEB302AB5}\FontData.ini
- %CommonProgramFiles%\InstallShield\Professional\RunTime\ObjF.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\ctoB.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iscC.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
- %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iusD.tmp в %CommonProgramFiles%\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
Сетевая активность:
Подключается к:
- 'cs#######-2-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- crl.verisign.com/pca3.crl
- wp#d/wpad.dat
UDP:
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
