Trojan.MulDrop27.58543

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ACC Sound 6.23.66] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ACC Sound 6.23.66] 'ImagePath' = '%ALLUSERSPROFILE%\ACC Sound 6.23.66\ACC Sound 6.23.66.exe'

Создает следующие сервисы

'ACC Sound 6.23.66' %ALLUSERSPROFILE%\ACC Sound 6.23.66\ACC Sound 6.23.66.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-auo64.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\free sound recorder\unins000.dat
%LOCALAPPDATA%\free sound recorder\is-bpcvv.tmp
%LOCALAPPDATA%\free sound recorder\is-0h6kf.tmp
%LOCALAPPDATA%\free sound recorder\is-55bt0.tmp
%LOCALAPPDATA%\free sound recorder\is-k3pev.tmp
%LOCALAPPDATA%\free sound recorder\is-0j9s7.tmp
%LOCALAPPDATA%\free sound recorder\is-uesca.tmp
%LOCALAPPDATA%\free sound recorder\is-k607v.tmp
%LOCALAPPDATA%\free sound recorder\is-j9p1o.tmp
%LOCALAPPDATA%\free sound recorder\is-ki6av.tmp
%LOCALAPPDATA%\free sound recorder\is-j3gnr.tmp
%LOCALAPPDATA%\free sound recorder\is-b79q3.tmp
%LOCALAPPDATA%\free sound recorder\is-aakcc.tmp
%LOCALAPPDATA%\free sound recorder\is-9ojeg.tmp
%LOCALAPPDATA%\free sound recorder\is-p4v4c.tmp
%LOCALAPPDATA%\free sound recorder\is-l6cfj.tmp
%LOCALAPPDATA%\free sound recorder\is-8ane3.tmp
%LOCALAPPDATA%\free sound recorder\is-vnod1.tmp
%LOCALAPPDATA%\free sound recorder\is-rkqj2.tmp
%LOCALAPPDATA%\free sound recorder\is-gen8n.tmp
%TEMP%\is-qjmq3.tmp\_isetup\_iscrypt.dll
%TEMP%\is-qjmq3.tmp\_isetup\_isdecmp.dll
%TEMP%\is-qjmq3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qjmq3.tmp\_isetup\_setup64.tmp
%TEMP%\is-qjmq3.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\free sound recorder\soundrecorder32_64.exe
%ALLUSERSPROFILE%\acc sound 6.23.66\acc sound 6.23.66.exe

Перемещает следующие файлы

%LOCALAPPDATA%\free sound recorder\is-gen8n.tmp в %LOCALAPPDATA%\free sound recorder\unins000.exe
%LOCALAPPDATA%\free sound recorder\is-55bt0.tmp в %LOCALAPPDATA%\free sound recorder\proportions.txt
%LOCALAPPDATA%\free sound recorder\is-k3pev.tmp в %LOCALAPPDATA%\free sound recorder\openh264_license.txt
%LOCALAPPDATA%\free sound recorder\is-0j9s7.tmp в %LOCALAPPDATA%\free sound recorder\qtavwidgets1.dll
%LOCALAPPDATA%\free sound recorder\is-uesca.tmp в %LOCALAPPDATA%\free sound recorder\qt5xml.dll
%LOCALAPPDATA%\free sound recorder\is-k607v.tmp в %LOCALAPPDATA%\free sound recorder\qt5winextras.dll
%LOCALAPPDATA%\free sound recorder\is-j9p1o.tmp в %LOCALAPPDATA%\free sound recorder\qt5svg.dll
%LOCALAPPDATA%\free sound recorder\is-ki6av.tmp в %LOCALAPPDATA%\free sound recorder\qt5opengl.dll
%LOCALAPPDATA%\free sound recorder\is-0h6kf.tmp в %LOCALAPPDATA%\free sound recorder\libeay32.dll
%LOCALAPPDATA%\free sound recorder\is-j3gnr.tmp в %LOCALAPPDATA%\free sound recorder\openh264.dll
%LOCALAPPDATA%\free sound recorder\is-aakcc.tmp в %LOCALAPPDATA%\free sound recorder\msvcp140_1.dll
%LOCALAPPDATA%\free sound recorder\is-9ojeg.tmp в %LOCALAPPDATA%\free sound recorder\msvcp140.dll
%LOCALAPPDATA%\free sound recorder\is-p4v4c.tmp в %LOCALAPPDATA%\free sound recorder\msvcp120.dll
%LOCALAPPDATA%\free sound recorder\is-l6cfj.tmp в %LOCALAPPDATA%\free sound recorder\mousehelper.dll
%LOCALAPPDATA%\free sound recorder\is-8ane3.tmp в %LOCALAPPDATA%\free sound recorder\libmp3lame.dll
%LOCALAPPDATA%\free sound recorder\is-vnod1.tmp в %LOCALAPPDATA%\free sound recorder\libcurl.dll
%LOCALAPPDATA%\free sound recorder\is-rkqj2.tmp в %LOCALAPPDATA%\free sound recorder\avdevice-58.dll
%LOCALAPPDATA%\free sound recorder\is-b79q3.tmp в %LOCALAPPDATA%\free sound recorder\msvcr120.dll
%LOCALAPPDATA%\free sound recorder\is-bpcvv.tmp в %LOCALAPPDATA%\free sound recorder\soundrecorder32_64.exe

Другое

Ищет следующие окна

ClassName: '' WindowName: 'j1427d_Flash6233FixClass_j1427d'

Создает и запускает на исполнение

'%TEMP%\is-auo64.tmp\<Имя файла>.tmp' /SL5="$80234,5398586,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\free sound recorder\soundrecorder32_64.exe' -i
'%LOCALAPPDATA%\free sound recorder\soundrecorder32_64.exe' -s