Trojan.MulDrop4.3665

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\moviemk.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\PINBALL.EXE.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\updater.exe.lnk

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ccosmSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\LinkKavsp] 'Start' = '00000002'

Substitutes the following executable system files:

<SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\SpecialPolice.exe
C:\InputGoogle.exe rb
C:\InputGoogle.exe <Full path to virus>

Executes the following:

<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
<SYSTEM32>\regsvr32.exe /u /s scrrun.dll
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\sc.exe create ccosmSrv BinPath= "%PROGRAM_FILES%\StormII\stormSrv.exe /asservice" type= own type= interact start= auto DisplayName= PathPolice
<SYSTEM32>\sc.exe description ccosmSrv "Contrl Center of Storm Media"
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Enable AutoImageResize" /t REG_SZ /d no /F
<SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
<SYSTEM32>\regsvr32.exe /s jscript.dll
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
<SYSTEM32>\regsvr32.exe /u /s shimgvw.dll
<SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\XpathLink.bat"
<SYSTEM32>\regsvr32.exe /u /s vbscript.dll
<SYSTEM32>\regsvr32.exe /u /s itss.dll
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F

Modifies file system :

Creates the following files:

%WINDIR%\SoftArchive.exe
%PROGRAM_FILES%\SpecialPolice.exe
%TEMP%\RGI1.tmp
C:\InputGoogle.exe
%PROGRAM_FILES%\StormII\stormSrv.exe
%PROGRAM_FILES%\XpathLink.bat

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\moviemk.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\PINBALL.EXE.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\updater.exe.lnk

Deletes the following files:

%TEMP%\RGI1.tmp

Moves the following files:

from <SYSTEM32>\dllcache\pinball.exe.new to <SYSTEM32>\dllcache\pinball.exe
from <SYSTEM32>\dllcache\rvsezm.exe.new to <SYSTEM32>\dllcache\rvsezm.exe
from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'WOLSPBNDASGM' WindowName: 'hbrabdynkqwp'

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial