Trojan.MulDrop9.30746

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\at.exe'

Изменения в файловой системе

Создает следующие файлы

C:\inspect\sbbxtsouklw-log
C:\inspect\sbbxtsouklw-network\arp
C:\inspect\sbbxtsouklw-schtasks\at
C:\inspect\sbbxtsouklw-network\net_use
C:\inspect\sbbxtsouklw-registry\system
C:\inspect\sbbxtsouklw-registry\sam
C:\inspect\sbbxtsouklw-registry\software
C:\inspect\sbbxtsouklw-ntuser\_documents and settings_default user_ntuser.dat
C:\inspect\sbbxtsouklw-event\system\secondary\odiag.evt
C:\inspect\sbbxtsouklw-ntuser\_documents and settings_localservice_ntuser.dat
C:\inspect\sbbxtsouklw-ntuser\_documents and settings_networkservice_ntuser.dat
C:\inspect\sbbxtsouklw-ntuser\_documents and settings_user_ntuser.dat
C:\inspect\sbbxtsouklw-event\system\appevent.evt
C:\inspect\sbbxtsouklw-event\system\secevent.evt
C:\inspect\sbbxtsouklw-event\system\sysevent.evt
C:\inspect\sbbxtsouklw-schtasks\schtasks
C:\inspect\sbbxtsouklw-registry\hardware
C:\inspect\sbbxtsouklw-tasklist\tasklist_svc
C:\inspect\sbbxtsouklw-disk\mft\mft_phys0part4
C:\inspect\sbbxtsouklw-disk\partition_table\mbr_phys0
C:\inspect\sbbxtsouklw-disk\partition_table\mbr_phys1
C:\inspect\sbbxtsouklw-disk\boot_sector\boot_sector_phys0_part_0
C:\inspect\sbbxtsouklw-disk\boot_sector\boot_sector_phys0_part_1
C:\inspect\sbbxtsouklw-disk\boot_sector\boot_sector_phys0_part_4
C:\inspect\sbbxtsouklw-disk\mft\mft_phys0part0
C:\inspect\sbbxtsouklw-network\netstat_a
C:\inspect\sbbxtsouklw-tasklist\tasklist
C:\inspect\sbbxtsouklw-network\netstat_b
C:\inspect\hashdeep.exe
C:\inspect\sbbxtsouklw-autoruns\launcher_files\system.ini
C:\inspect\sbbxtsouklw-autoruns\launcher_files\win.ini
C:\inspect\sbbxtsouklw-network\ipconfig_dns
C:\inspect\sbbxtsouklw-network\ipconfig_all
C:\inspect\sbbxtsouklw-tasklist\tasklist_mod
C:\inspect\sbbxtsouklw-event\system\secondary\osession.evt

Удаляет следующие файлы

C:\inspect\hashdeep.exe

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'C:\inspect\hashdeep.exe' -r -c sha256 "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" "%ALLUSERSPROFILE%\Start Menu\Programs\StartUp\" "C:\wmiOWS\Start Menu\Programs\StartUp\" "C:\WINNT\Profiles\All Us...

Запускает на исполнение

'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-PROCESSES""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-REGISTRY""
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\SYSTEM "C:\Inspect\sbbxtsouklw-REGISTRY\SYSTEM""
'<SYSTEM32>\reg.exe' save HKLM\SYSTEM "C:\Inspect\sbbxtsouklw-REGISTRY\SYSTEM"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\SAM "C:\Inspect\sbbxtsouklw-REGISTRY\SAM""
'<SYSTEM32>\reg.exe' save HKLM\SAM "C:\Inspect\sbbxtsouklw-REGISTRY\SAM"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\SECURITY "C:\Inspect\sbbxtsouklw-REGISTRY\SECURITY""
'<SYSTEM32>\reg.exe' save HKLM\SECURITY "C:\Inspect\sbbxtsouklw-REGISTRY\SECURITY"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\SOFTWARE "C:\Inspect\sbbxtsouklw-REGISTRY\SOFTWARE""
'<SYSTEM32>\reg.exe' save HKLM\SOFTWARE "C:\Inspect\sbbxtsouklw-REGISTRY\SOFTWARE"
'<SYSTEM32>\cmd.exe' "net.exe USE"
'<SYSTEM32>\net.exe' USE
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\Schema "C:\Inspect\sbbxtsouklw-REGISTRY\Schema""
'<SYSTEM32>\reg.exe' save HKLM\COMPONENTS "C:\Inspect\sbbxtsouklw-REGISTRY\COMPONENTS"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\BCD00000000 "C:\Inspect\sbbxtsouklw-REGISTRY\BCD00000000""
'<SYSTEM32>\reg.exe' save HKLM\BCD00000000 "C:\Inspect\sbbxtsouklw-REGISTRY\BCD00000000"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\HARDWARE "C:\Inspect\sbbxtsouklw-REGISTRY\HARDWARE""
'<SYSTEM32>\reg.exe' save HKLM\HARDWARE "C:\Inspect\sbbxtsouklw-REGISTRY\HARDWARE"
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-NTUSER""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-EVENT\SYSTEM""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-EVENT\SYSTEM\SECONDARY""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-INTERNET HISTORY\CHROME""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-INTERNET HISTORY\OPERA""
'<SYSTEM32>\reg.exe' save HKLM\Schema "C:\Inspect\sbbxtsouklw-REGISTRY\Schema"
'<SYSTEM32>\cmd.exe' "reg.exe save HKLM\COMPONENTS "C:\Inspect\sbbxtsouklw-REGISTRY\COMPONENTS""
'<SYSTEM32>\cmd.exe' "at.exe "
'<SYSTEM32>\arp.exe' -a
'<SYSTEM32>\cmd.exe' "arp.exe -a"
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-DISK\BOOT_SECTOR\""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-DISK\MFT""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-NETWORK""
'<SYSTEM32>\cmd.exe' "netstat.exe -a"
'<SYSTEM32>\netstat.exe' -a
'<SYSTEM32>\cmd.exe' "netstat.exe -anob"
'<SYSTEM32>\netstat.exe' -anob
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-AUTORUNS""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-AUTORUNS\LAUNCHER_FILES""
'<SYSTEM32>\cmd.exe' ""C:\Inspect\hashdeep.exe" -r -c sha256 "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" "%ALLUSERSPROFILE%\Start Menu\Programs\StartUp\" "C:\wmiOWS\Start Menu\Programs\StartUp\...
'<SYSTEM32>\cmd.exe' "ipconfig.exe /displaydns"
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-DISK\PARTITION_TABLE""
'<SYSTEM32>\ipconfig.exe' /displaydns
'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-TASKLIST""
'<SYSTEM32>\cmd.exe' "tasklist.exe -v /fo csv"
'<SYSTEM32>\tasklist.exe' -v /fo csv
'<SYSTEM32>\cmd.exe' "tasklist.exe /M /fo csv"
'<SYSTEM32>\tasklist.exe' /M /fo csv
'<SYSTEM32>\cmd.exe' "tasklist.exe /SVC /fo csv"
'<SYSTEM32>\tasklist.exe' /SVC /fo csv
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-SCHTASKS""
'<SYSTEM32>\cmd.exe' "schtasks.exe /QUERY"
'<SYSTEM32>\schtasks.exe' /QUERY
'<SYSTEM32>\cmd.exe' "ipconfig.exe /all"
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-INTERNET HISTORY\FIREFOX""
'<SYSTEM32>\cmd.exe' "mkdir "C:\Inspect\sbbxtsouklw-INTERNET HISTORY\OLD_IE""