Trojan.DownLoader11.31195

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe'
'%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe' 32\IDriver.exe -Embedding
'%TEMP%\00038E0D\averywizardenglish.exe'

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' -Embedding 7191170596F45124F312D0F55CF1D085 C
'<SYSTEM32>\msiexec.exe' /V

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\String1033.txt
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\_ISRES.DLL
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\IsConfig.INI
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\Setup.cfg
%TEMP%\MSI7.tmp
%TEMP%\MSI6.tmp
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\objpscnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IUserCnv.dll
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\ISRT.DLL
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\setup.inx
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver2.exe
%TEMP%\{6B10045E-6789-49C4-BFED-52575F5B76BF}\Hintergrund.bmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%TEMP%\MSI8.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
%TEMP%\_is2\_ISMSIDEL.INI
%TEMP%\_is2\Setup.INI
%TEMP%\~1.tmp
%TEMP%\_is2\ISScript1050.Msi
%TEMP%\_is2\Avery Assistant.msi
%TEMP%\_is2\0x0409.ini
%TEMP%\averywizardenglish.exe
%TEMP%\00035078
%TEMP%\000257AB
%TEMP%\00038E0D\config.yaml
%TEMP%\00038E0D\averywizardenglish.exe
%TEMP%\config.yaml
%WINDIR%\Installer\2ee9c.msi
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\ISRT.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\Config.Msi\2ee9f.rbs
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\_ISRES1033.dll
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%WINDIR%\Installer\MSI3.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1