Trojan.MulDrop3.12122

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\regedit\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\hlpfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path] 'debugger' = '<LS_APPDATA>\shell.exe'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\Directory\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
[<HKLM>\SOFTWARE\Classes\WinRAR\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\Folder\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
[<HKLM>\SOFTWARE\Classes\Drive\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
[<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\MSInfo.Document\Shell\Open\Command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\mailto\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\pengging.scr'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'service' = '<LS_APPDATA>\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'Autorun' = '%WINDIR%\pengging.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\pengging.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'systray' = '%WINDIR%\pengging.exe'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pengging' = '<LS_APPDATA>\smss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg' = '<LS_APPDATA>\lsass.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Paint.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Notepad.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\pengging.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.Exe, %WINDIR%\pengging.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\%USERNAME%.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\default.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

blocks the following features:

System Restore (SR)

Creates and executes the following:

%WINDIR%\pengging.exe

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'

Modifies file system :

Creates the following files:

<LS_APPDATA>\services.exe
<LS_APPDATA>\lsass.exe
<LS_APPDATA>\winlogon.exe
<LS_APPDATA>\shell.exe
%WINDIR%\msvbvm50.dll
%WINDIR%\msvbvm60.dll
<LS_APPDATA>\smss.exe
<LS_APPDATA>\csrss.exe
<SYSTEM32>\pengging.scr
<SYSTEM32>\svchost .exe
%WINDIR%\pengging.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\default.exe
<LS_APPDATA>\pengging.exe
<SYSTEM32>\shell.exe
<SYSTEM32>\kernel.sys

Sets the 'hidden' attribute to the following files:

<LS_APPDATA>\shell.exe
<LS_APPDATA>\winlogon.exe
<LS_APPDATA>\services.exe
%WINDIR%\msvbvm60.dll
%WINDIR%\msvbvm50.dll
<LS_APPDATA>\csrss.exe
<SYSTEM32>\pengging.scr
%WINDIR%\pengging.exe
<SYSTEM32>\svchost .exe
<LS_APPDATA>\smss.exe
<LS_APPDATA>\lsass.exe

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Luke Filewalker'
ClassName: '' WindowName: 'AntiVir PersonalEdition Classic'
ClassName: '' WindowName: 'CProcess'
ClassName: '' WindowName: 'Antivirus'
ClassName: '' WindowName: 'Display Properties'
ClassName: '' WindowName: 'Application Data'
ClassName: '' WindowName: 'Killer Machine'
ClassName: '' WindowName: 'The Killer Machine'
ClassName: '' WindowName: 'ScanVirus'
ClassName: '' WindowName: 'TuneUp Process Manager'
ClassName: '' WindowName: 'TuneUp Registry Editor'
ClassName: '' WindowName: 'G TaskMan'
ClassName: '' WindowName: 'TuneUp RegistryCleaner'
ClassName: '' WindowName: 'Kaspersky Lab'
ClassName: '' WindowName: 'AntiVirX'
ClassName: '' WindowName: 'VBRezQ'
ClassName: '' WindowName: 'I*n*d*o*prog v_i_rus s*c*a*n*ner'
ClassName: '' WindowName: 'Antivir'
ClassName: '' WindowName: 'Kaspersky'
ClassName: '' WindowName: 'Program'
ClassName: '' WindowName: 'antiviral'
ClassName: '' WindowName: 'C:\WINNT\system32\cmd.exe'
ClassName: '' WindowName: 'Safely Remove Hardware'
ClassName: '' WindowName: 'Run'
ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
ClassName: '' WindowName: 'Anti Virus'
ClassName: '' WindowName: 'Select Drive'
ClassName: '' WindowName: 'Deep Freeze 5'
ClassName: '' WindowName: 'Local Settings'
ClassName: '' WindowName: 'System Restore'
ClassName: '' WindowName: 'User Accounts'
ClassName: '' WindowName: 'My Network Places'
ClassName: '' WindowName: 'Deep Freeze 6'
ClassName: '' WindowName: 'Deep Freeze STD'
ClassName: '' WindowName: 'ShowKillProcess'
ClassName: '' WindowName: 'System Properties'
ClassName: '' WindowName: 'Master'
ClassName: '' WindowName: 'WINNT'
ClassName: '' WindowName: 'Program Files'
ClassName: '' WindowName: 'system32'
ClassName: '' WindowName: 'WINDOWS'
ClassName: '' WindowName: 'Search Results'
ClassName: '' WindowName: 'Group Policy'
ClassName: '' WindowName: 'Taskbar and Start Menu Properties'
ClassName: '' WindowName: 'Registry Editor'
ClassName: '' WindowName: 'Windows Task Manager'
ClassName: '' WindowName: 'ngging'
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: 'StartUp'
ClassName: '' WindowName: 'RECYCLER'
ClassName: '' WindowName: 'Process Viewer'
ClassName: '' WindowName: 'Open With'
ClassName: '' WindowName: 'An'
ClassName: '' WindowName: 'Tuneup Utilities'
ClassName: '' WindowName: 'CompactbyteAV'
ClassName: '' WindowName: 'Norman Generic Fix'
ClassName: '' WindowName: 'CurrProcess'
ClassName: '' WindowName: 'Lock Folder 3.0'
ClassName: '' WindowName: 'Pemantau dan Penghapus Proses/File Jahat'
ClassName: '' WindowName: 'Anti...worm - www.gdata.pl/eng'
ClassName: '' WindowName: 'Autoplay'
ClassName: '' WindowName: 'Temp'
ClassName: '' WindowName: 'Recycle Bin'
ClassName: '' WindowName: 'Folder Options'
ClassName: '' WindowName: 'Command Prompt'
ClassName: '' WindowName: 'Control Panel'
ClassName: '' WindowName: 'Add or Remove Programs'
ClassName: '' WindowName: 'All Users'
ClassName: '' WindowName: 'System Configuration Utility'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial