Trojan.MulDrop11.18610

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'

Creates or modifies the following files

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\XPSHardware] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\XPSHardware] 'ImagePath' = '%WINDIR%\ehome\ASCON\xpsrchv.exe'

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\ehome\ASCON\xpsrchv.exe' = '%WINDIR%\ehome\ASCON\xpsrchv....

Executes the following

Modifies file system

Creates the following files

%TEMP%\$inst\2.tmp
%APPDATA%\googleupdate\l\msvcr110.dll
%APPDATA%\googleupdate\l\googleupdate.exe
%WINDIR%\ehome\ascon\drv_set.reg
%WINDIR%\ehome\ascon\xpsrchv.exe
%WINDIR%\ehome\ascon\wudlicense.exe
%WINDIR%\ehome\ascon\webmvorbisencoder.dll
%WINDIR%\ehome\ascon\webmvorbisdecoder.dll
%WINDIR%\ehome\ascon\webmmux.dll
%WINDIR%\ehome\ascon\vp8encoder.dll
%WINDIR%\ehome\ascon\vp8decoder.dll
%WINDIR%\ehome\ascon\systeminstall.bat
%WINDIR%\ehome\ascon\russian.lg
%WINDIR%\ehome\ascon\drv_install(x86).exe
%APPDATA%\googleupdate\l\msvcr.bat
%APPDATA%\googleupdate\l\config.txt
%APPDATA%\googleupdate\update.exe
%APPDATA%\googleupdate\ico.exe
%APPDATA%\googleupdate\googleupdate.exe
%APPDATA%\googleupdate\sys.vbs
%APPDATA%\googleupdate\ico.sfx.exe
%TEMP%\$inst\0001.tmp
%APPDATA%\googleupdate\icon.exe
<Current directory>\sys.vbs
<Current directory>\ГіГ¤ГЁГўГЁГІГҐГ«ГјГГ»ГҐ Г¬Г ГІГҐГ¬Г ГІГЁГ·ГҐГ±ГЄГЁГҐ ГЈГ®Г«Г®ГўГ®Г«Г®Г¬ГЄГЁ. ГµГ Г°ГІ-Г¤ГЅГўГЁГ± Г .djvu
%TEMP%\$inst\temp_0.tmp
%APPDATA%\googleupdate\l\update.vbs
%WINDIR%\ehome\ascon\systemapi.dat

Deletes the following files

Substitutes the following files

Network activity

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%APPDATA%\googleupdate\icon.exe'
'<SYSTEM32>\wscript.exe' "<Current directory>\sys.vbs"
'<SYSTEM32>\wscript.exe' "%APPDATA%\GoogleUpdate\sys.vbs"
'%APPDATA%\googleupdate\ico.sfx.exe' -p121212
'%APPDATA%\googleupdate\ico.exe'
'%APPDATA%\googleupdate\update.exe'
'%WINDIR%\ehome\ascon\drv_install(x86).exe'
'%WINDIR%\ehome\ascon\xpsrchv.exe' /silentinstall
'%WINDIR%\ehome\ascon\xpsrchv.exe' /firewall
'%WINDIR%\ehome\ascon\xpsrchv.exe' /start
'%WINDIR%\ehome\ascon\xpsrchv.exe'
'%WINDIR%\ehome\ascon\wudlicense.exe' /tray
'%APPDATA%\googleupdate\ico.sfx.exe' -p121212' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /IM ico.sfx.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\ehome\ASCON\SystemInstall.bat" "' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\ehome\ASCON\SystemInstall.bat" "
'<SYSTEM32>\attrib.exe' +s +h "%WINDIR%\ehome\ASCON"
'<SYSTEM32>\sc.exe' stop AdobeReader
'<SYSTEM32>\sc.exe' stop RManService
'<SYSTEM32>\sc.exe' delete AdobeReader
'<SYSTEM32>\sc.exe' delete RManService
'<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\Hardware System\DeviceXPS" /f
'%WINDIR%\regedit.exe' /s "%WINDIR%\ehome\ASCON\drv_set.reg"
'<SYSTEM32>\sc.exe' failure WUDLicense reset= 0 actions= restart/1000/restart/1000/restart/1000
'<SYSTEM32>\sc.exe' config WUDLicense obj= LocalSystem type= interact type= own