Trojan.MulDrop12.26357

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

изменяет следующие системные настройки:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoShellSearchButton' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDeletePrinter' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartmenuLogoff' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoAddPrinter' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000000'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\app\portabledata\settings.ini
%TEMP%\is-lpuk7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-lpuk7.tmp\_isetup\_setup64.tmp
%TEMP%\is-lpuk7.tmp\_isetup\_regdll.tmp
%TEMP%\is-3q97i.tmp\wintoolsnetportable.tmp
%TEMP%\7zipsfx.000\wintoolsnetportable.exe
%TEMP%\7zipsfx.000\sert.cer
%TEMP%\7zipsfx.000\app\wintools.net\wintoolspro.xml
%TEMP%\7zipsfx.000\app\wintools.net\wintoolspremium.xml
%TEMP%\7zipsfx.000\app\wintools.net\wintoolsnet.ini
%TEMP%\7zipsfx.000\app\wintools.net\wintoolsnet.exe
%TEMP%\7zipsfx.000\app\wintools.net\wintools.xml
%TEMP%\7zipsfx.000\app\wintools.net\regs\photoviewer.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\fix-lnk.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\fix-ico.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\fix-folder.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\fix-exe.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\fix-drive.reg
%TEMP%\7zipsfx.000\app\wintools.net\regs\blank.ico
%TEMP%\7zipsfx.000\app\wintools.net\language.exe
%TEMP%\7zipsfx.000\app\wintools.net\lang\ukrainian.lng
%TEMP%\7zipsfx.000\app\wintools.net\lang\russian.lng
%TEMP%\7zipsfx.000\app\wintools.net\lang\english.lng
%TEMP%\7zipsfx.000\app\wintools.net\lang\belarusian.lng
%TEMP%\is-lpuk7.tmp\_isetup\_iscrypt.dll
%TEMP%\7zipsfx.000\app\wintools.net\lang\default.lng

Другое

Добавляет корневой сертификат

Ищет следующие окна

ClassName: '' WindowName: 'В«WinTools.net Portable Launcher (DodakaedrВ©2020)В»'
ClassName: 'WINTOOLSNETCLASS' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\wintoolsnetportable.exe'
'%TEMP%\is-3q97i.tmp\wintoolsnetportable.tmp' /SL5="$C020C,108128,108032,%TEMP%\7ZipSfx.000\WinToolsNetPortable.exe"
'%TEMP%\7zipsfx.000\app\wintools.net\wintoolsnet.exe'
'<SYSTEM32>\cmd.exe' /c if exist <SYSTEM32>\certutil.exe (certutil -addstore root Sert.cer)' (со скрытым окном)
'%TEMP%\7zipsfx.000\wintoolsnetportable.exe' ' (со скрытым окном)

Запускает на исполнение