Trojan.KillProc.34372

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v3' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v3' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v5' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v5' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server v6' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server v5' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server v5' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server v6' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v10' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v10' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v9' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v11' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v12' = '%APPDATA%\RDPServicev12\termsvc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v12' = '%APPDATA%\RDPServicev12\termsvc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v11' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v7' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v6' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v6' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v7' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v9' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows RDP Service v8' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows RDP Service v8' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Security Essentials Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Security Essentials Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Exception Filter' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Security Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Event Log Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Event Log Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Security Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Exception Filter v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Exception Filter' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Exception Filter' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Exception Filter v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Exception Filter' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Exception Filter v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Exception Filter v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server v2' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server v3' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server v4' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Server v3' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Terminal Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Windows Terminal Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Terminal Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Terminal Server' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Terminal Service' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Terminal Service' = ''

Malicious functions:

Creates and executes the following:

'%APPDATA%\RDPServicev12\termsvc.exe' <Full path to virus>

Executes the following:

'<SYSTEM32>\sc.exe' delete "Windows Ssyncer"
'<SYSTEM32>\sc.exe' stop "Windows ssyncer agent"
'<SYSTEM32>\taskkill.exe' /f /im ssyncer.exe
'<SYSTEM32>\sc.exe' delete "Windows ssyncer agent"
'<SYSTEM32>\sc.exe' stop "Windows Ssyncer"
'<SYSTEM32>\taskkill.exe' /f /im cmd.exe
'<SYSTEM32>\taskkill.exe' /f /im CheckServer.exe
'<SYSTEM32>\taskkill.exe' /f /im exceptionfilter.exe
'<SYSTEM32>\taskkill.exe' /f /im WerFault.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system :

Creates the following files:

%APPDATA%\RDPServicev12\termsvc.exe

Sets the 'hidden' attribute to the following files:

%APPDATA%\RDPServicev12\termsvc.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial