Trojan.MulDrop27.2717

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

изменяет следующие системные настройки:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000000'

Изменения в файловой системе

Создает следующие файлы

C:\shaolin\idm193.exe
%TEMP%\idmregclean.reg
%TEMP%\batclen.bat
nul
%TEMP%\reg144b.tmp
%WINDIR%\temp\_backup_hkcu_clsid_20240426-150157021.reg

Удаляет следующие файлы

%TEMP%\idmregclean.reg
%TEMP%\reg144b.tmp
C:\shaolin\idm193.exe

Другое

Создает и запускает на исполнение

'C:\shaolin\idm193.exe' -silent -noupdate

Запускает на исполнение

'%WINDIR%\syswow64\reg.exe' import %TEMP%\IDMRegClean.reg
'<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f
'%WINDIR%\syswow64\cmd.exe' /c powershell.exe "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "(Get-Date).ToString('yyyyMMdd-HHmmssfff')"
'<SYSTEM32>\reg.exe' export HKCU\Software\Classes\Wow6432Node\CLSID "%WINDIR%\Temp\_Backup_HKCU_CLSID_20240426-150157021.reg"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "Email"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "Serial"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "scansk"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "tvfrdt"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "radxcnt"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "LstCheck"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "ptrk_scdt"
'<SYSTEM32>\reg.exe' query "HKCU\Software\DownloadManager" "/v" "LastCheckQU"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$sid = 'S-1-5-21-1238866942-1249195528-555854008-1000'; $HKCUsync = 1; $lockKey = $null; $deleteKey = 1; $f=[io.file]::ReadAllText('%TEMP%\BATCLEN.bat') -split ':regscan\:.*';iex ($f[1])"
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\reg.exe' ADD "HKLM\Software\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\Software\WOW6432Node\Internet Download Manager" /v "AdvIntDriverEnabled2" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' ADD "HKCU\Software\DownloadManager" /v "nLst" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' ADD "HKCU\Software\DownloadManager" /v "LName" /t REG_SZ /d " " /f
'<SYSTEM32>\reg.exe' query HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
'<SYSTEM32>\reg.exe' ADD "HKCU\Software\DownloadManager" /v "FName" /t REG_SZ /d "user" /f
'<SYSTEM32>\reg.exe' add HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software\DownloadManager" /v ExePath 2>nul
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\BATCLEN.bat"
'%WINDIR%\syswow64\cmd.exe' /c ver
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo "%TEMP%\BATCLEN.bat" "
'<SYSTEM32>\find.exe' /i "%LOCALAPPDATA%\Temp"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "$f=[io.file]::ReadAllText('%TEMP%\BATCLEN.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
'<SYSTEM32>\find.exe' /i "FullLanguage"
'<SYSTEM32>\reg.exe' query HKCU\Console /v QuickEdit
'<SYSTEM32>\find.exe' /i "0x0"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"
'<SYSTEM32>\find.exe' /i "computersystem"
'%WINDIR%\syswow64\cmd.exe' /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"
'<SYSTEM32>\reg.exe' query HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software
'<SYSTEM32>\reg.exe' delete HKCU\IAS_TEST /f
'<SYSTEM32>\reg.exe' delete HKU\S-1-5-21-1238866942-1249195528-555854008-1000\IAS_TEST /f
'<SYSTEM32>\reg.exe' add HKCU\IAS_TEST
'<SYSTEM32>\reg.exe' query HKU\S-1-5-21-1238866942-1249195528-555854008-1000\IAS_TEST
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
'<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
'<SYSTEM32>\reg.exe' query "HKU\S-1-5-21-1238866942-1249195528-555854008-1000\Software\DownloadManager" /v ExePath
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' write-host -back '"DarkGreen"' -fore '"white"' '"The IDM reset process has been completed."'