Trojan.MulDrop16.35891

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\AutoHotkeyScript\Shell\Open\Command] '' = '"%ProgramFiles%\AutoHotkey\AutoHotkey.exe" "%1" %*'
[<HKLM>\Software\Classes\AutoHotkeyScript\Shell\Open\Command] '' = '"C:\Programs\AutoHotkey\AutoHotkey.exe" "%1" %*'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\autohotkey\autohotkey website.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\autohotkey setup.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\convert .ahk to .exe.lnk
nul
C:\programs\autohotkey\autohotkey website.url
C:\programs\autohotkey\autohotkey.chm
C:\programs\autohotkey\autohotkey.exe
C:\programs\autohotkey\autohotkeya32.exe
C:\programs\autohotkey\autohotkeyu32.exe
C:\programs\autohotkey\autohotkeyu64.exe
C:\programs\autohotkey\installer.ahk
%ProgramFiles%\autohotkey\autohotkey website.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\website.lnk
C:\programs\autohotkey\license.txt
C:\programs\autohotkey\compiler\ahk2exe.exe
C:\programs\autohotkey\compiler\ansi 32-bit.bin
C:\programs\autohotkey\compiler\autohotkeysc.bin
C:\programs\autohotkey\compiler\readme.txt
C:\programs\autohotkey\compiler\unicode 32-bit.bin
C:\programs\autohotkey\compiler\unicode 64-bit.bin
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\database compare.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\office language preferences.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\skype for business recording manager.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\spreadsheet compare.lnk
C:\programs\autohotkey\template.ahk
C:\programs\autohotkey\windowspy.ahk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\autohotkey help file.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\window spy.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\autohotkey\autohotkey.lnk
%TEMP%\7zipsfx.000\autohotkey\compiler\ansi 32-bit.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\autohotkeysc.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\readme.txt
%TEMP%\7zipsfx.000\autohotkey\compiler\unicode 32-bit.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\unicode 64-bit.bin
%TEMP%\7zipsfx.000\autohotkey\installer.ahk
%TEMP%\7zipsfx.000\autohotkey\license.txt
%TEMP%\7zipsfx.000\autohotkey\template.ahk
%TEMP%\7zipsfx.000\autohotkey\windowspy.ahk
%TEMP%\7zipsfx.000\microsoft office tools\database compare.lnk
%TEMP%\7zipsfx.000\microsoft office tools\office language preferences.lnk
%TEMP%\7zipsfx.000\autohotkey\autohotkey.chm
%TEMP%\7zipsfx.000\microsoft office tools\skype for business recording manager.lnk
%TEMP%\7zipsfx.000\microsoft office tools\telemetry dashboard for office.lnk
%TEMP%\7zipsfx.000\microsoft office tools\telemetry log for office.lnk
%TEMP%\7zipsfx.000\installer.ahk
%TEMP%\7zipsfx.000\autohotkey.cmd
%TEMP%\7zipsfx.000\autohotkey\autohotkey.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeya32.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeyu32.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeyu64.exe
%TEMP%\7zipsfx.000\autohotkey\compiler\ahk2exe.exe
%TEMP%\7zipsfx.000\setup.exe
%ProgramFiles%\autohotkey\installer.ahk
%TEMP%\7zipsfx.000\microsoft office tools\spreadsheet compare.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\telemetry dashboard for office.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office tools\telemetry log for office.lnk

Удаляет следующие файлы

%TEMP%\7zipsfx.000\autohotkey\autohotkey website.url
%TEMP%\7zipsfx.000\microsoft office tools\telemetry dashboard for office.lnk
%TEMP%\7zipsfx.000\microsoft office tools\spreadsheet compare.lnk
%TEMP%\7zipsfx.000\microsoft office tools\skype for business recording manager.lnk
%TEMP%\7zipsfx.000\microsoft office tools\office language preferences.lnk
%TEMP%\7zipsfx.000\microsoft office tools\database compare.lnk
%TEMP%\7zipsfx.000\installer.ahk
%TEMP%\7zipsfx.000\autohotkey.cmd
%TEMP%\7zipsfx.000\autohotkey\windowspy.ahk
%TEMP%\7zipsfx.000\autohotkey\template.ahk
%TEMP%\7zipsfx.000\autohotkey\license.txt
%TEMP%\7zipsfx.000\microsoft office tools\telemetry log for office.lnk
%TEMP%\7zipsfx.000\autohotkey\installer.ahk
%TEMP%\7zipsfx.000\autohotkey\compiler\unicode 32-bit.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\readme.txt
%TEMP%\7zipsfx.000\autohotkey\compiler\autohotkeysc.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\ansi 32-bit.bin
%TEMP%\7zipsfx.000\autohotkey\compiler\ahk2exe.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeyu64.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeyu32.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkeya32.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkey.exe
%TEMP%\7zipsfx.000\autohotkey\autohotkey.chm
%TEMP%\7zipsfx.000\autohotkey\compiler\unicode 64-bit.bin
%TEMP%\7zipsfx.000\setup.exe

Другое

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\setup.exe' /S
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\AutoHotkey.cmd" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\AutoHotkey.cmd" "
'%WINDIR%\syswow64\timeout.exe' /t 1
'%WINDIR%\syswow64\reg.exe' delete "HKCR\AutoHotkeyScript\Shell" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell" /ve /t REG_SZ /d "Open" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Compile" /ve /t REG_SZ /d "ahk ╚В«└σ└┌ EXE╖╬ ╕╕╡Θ▒Γ" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Compile\Command" /ve /t REG_SZ /d "\"C:\Programs\AutoHotkey\Compiler\Ahk2Exe.exe\" /in \"%l\" %*" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Edit" /ve /t REG_SZ /d "ahk ╚В«└σ└┌ ╕▐╕≡└σ 2╖╬ ┐ВЎ▒Γ" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Edit\Command" /ve /t REG_SZ /d "C:\Programs\╣В«╝ВЎ └█╝║ ┐└╟╟╜║\Release_x64\NotePad2.exe %1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Open" /ve /t REG_SZ /d "ahk ╞─└╧ ┐ВЎ▒Γ" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\AutoHotkeyScript\Shell\Open\Command" /ve /t REG_SZ /d "\"C:\Programs\AutoHotkey\AutoHotkey.exe\" \"%1\" %*" /f
'%WINDIR%\syswow64\xcopy.exe' "AutoHotkey\." "\Programs\AutoHotkey\" /cheriky
'%WINDIR%\syswow64\xcopy.exe' "Microsoft Office Tools\." "\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools" /cheriky