Trojan.DownLoader8.26800

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe 32\IDriver.exe -Embedding

Запускает на исполнение:

<SYSTEM32>\msiexec.exe -Embedding A5D7224312A7995CF1D047DD811C3133 C
<SYSTEM32>\msiexec.exe /V

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
%TEMP%\MSI8.tmp
%TEMP%\MSI9.tmp
%TEMP%\MSI7.tmp
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\eula.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\ispr53c.rra
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\skin694.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%WINDIR%\Installer\3887a.msi
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%WINDIR%\Installer\MSI3.tmp
C:\Config.Msi\3887d.rbs
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
%TEMP%\_is2\_ISMSIDEL.INI
%TEMP%\_is2\0x0409.ini
%TEMP%\~1.tmp
%TEMP%\_is2\Setup.INI
%TEMP%\_is2\MSI Plessey Barcode Font (Demo).msi
%TEMP%\_is2\ISScript1050.Msi
%TEMP%\_is2\setup.isn
%TEMP%\_is2\splash.bmp
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\ISRT.DLL
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\IsConfig.INI
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver2.exe
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\setup.inx
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\String1033.txt
%TEMP%\MSI6.tmp
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\_ISRES.DLL
%TEMP%\{1884FCF5-4D3F-4F49-8F8A-4D92CE71F3D6}\_ISUSER.DLL
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\_ISRES1033.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriver.exe
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\ISRT.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\objpscnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IUserCnv.dll