Trojan.DownLoader5.12303

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\prvdisk] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\ianoSvrup] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\PolicyAgent] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\Intel\ianotife.exe
%TEMP%\nsj7.tmp\nsA.tmp sc start ianoSvrup
%TEMP%\nsj7.tmp\ns9.tmp sc description ianoSvrup "К№УГIanno Web CahceјјКхМб№©ЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМб№©µДјУЛЩ№¦ДЬЎЈ"
%TEMP%\~nsu.tmp\Au_.exe _?=%PROGRAM_FILES%\iewnoznpwu\
%PROGRAM_FILES%\iewnoznpwu\un0608115600452.exe
%TEMP%\nsj7.tmp\nsB.tmp sc create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
%PROGRAM_FILES%\iewnoznpwu\bwspowjvb.exe -file 4kcahd3.txt
%TEMP%\nsb2.tmp\ns4.tmp "bwspowjvb.exe" -file 4kcahd3.txt
%TEMP%\nsb2.tmp\ns3.tmp sc start PolicyAgent
%TEMP%\nsj7.tmp\ns8.tmp sc create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
%PROGRAM_FILES%\iewnoznpwu\mysetup.exe
%TEMP%\nsb2.tmp\ns5.tmp sc config PolicyAgent start= auto

Запускает на исполнение:

<SYSTEM32>\sc.exe start ianoSvrup
<SYSTEM32>\sc.exe create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
<SYSTEM32>\wscript.exe "%CommonProgramFiles%\Intel\note.vbs"
<SYSTEM32>\sc.exe description ianoSvrup "К№УГIanno Web CahceјјКхМб№©ЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМб№©µДјУЛЩ№¦ДЬЎЈ"
<SYSTEM32>\sc.exe start PolicyAgent
<SYSTEM32>\sc.exe config PolicyAgent start= auto
<SYSTEM32>\sc.exe create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Intel\config-n.xml
%CommonProgramFiles%\Intel\config-s.xml
%TEMP%\nsj7.tmp\AccessControl.dll
%TEMP%\nsj7.tmp\nsExec.dll
%TEMP%\nsj7.tmp\System.dll
%CommonProgramFiles%\Intel\prvdisk.sys
%CommonProgramFiles%\Intel\note.txt
%CommonProgramFiles%\Intel\ypac.txt
%CommonProgramFiles%\Intel\vison.txt
%CommonProgramFiles%\Intel\suject.db
%CommonProgramFiles%\Intel\ianotife.exe
%CommonProgramFiles%\Intel\note.vbs
%TEMP%\nsj7.tmp\nsB.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\ol[1].asp
%CommonProgramFiles%\Intel\suject.db-journal
%TEMP%\~nsu.tmp\Au_.exe
<SYSTEM32>\PrvMon\prvdisk.sys
%TEMP%\nsj7.tmp\ns9.tmp
%TEMP%\nsj7.tmp\ns8.tmp
%TEMP%\nsj7.tmp\nsA.tmp
%WINDIR%\tudouva.pac
%CommonProgramFiles%\Intel\pro.txt
%TEMP%\nsb2.tmp\nsRandom.dll
%PROGRAM_FILES%\iewnoznpwu\un0608115600452.exe
%TEMP%\nsb2.tmp\InetLoad.dll
%TEMP%\nsb2.tmp\nsplugin.dll
%TEMP%\nsb2.tmp\Internet.dll
%PROGRAM_FILES%\iewnoznpwu\temp0608115600452.ini
%PROGRAM_FILES%\iewnoznpwu\s0001.xml
%PROGRAM_FILES%\iewnoznpwu\menu.xml
%PROGRAM_FILES%\iewnoznpwu\reginfo.xml
%TEMP%\nsb2.tmp\System.dll
%PROGRAM_FILES%\iewnoznpwu\ser000.xml
%PROGRAM_FILES%\iewnoznpwu\info.reg
%TEMP%\nsb2.tmp\ns4.tmp
%TEMP%\nsb2.tmp\ns5.tmp
%CommonProgramFiles%\Intel\sqlite3.dll
%PROGRAM_FILES%\iewnoznpwu\mysetup.exe
%TEMP%\nsb2.tmp\ns3.tmp
%PROGRAM_FILES%\iewnoznpwu\bwspowjvb.exe
<Текущая директория>\op.ini
<Текущая директория>\tx.ini
%TEMP%\nsb2.tmp\nsExec.dll
%PROGRAM_FILES%\iewnoznpwu\4kcahd3.txt