Trojan.MulDrop5.38430

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
[<HKLM>\SOFTWARE\Classes\.com] '' = 'comfile'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\cfxxefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\.exe] '' = 'exefile'
[<HKLM>\SOFTWARE\Classes\.pif] '' = 'piffile'
[<HKLM>\SOFTWARE\Classes\.cmd] '' = 'cmdfile'
[<HKLM>\SOFTWARE\Classes\.bat] '' = 'batfile'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Creates and executes the following:

'C:\32788R22FWJFW\grep.cfxxe' -isq "ProductType.*WinNT" WinNT00
'C:\32788R22FWJFW\swreg.exe' QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
'C:\32788R22FWJFW\NirCmd.cfxxe' WIN CLOSE CLASS "#32770"
'C:\32788R22FWJFW\SWREG.cfxxe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option
'C:\32788R22FWJFW\pev.exe' UZIP License\pv_5_2_2.zip .\
'C:\32788R22FWJFW\SWREG.cfxxe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
'C:\32788R22FWJFW\SWREG.cfxxe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
'C:\32788R22FWJFW\NirCmd.cfxxe' cmdwait 1700 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788R22FWJFW\n.pif' cmdwait 1000 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788R22FWJFW\NirCmd.cfxxe' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788R22FWJFW\cmd.cfxxe' /c 32788R22FWJFW\p.cmd
'C:\32788R22FWJFW\swreg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
'C:\32788R22FWJFW\grep.cfxxe' -F "5.1.2" OsVer
'C:\32788R22FWJFW\n.pif' cmdwait 2500 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788R22FWJFW\SWREG.cfxxe' QUERY "HKLM\Software\Swearware" /V LastDir /D "C:\"
'C:\32788R22FWJFW\SWREG.cfxxe' ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1251"
'C:\32788R22FWJFW\SWREG.cfxxe' ADD HKCU\Console /V CodePage /T REG_DWORD /D "1251"
'C:\32788R22FWJFW\sed.cfxxe' "/.* /!d; s//@CHCP.com /" NlsCodePageACP00
'C:\32788R22FWJFW\SWREG.cfxxe' QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
'C:\32788R22FWJFW\grep.cfxxe' -isq "0C$" NlsLanguageDefault
'C:\32788R22FWJFW\grep.cfxxe' -isq "09$" NlsLanguageDefault
'C:\32788R22FWJFW\sed.cfxxe' "/.* /!d; s///" NlsLanguage00
'C:\32788R22FWJFW\SWREG.cfxxe' QUERY "HKCU\Console_combofixbackup"
'C:\32788R22FWJFW\PEV.cfxxe' -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or OsVer.exe or WinNT.exe or N_.exe }
'C:\32788R22FWJFW\sed.cfxxe' -r "/.* (.:\\[^\\]*)$/!d; s//\1/"
'C:\32788R22FWJFW\SWREG.cfxxe' COPY "HKCU\Console" "HKCU\Console_combofixbackup" /s
'C:\32788R22FWJFW\SWREG.cfxxe' QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
'C:\32788R22FWJFW\SWREG.cfxxe' ADD "HKCU\Console" /V "InsertMode" /T REG_DWORD /D 1
'C:\32788R22FWJFW\SWREG.cfxxe' ADD "HKCU\Console" /v "QuickEdit" /T REG_DWORD /D 0
'C:\32788R22FWJFW\gsar.cfxxe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788R22FWJFW\pev.exe' RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788R22FWJFW\n.pif' exec hide 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
'C:\32788R22FWJFW\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -k *sysguard.exe
'C:\32788R22FWJFW\iexplore.exe' win close ititle "SysInternals"
'C:\32788R22FWJFW\iexplore.exe' win close ititle " Security"
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\pev.exe -k * and { *Antivirus*Pro.exe or *Police*Pro.exe or svch[!o]st.exe or sv[!c]host.exe or winupdate.exe or or ANTI_files.exe or dbsinit.exe or ?.exe or desot.exe or desote.exe or *sysguard.exe or aap.exe or pump.exe os svcst.exe or seres.exe or *spyware.exe or new.exe or ave.exe or -preg"\d{3,}.exe" }
'C:\32788R22FWJFW\n.pif' shexec install 32788R22FWJFW\Prep.inf
'C:\32788R22FWJFW\pev.exe' -k * and { *Antivirus*Pro.exe or *Police*Pro.exe or svch[!o]st.exe or sv[!c]host.exe or winupdate.exe or or ANTI_files.exe or dbsinit.exe or ?.exe or desot.exe or desote.exe or *sysguard.exe or aap.exe or pump.exe os svcst.exe or seres.exe or *spyware.exe or new.exe or ave.exe or -preg"\d{3,}.exe" }
'C:\32788R22FWJFW\License\iexplore.exe' -k *sysguard.exe
'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
'C:\32788R22FWJFW\n.pif' cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788R22FWJFW\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788R22FWJFW\n.pif' shellcopy <SYSTEM32>\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
'C:\32788R22FWJFW\n.pif' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
'C:\32788R22FWJFW\NirCmd.cfxxe' shellcopy <SYSTEM32>\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
'C:\32788R22FWJFW\swxcacls.cfxxe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\SWXCACLS.cfxxe "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788R22FWJFW\n.pif' exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
'C:\32788R22FWJFW\n.pif' cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788R22FWJFW\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q

Executes the following:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\chcp.com' 1251
'<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 C:\32788R22FWJFW\Prep.inf
'<SYSTEM32>\runonce.exe' -r

Modifies file system :

Creates the following files:

C:\32788R22FWJFW\system_ini.dat
C:\32788R22FWJFW\svchost.w7.x64.dat
C:\32788R22FWJFW\vistareg.dat
C:\32788R22FWJFW\w2kreg.dat
C:\32788R22FWJFW\vun.dat
C:\32788R22FWJFW\svchost.w7.dat
C:\32788R22FWJFW\Safeboot.def.w7.dat
C:\32788R22FWJFW\safeboot.def.vista.dat
C:\32788R22FWJFW\svc_wht.dat
C:\32788R22FWJFW\svchost.vista.dat
C:\32788R22FWJFW\svchost.dat
C:\32788R22FWJFW\ERDNTWIN.LOC
C:\32788R22FWJFW\ERDNTDOS.LOC
C:\32788R22FWJFW\ERUNT.LOC
C:\32788R22FWJFW\files.pif
C:\32788R22FWJFW\srizbi.md5
C:\32788R22FWJFW\ERDNT.e_e
C:\32788R22FWJFW\xpreg.dat
C:\32788R22FWJFW\w7reg.dat
C:\32788R22FWJFW\zDomain.dat
C:\32788R22FWJFW\Thumbs.db
C:\32788R22FWJFW\zhsvc.dat
C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat
C:\32788R22FWJFW\LocalService.dat
C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat
C:\32788R22FWJFW\netsvc.bad.dat
C:\32788R22FWJFW\ndis_combofix.dat
C:\32788R22FWJFW\Fin.dat
C:\32788R22FWJFW\023w7.dat
C:\32788R22FWJFW\023v.dat
C:\32788R22FWJFW\Creg.dat
C:\32788R22FWJFW\Dnl.dat
C:\32788R22FWJFW\CregC.dat
C:\32788R22FWJFW\region.dat
C:\32788R22FWJFW\RCLink.dat
C:\32788R22FWJFW\rogues.dat
C:\32788R22FWJFW\safeboot.def.dat
C:\32788R22FWJFW\safeboot.dat
C:\32788R22FWJFW\Purity.dat
C:\32788R22FWJFW\netsvc.vista.dat
C:\32788R22FWJFW\netsvc.dat
C:\32788R22FWJFW\netsvc.xp.dat
C:\32788R22FWJFW\Policies.dat
C:\32788R22FWJFW\NetworkService.dat
C:\32788R22FWJFW\md5sum.pif
C:\32788R22FWJFW\VerCF.bat
C:\32788R22FWJFW\Set.txt
C:\32788R22FWJFW\SWREG.cfxxe
C:\32788R22FWJFW\N_\23057
C:\32788R22FWJFW\N_\25595
C:\32788R22FWJFW\WinNT00
C:\32788R22FWJFW\prep.done
C:\32788R22FWJFW\cmd.cfxxe
C:\32788R22FWJFW\OsVer
C:\32788R22FWJFW\N_\24565
C:\32788R22FWJFW\XP.mac
C:\32788R22FWJFW\NlsCodePageACP00
C:\32788R22FWJFW\N_\17924
C:\32788R22FWJFW\CHCP.bat
C:\32788R22FWJFW\NlsLanguageDefault
C:\32788R22FWJFW\NlsLanguage00
C:\32788R22FWJFW\N_\2971
C:\32788R22FWJFW\N_\9771
C:\32788R22FWJFW\NircmdB.exe
C:\32788R22FWJFW\pv.exe
C:\32788R22FWJFW\PEV.cfxxe
C:\32788R22FWJFW\pv.txt
C:\32788R22FWJFW\RegDo.sed
C:\32788R22FWJFW\REGDACL.sed
C:\32788R22FWJFW\run2.sed
C:\32788R22FWJFW\asp.str
C:\32788R22FWJFW\toolbar.sed
C:\32788R22FWJFW\embedded.sed
C:\32788R22FWJFW\n.pif
C:\32788R22FWJFW\md5sum00.pif
C:\32788R22FWJFW\Exe.reg
C:\32788R22FWJFW\ddsDo.sed
C:\32788R22FWJFW\XPSBoot.reg
C:\32788R22FWJFW\Wmi_rem.vbs
C:\32788R22FWJFW\SvcDrv.vbs
C:\32788R22FWJFW\image001.gif
C:\32788R22FWJFW\License\streamtools.zip
C:\32788R22FWJFW\License\pv_5_2_2.zip
C:\32788R22FWJFW\restore_pt.vbs
C:\32788R22FWJFW\Rust.str
C:\32788R22FWJFW\DPF.str
C:\32788R22FWJFW\av.vbs
C:\32788R22FWJFW\OSid.vbs
C:\32788R22FWJFW\lnkread.vbs
C:\32788R22FWJFW\CF-Script.cmd
C:\32788R22FWJFW\Catch-sub.cmd
C:\32788R22FWJFW\Create.cmd
C:\32788R22FWJFW\CSet.cmd
C:\32788R22FWJFW\CregC.cmd
C:\32788R22FWJFW\Boot-Rk.cmd
C:\32788R22FWJFW\Assoc.cmd
C:\32788R22FWJFW\SetEnvmt.bat
C:\32788R22FWJFW\Auto-RC.cmd
C:\32788R22FWJFW\AWF.cmd
C:\32788R22FWJFW\av.cmd
C:\32788R22FWJFW\P.cmd
C:\32788R22FWJFW\NT-OS.cmd
C:\32788R22FWJFW\RegScan.cmd
C:\32788R22FWJFW\Rkey.cmd
C:\32788R22FWJFW\RegScan64.cmd
C:\32788R22FWJFW\Kill-All.cmd
C:\32788R22FWJFW\FKMGen.cmd
C:\32788R22FWJFW\FD-SV.cmd
C:\32788R22FWJFW\GetHive.cmd
C:\32788R22FWJFW\katch.cmd
C:\32788R22FWJFW\Install-RC.cmd
C:\32788R22FWJFW\Boot.bat
C:\32788R22FWJFW\License\UnxUtilsDist.html
C:\32788R22FWJFW\c.bat
C:\32788R22FWJFW\DelClsid.bat
C:\32788R22FWJFW\Combobatch.bat
C:\32788R22FWJFW\License\Zip - license.txt
C:\32788R22FWJFW\License\dumphive-license.txt
C:\32788R22FWJFW\License\Curl - license.txt
C:\32788R22FWJFW\License\EXTRACT.TXT
C:\32788R22FWJFW\License\mtee.txt.txt
C:\32788R22FWJFW\License\FI - license.txt
C:\32788R22FWJFW\List-D.bat
C:\32788R22FWJFW\List-C.bat
C:\32788R22FWJFW\List.bat
C:\32788R22FWJFW\ND_.bat
C:\32788R22FWJFW\MoveIt.bat
C:\32788R22FWJFW\List-B.bat
C:\32788R22FWJFW\FIND3M.bat
C:\32788R22FWJFW\DelClsid64.bat
C:\32788R22FWJFW\FIXLSP.bat
C:\32788R22FWJFW\Lang.bat
C:\32788R22FWJFW\history.bat
C:\32788R22FWJFW\SnapShot.cmd
C:\32788R22FWJFW\handle.cfxxe
C:\32788R22FWJFW\gsar.cfxxe
C:\32788R22FWJFW\mbr.cfxxe
C:\32788R22FWJFW\License\ncmd.cfxxe
C:\32788R22FWJFW\mtee.cfxxe
C:\32788R22FWJFW\grep.cfxxe
C:\32788R22FWJFW\dumphive.cfxxe
C:\32788R22FWJFW\dd.cfxxe
C:\32788R22FWJFW\ERUNT.cfxxe
C:\32788R22FWJFW\FileKill.cfxxe
C:\32788R22FWJFW\extract.cfxxe
C:\32788R22FWJFW\tail.cfxxe
C:\32788R22FWJFW\swxcacls.cfxxe
C:\32788R22FWJFW\zip.cfxxe
C:\32788R22FWJFW\023.dat
C:\32788R22FWJFW\NirCmd.chm
C:\32788R22FWJFW\swsc.cfxxe
C:\32788R22FWJFW\NirCmd.cfxxe
C:\32788R22FWJFW\ncmd.cfxxe
C:\32788R22FWJFW\NirCmdC.cfxxe
C:\32788R22FWJFW\setpath.cfxxe
C:\32788R22FWJFW\sed.cfxxe
C:\32788R22FWJFW\hidec.exe
C:\32788R22FWJFW\pv.com
C:\32788R22FWJFW\iexplore.exe
C:\32788R22FWJFW\pev.exe
C:\32788R22FWJFW\License\iexplore.exe
C:\32788R22FWJFW\Prep.inf
C:\32788R22FWJFW\SuppScan.cmd
C:\32788R22FWJFW\SRestore.cmd
C:\32788R22FWJFW\Update-CF.cmd
C:\32788R22FWJFW\clsid.c
C:\32788R22FWJFW\badclsid.c
C:\32788R22FWJFW\VInfo
C:\32788R22FWJFW\hhdsh
C:\32788R22FWJFW\appinit.bad
C:\32788R22FWJFW\ComboFix-Download.cfxxe
C:\32788R22FWJFW\catchme.cfxxe
C:\32788R22FWJFW\Combo-Fix.sys
C:\32788R22FWJFW\BootSect.dll
C:\32788R22FWJFW\swreg.exe
C:\32788R22FWJFW\ffdefstr.dll
C:\32788R22FWJFW\w2k_sock.dll
C:\32788R22FWJFW\w_sock.dll

Sets the 'hidden' attribute to the following files:

C:\32788R22FWJFW\Thumbs.db

Deletes the following files:

C:\32788R22FWJFW\NlsCodePageACP00
C:\32788R22FWJFW\NlsLanguage00
C:\32788R22FWJFW\pv.txt
C:\32788R22FWJFW\WinNT00
C:\32788R22FWJFW\md5sum00.pif

Moves the following files:

from C:\32788R22FWJFW\pv.exe to C:\32788R22FWJFW\PV.cfxxe
from C:\32788R22FWJFW\ncmd.cfxxe to C:\32788R22FWJFW\ncmd.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial