Trojan.KillFiles.65046

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\installshieldВ® update service scheduler
<SYSTEM32>\tasks\optimize thumbnail cache files

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "ISUSPM.exe"

Modifies file system

Creates the following files

%TEMP%\is-uvggs.tmp\<File name>.tmp
%TEMP%\is-l21eg.tmp\_isetup\_setup64.tmp
%TEMP%\is-l21eg.tmp\idp.dll
%TEMP%\is-u03ou.tmp\<File name>.tmp
%TEMP%\is-qql8a.tmp\_isetup\_setup64.tmp
%TEMP%\is-qql8a.tmp\idp.dll
%CommonProgramFiles(x86)%\installshield\update\is-jgik8.tmp
%PROGRAMDATA%\installshield\update\is-4e338.tmp
<Current directory>\is-9chef.tmp
%TEMP%\creativecloud\acc\adobedownload\hdinstaller.log

Sets the 'hidden' attribute to the following files

<Current directory>\setup.exe

Deletes the following files

%TEMP%\is-l21eg.tmp\idp.dll
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
%TEMP%\is-qql8a.tmp\idp.dll
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
%TEMP%\is-qql8a.tmp\_isetup\_setup64.tmp
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\adobe flash player updater
%WINDIR%\tasks\adobe flash player updater.job
<SYSTEM32>\tasks\adobe acrobat update task
%TEMP%\is-uvggs.tmp\<File name>.tmp
%TEMP%\is-l21eg.tmp\_isetup\_setup64.tmp
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
%TEMP%\is-u03ou.tmp\<File name>.tmp

Moves the following files

from %CommonProgramFiles(x86)%\installshield\update\is-jgik8.tmp to %CommonProgramFiles(x86)%\installshield\update\isuspm.exe
from %PROGRAMDATA%\installshield\update\is-4e338.tmp to %PROGRAMDATA%\installshield\update\isuspm.ini
from <Current directory>\is-9chef.tmp to <Current directory>\setup.exe

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\is-uvggs.tmp\<File name>.tmp' /SL5="$B01DA,1794130,122880,<Full path to file>"
'%TEMP%\is-u03ou.tmp\<File name>.tmp' /SL5="$D022A,1794130,122880,<Full path to file>" /VERYSILENT
'<Current directory>\setup.exe'
'%WINDIR%\syswow64\taskkill.exe' /f /im "ISUSPM.exe"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn * /f' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete isupdate.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete ISUSPM.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete msiupd.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete router.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete Updater.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete updatesvc.exe' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "InstallShieldВ® Update Service Scheduler" /TR "\"%CommonProgramFiles(x86)%\InstallShield\Update\ISUSPM.exe\"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC WEEKLY /D WED,SUN /ST 12:00 /RL HIGHEST /TN "Optimize Thumbnail Cache Files" /TR "wscript.exe //nologo //E:jscript //B \"%PROGRAMDATA%\InstallShield\Update\isuspm.ini\"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn * /f
'%WINDIR%\syswow64\sc.exe' delete isupdate.exe
'%WINDIR%\syswow64\sc.exe' delete ISUSPM.exe
'%WINDIR%\syswow64\sc.exe' delete msiupd.exe
'%WINDIR%\syswow64\sc.exe' delete router.exe
'%WINDIR%\syswow64\sc.exe' delete Updater.exe
'%WINDIR%\syswow64\sc.exe' delete updatesvc.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "InstallShieldВ® Update Service Scheduler" /TR "\"%CommonProgramFiles(x86)%\InstallShield\Update\ISUSPM.exe\"
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC WEEKLY /D WED,SUN /ST 12:00 /RL HIGHEST /TN "Optimize Thumbnail Cache Files" /TR "wscript.exe //nologo //E:jscript //B \"%PROGRAMDATA%\InstallShield\Update\isuspm.ini\"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней