Trojan.MulDrop12.26084

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\net.exe' stop sppsvc /y
'<SYSTEM32>\net.exe' stop osppsvc /y

Изменения в файловой системе

Создает следующие файлы

C:\temp\kms-activator-master\clean.cmd
C:\temp\kms-activator-master\auto_kms_2018.cmd
C:\temp\kms-activator-master\auto_kms-activator-master.cmd
C:\temp\kms-activator-master\auto.cmd
C:\temp\kms-activator-master\x64\sppextcomobjhook.dll
C:\temp\kms-activator-master\win32\key.cmd
C:\temp\kms-activator-master\win32\sppextcomobjhook.dll
C:\temp\kms-activator-master\win32\svctrigger.xml
nul
%WINDIR%\syswow64\sppextcomobjhook.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""C:\Temp\KMS-Activator-Master\Auto.cmd" "
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d 172.16.0.2
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d 1688
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 256
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
'<SYSTEM32>\findstr.exe' /i Office
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
'%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
'%WINDIR%\syswow64\cmd.exe' /c "WMIC PATH SoftwareLicensingService GET Version /VALUE"
'<SYSTEM32>\wbem\wmic.exe' PATH SoftwareLicensingService GET Version /VALUE
'<SYSTEM32>\wbem\wmic.exe' PATH SoftwareLicensingProduct WHERE (Name like 'Windows%' and PartialProductKey is not NULL) CALL Activate
'<SYSTEM32>\wbem\wmic.exe' PATH SoftwareLicensingService WHERE version='6.1.7601.17514' CALL RefreshLicenseStatus
'<SYSTEM32>\wbem\wmic.exe' PATH SoftwareLicensingProduct WHERE LicenseStatus=1 GET Name
'<SYSTEM32>\findstr.exe' /i "Windows"
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name
'<SYSTEM32>\findstr.exe' /i Windows
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version
'%WINDIR%\syswow64\mode.com' con cols=100 lines=30
'%WINDIR%\syswow64\cmd.exe' /c ver
'<SYSTEM32>\find.exe' /i "STOPPED"
'<SYSTEM32>\net1.exe' stop sppsvc /y
'<SYSTEM32>\sc.exe' query osppsvc
'<SYSTEM32>\net1.exe' stop osppsvc /y
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 256
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
'<SYSTEM32>\sc.exe' query sppsvc
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version /VALUE
'<SYSTEM32>\attrib.exe' -R -A -S -H *.*