Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TASA_McciTrayApp' = '"%PROGRAM_FILES%\TASA\McciTrayApp.exe"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\McciCMService] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\Detectors\Outlook Dialog\\TASA" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\Detectors\Visible\\TASA" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\Detectors\Delimiters\\TASA" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\Detectors\\MSEMAIL" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\Detectors\\WINDOW" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\TASA\\Alerts Location" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\TASA\UninstallTracking\\MaxRetries" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\TASA\UninstallTracking\\RetryIntervalMinutes" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\TASA\UninstallTracking\\TargetURL" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\TASA\\AnimationSpeed" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\TASA\\Agent Path" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /registercmservice /Platform=WIN32
- %CommonProgramFiles%\Motive\McciCMService.exe /Service
- %CommonProgramFiles%\Motive\InstallHelper.exe /addlegacy= /Platform=WIN32
- %PROGRAM_FILES%\TASA\McciTrayApp.exe /UpdateRunKey
- %CommonProgramFiles%\Motive\InstallHelper.exe /predefinedallaccess /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /startcmservice /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\TASA\McciTrayApp\\AppPath" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /uninstallvendor="TASA" /addregkey="HKLM\SOFTWARE\Motive\Rainier\McciContext\\Processor" /Platform=WIN32
- %CommonProgramFiles%\Motive\InstallHelper.exe /allaccessdir="%PROGRAM_FILES%\TASA" /Platform=WIN32
- %CommonProgramFiles%\Motive\McciCMService.exe
- %CommonProgramFiles%\Motive\InstallHelper.exe /addlegacy="%PROGRAM_FILES%\TASA" /Platform=WIN32
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\McciTrayApp.exe
- %CommonProgramFiles%\Motive\McciCMService.exe
- %PROGRAM_FILES%\TASA\McciTrayApp.exe
- %PROGRAM_FILES%\TASA\McciTrayApp.ini
- %TEMP%\McciTrayApp.ini
- %TEMP%\nsv3.tmp\NSISPlugin.dll
- %TEMP%\nsf2.tmp
- %TEMP%\InstallHelper.exe
- %TEMP%\McciCMService.exe
- %CommonProgramFiles%\Motive\InstallHelper.exe
Удаляет следующие файлы:
- %TEMP%\McciTrayApp.exe
- %TEMP%\McciTrayApp.ini
- %TEMP%\InstallHelper.exe
- %TEMP%\McciCMService.exe
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
