Trojan.MulDrop11.18941

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'upgrade' = '%APPDATA%\sysupgrades.exe'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei22922\vcruntime140.dll
%TEMP%\_mei22922\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei22922\pyexpat.pyd
%TEMP%\_mei22922\python36.dll
%TEMP%\_mei22922\select.pyd
%TEMP%\_mei22922\test.exe.manifest
%TEMP%\_mei22922\ucrtbase.dll
%TEMP%\_mei22922\unicodedata.pyd
%TEMP%\_mei22922\sm.pdf
%TEMP%\_mei22922\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei22922\base_library.zip
%TEMP%\_mei22922\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei22922\_bz2.pyd
%TEMP%\_mei22922\_hashlib.pyd
%TEMP%\_mei22922\_lzma.pyd
%TEMP%\_mei22922\_socket.pyd
%TEMP%\_mei22922\_ssl.pyd
%TEMP%\_mei22922\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei22922\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei22922\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-string-l1-1-0.dll
%APPDATA%\sysupgrades.exe

Удаляет следующие файлы

%TEMP%\_mei22922\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei22922\base_library.zip
%TEMP%\_mei22922\_socket.pyd
%TEMP%\_mei22922\pyexpat.pyd
%TEMP%\_mei22922\python36.dll
%TEMP%\_mei22922\select.pyd
%TEMP%\_mei22922\test.exe.manifest
%TEMP%\_mei22922\ucrtbase.dll
%TEMP%\_mei22922\unicodedata.pyd
%TEMP%\_mei22922\vcruntime140.dll
%TEMP%\_mei22922\_bz2.pyd
%TEMP%\_mei22922\_hashlib.pyd
%TEMP%\_mei22922\_lzma.pyd
%TEMP%\_mei22922\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei22922\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei22922\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei22922\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei22922\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei22922\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei22922\_ssl.pyd

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v upgrade /t REG_SZ /d %APPDATA%\sysupgrades.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI22922\SM.pdf"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v upgrade /t REG_SZ /d %APPDATA%\sysupgrades.exe"
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v upgrade /t REG_SZ /d %APPDATA%\sysupgrades.exe
'<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI22922\SM.pdf"
'%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\_MEI22922\SM.pdf"