Trojan.MulDrop7.28045

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Malicious functions:

Executes the following:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\runonce.exe' -r
'%TEMP%\7ZipSfx.000\runinf.exe' DefaultInstall 128 .\dxrt.inf

Modifies file system:

Creates the following files:

<SYSTEM32>\SET18.tmp
<SYSTEM32>\SET17.tmp
<SYSTEM32>\SET1A.tmp
<SYSTEM32>\SET19.tmp
<SYSTEM32>\SET16.tmp
<SYSTEM32>\SET13.tmp
<SYSTEM32>\SET12.tmp
<SYSTEM32>\SET15.tmp
<SYSTEM32>\SET14.tmp
<SYSTEM32>\SET1B.tmp
<SYSTEM32>\SET22.tmp
<SYSTEM32>\SET21.tmp
<SYSTEM32>\SET24.tmp
<SYSTEM32>\SET23.tmp
<SYSTEM32>\SET20.tmp
<SYSTEM32>\SET1D.tmp
<SYSTEM32>\SET1C.tmp
<SYSTEM32>\SET1F.tmp
<SYSTEM32>\SET1E.tmp
<SYSTEM32>\SET5.tmp
<SYSTEM32>\SET4.tmp
<SYSTEM32>\SET7.tmp
<SYSTEM32>\SET6.tmp
<SYSTEM32>\SET3.tmp
%TEMP%\7ZipSfx.000\xinput1_3.dll
%TEMP%\7ZipSfx.000\xinput1_2.dll
%TEMP%\7ZipSfx.000\dxrt.inf
%TEMP%\7ZipSfx.000\xinput9_1_0.dll
<SYSTEM32>\SET8.tmp
<SYSTEM32>\SETF.tmp
<SYSTEM32>\SETE.tmp
<SYSTEM32>\SET11.tmp
<SYSTEM32>\SET10.tmp
<SYSTEM32>\SETD.tmp
<SYSTEM32>\SETA.tmp
<SYSTEM32>\SET9.tmp
<SYSTEM32>\SETC.tmp
<SYSTEM32>\SETB.tmp
<SYSTEM32>\SET25.tmp
<SYSTEM32>\SET3F.tmp
<SYSTEM32>\SET3E.tmp
<SYSTEM32>\SET41.tmp
<SYSTEM32>\SET40.tmp
<SYSTEM32>\SET3D.tmp
<SYSTEM32>\SET3A.tmp
<SYSTEM32>\SET39.tmp
<SYSTEM32>\SET3C.tmp
<SYSTEM32>\SET3B.tmp
<SYSTEM32>\SET42.tmp
<SYSTEM32>\SET49.tmp
<SYSTEM32>\SET48.tmp
<SYSTEM32>\SET4B.tmp
<SYSTEM32>\SET4A.tmp
<SYSTEM32>\SET47.tmp
<SYSTEM32>\SET44.tmp
<SYSTEM32>\SET43.tmp
<SYSTEM32>\SET46.tmp
<SYSTEM32>\SET45.tmp
<SYSTEM32>\SET2C.tmp
<SYSTEM32>\SET2B.tmp
<SYSTEM32>\SET2E.tmp
<SYSTEM32>\SET2D.tmp
<SYSTEM32>\SET2A.tmp
<SYSTEM32>\SET27.tmp
<SYSTEM32>\SET26.tmp
<SYSTEM32>\SET29.tmp
<SYSTEM32>\SET28.tmp
<SYSTEM32>\SET2F.tmp
<SYSTEM32>\SET36.tmp
<SYSTEM32>\SET35.tmp
<SYSTEM32>\SET38.tmp
<SYSTEM32>\SET37.tmp
<SYSTEM32>\SET34.tmp
<SYSTEM32>\SET31.tmp
<SYSTEM32>\SET30.tmp
<SYSTEM32>\SET33.tmp
<SYSTEM32>\SET32.tmp
%TEMP%\7ZipSfx.000\xinput1_1.dll
%TEMP%\7ZipSfx.000\d3dx9_25.dll
%TEMP%\7ZipSfx.000\d3dx9_24.dll
%TEMP%\7ZipSfx.000\d3dx9_27.dll
%TEMP%\7ZipSfx.000\d3dx9_26.dll
%TEMP%\7ZipSfx.000\d3dx11_42.dll
%TEMP%\7ZipSfx.000\d3dx10_40.dll
%TEMP%\7ZipSfx.000\d3dx10_39.dll
%TEMP%\7ZipSfx.000\d3dx10_42.dll
%TEMP%\7ZipSfx.000\d3dx10_41.dll
%TEMP%\7ZipSfx.000\d3dx9_28.dll
%TEMP%\7ZipSfx.000\d3dx9_35.dll
%TEMP%\7ZipSfx.000\d3dx9_34.dll
%TEMP%\7ZipSfx.000\d3dx9_37.dll
%TEMP%\7ZipSfx.000\d3dx9_36.dll
%TEMP%\7ZipSfx.000\d3dx9_33.dll
%TEMP%\7ZipSfx.000\d3dx9_30.dll
%TEMP%\7ZipSfx.000\d3dx9_29.dll
%TEMP%\7ZipSfx.000\d3dx9_32.dll
%TEMP%\7ZipSfx.000\d3dx9_31.dll
%TEMP%\7ZipSfx.000\d3dcompiler_38.dll
%TEMP%\7ZipSfx.000\d3dcompiler_37.dll
%TEMP%\7ZipSfx.000\d3dcompiler_40.dll
%TEMP%\7ZipSfx.000\d3dcompiler_39.dll
%TEMP%\7ZipSfx.000\d3dcompiler_36.dll
%TEMP%\7ZipSfx.000\d3dcompiler_33.dll
%TEMP%\7ZipSfx.000\runinf.exe
%TEMP%\7ZipSfx.000\d3dcompiler_35.dll
%TEMP%\7ZipSfx.000\d3dcompiler_34.dll
%TEMP%\7ZipSfx.000\d3dcompiler_41.dll
%TEMP%\7ZipSfx.000\d3dx10_36.dll
%TEMP%\7ZipSfx.000\d3dx10_35.dll
%TEMP%\7ZipSfx.000\d3dx10_38.dll
%TEMP%\7ZipSfx.000\d3dx10_37.dll
%TEMP%\7ZipSfx.000\d3dx10_34.dll
%TEMP%\7ZipSfx.000\d3dcsx_42.dll
%TEMP%\7ZipSfx.000\d3dcompiler_42.dll
%TEMP%\7ZipSfx.000\d3dx10_33.dll
%TEMP%\7ZipSfx.000\d3dx10.dll
%TEMP%\7ZipSfx.000\d3dx9_38.dll
%TEMP%\7ZipSfx.000\xactengine3_3.dll
%TEMP%\7ZipSfx.000\xactengine3_2.dll
%TEMP%\7ZipSfx.000\xactengine3_5.dll
%TEMP%\7ZipSfx.000\xactengine3_4.dll
%TEMP%\7ZipSfx.000\xactengine3_1.dll
%TEMP%\7ZipSfx.000\xactengine2_8.dll
%TEMP%\7ZipSfx.000\xactengine2_7.dll
%TEMP%\7ZipSfx.000\xactengine3_0.dll
%TEMP%\7ZipSfx.000\xactengine2_9.dll
%TEMP%\7ZipSfx.000\xapofx1_0.dll
%TEMP%\7ZipSfx.000\xaudio2_3.dll
%TEMP%\7ZipSfx.000\xaudio2_2.dll
%TEMP%\7ZipSfx.000\xaudio2_5.dll
%TEMP%\7ZipSfx.000\xaudio2_4.dll
%TEMP%\7ZipSfx.000\xaudio2_1.dll
%TEMP%\7ZipSfx.000\xapofx1_2.dll
%TEMP%\7ZipSfx.000\xapofx1_1.dll
%TEMP%\7ZipSfx.000\xaudio2_0.dll
%TEMP%\7ZipSfx.000\xapofx1_3.dll
%TEMP%\7ZipSfx.000\x3daudio1_2.dll
%TEMP%\7ZipSfx.000\x3daudio1_1.dll
%TEMP%\7ZipSfx.000\x3daudio1_4.dll
%TEMP%\7ZipSfx.000\x3daudio1_3.dll
%TEMP%\7ZipSfx.000\x3daudio1_0.dll
%TEMP%\7ZipSfx.000\d3dx9_40.dll
%TEMP%\7ZipSfx.000\d3dx9_39.dll
%TEMP%\7ZipSfx.000\d3dx9_42.dll
%TEMP%\7ZipSfx.000\d3dx9_41.dll
%TEMP%\7ZipSfx.000\x3daudio1_5.dll
%TEMP%\7ZipSfx.000\xactengine2_4.dll
%TEMP%\7ZipSfx.000\xactengine2_3.dll
%TEMP%\7ZipSfx.000\xactengine2_6.dll
%TEMP%\7ZipSfx.000\xactengine2_5.dll
%TEMP%\7ZipSfx.000\xactengine2_2.dll
%TEMP%\7ZipSfx.000\xactengine2_0.dll
%TEMP%\7ZipSfx.000\x3daudio1_6.dll
%TEMP%\7ZipSfx.000\xactengine2_10.dll
%TEMP%\7ZipSfx.000\xactengine2_1.dll

Deletes the following files:

%TEMP%\7ZipSfx.000\xactengine2_2.dll
%TEMP%\7ZipSfx.000\xactengine2_3.dll
%TEMP%\7ZipSfx.000\xactengine2_10.dll
%TEMP%\7ZipSfx.000\xactengine2_0.dll
%TEMP%\7ZipSfx.000\xactengine2_1.dll
%TEMP%\7ZipSfx.000\xactengine2_7.dll
%TEMP%\7ZipSfx.000\xactengine2_8.dll
%TEMP%\7ZipSfx.000\xactengine2_6.dll
%TEMP%\7ZipSfx.000\xactengine2_4.dll
%TEMP%\7ZipSfx.000\xactengine2_5.dll
%TEMP%\7ZipSfx.000\x3daudio1_0.dll
%TEMP%\7ZipSfx.000\x3daudio1_1.dll
%TEMP%\7ZipSfx.000\runinf.exe
%TEMP%\7ZipSfx.000\d3dx9_42.dll
%TEMP%\7ZipSfx.000\dxrt.inf
%TEMP%\7ZipSfx.000\x3daudio1_5.dll
%TEMP%\7ZipSfx.000\x3daudio1_6.dll
%TEMP%\7ZipSfx.000\x3daudio1_4.dll
%TEMP%\7ZipSfx.000\x3daudio1_2.dll
%TEMP%\7ZipSfx.000\x3daudio1_3.dll
%TEMP%\7ZipSfx.000\xactengine2_9.dll
%TEMP%\7ZipSfx.000\xaudio2_3.dll
%TEMP%\7ZipSfx.000\xaudio2_4.dll
%TEMP%\7ZipSfx.000\xaudio2_2.dll
%TEMP%\7ZipSfx.000\xaudio2_0.dll
%TEMP%\7ZipSfx.000\xaudio2_1.dll
%TEMP%\7ZipSfx.000\xinput1_3.dll
%TEMP%\7ZipSfx.000\xinput9_1_0.dll
%TEMP%\7ZipSfx.000\xinput1_2.dll
%TEMP%\7ZipSfx.000\xaudio2_5.dll
%TEMP%\7ZipSfx.000\xinput1_1.dll
%TEMP%\7ZipSfx.000\xactengine3_3.dll
%TEMP%\7ZipSfx.000\xactengine3_4.dll
%TEMP%\7ZipSfx.000\xactengine3_2.dll
%TEMP%\7ZipSfx.000\xactengine3_0.dll
%TEMP%\7ZipSfx.000\xactengine3_1.dll
%TEMP%\7ZipSfx.000\xapofx1_2.dll
%TEMP%\7ZipSfx.000\xapofx1_3.dll
%TEMP%\7ZipSfx.000\xapofx1_1.dll
%TEMP%\7ZipSfx.000\xactengine3_5.dll
%TEMP%\7ZipSfx.000\xapofx1_0.dll
%TEMP%\7ZipSfx.000\d3dx10_34.dll
%TEMP%\7ZipSfx.000\d3dx10_35.dll
%TEMP%\7ZipSfx.000\d3dx10_33.dll
%TEMP%\7ZipSfx.000\d3dcsx_42.dll
%TEMP%\7ZipSfx.000\d3dx10.dll
%TEMP%\7ZipSfx.000\d3dx10_39.dll
%TEMP%\7ZipSfx.000\d3dx10_40.dll
%TEMP%\7ZipSfx.000\d3dx10_38.dll
%TEMP%\7ZipSfx.000\d3dx10_36.dll
%TEMP%\7ZipSfx.000\d3dx10_37.dll
%TEMP%\7ZipSfx.000\d3dcompiler_36.dll
%TEMP%\7ZipSfx.000\d3dcompiler_37.dll
%TEMP%\7ZipSfx.000\d3dcompiler_35.dll
%TEMP%\7ZipSfx.000\d3dcompiler_33.dll
%TEMP%\7ZipSfx.000\d3dcompiler_34.dll
%TEMP%\7ZipSfx.000\d3dcompiler_41.dll
%TEMP%\7ZipSfx.000\d3dcompiler_42.dll
%TEMP%\7ZipSfx.000\d3dcompiler_40.dll
%TEMP%\7ZipSfx.000\d3dcompiler_38.dll
%TEMP%\7ZipSfx.000\d3dcompiler_39.dll
%TEMP%\7ZipSfx.000\d3dx10_41.dll
%TEMP%\7ZipSfx.000\d3dx9_35.dll
%TEMP%\7ZipSfx.000\d3dx9_36.dll
%TEMP%\7ZipSfx.000\d3dx9_34.dll
%TEMP%\7ZipSfx.000\d3dx9_32.dll
%TEMP%\7ZipSfx.000\d3dx9_33.dll
%TEMP%\7ZipSfx.000\d3dx9_40.dll
%TEMP%\7ZipSfx.000\d3dx9_41.dll
%TEMP%\7ZipSfx.000\d3dx9_39.dll
%TEMP%\7ZipSfx.000\d3dx9_37.dll
%TEMP%\7ZipSfx.000\d3dx9_38.dll
%TEMP%\7ZipSfx.000\d3dx9_25.dll
%TEMP%\7ZipSfx.000\d3dx9_26.dll
%TEMP%\7ZipSfx.000\d3dx9_24.dll
%TEMP%\7ZipSfx.000\d3dx10_42.dll
%TEMP%\7ZipSfx.000\d3dx11_42.dll
%TEMP%\7ZipSfx.000\d3dx9_30.dll
%TEMP%\7ZipSfx.000\d3dx9_31.dll
%TEMP%\7ZipSfx.000\d3dx9_29.dll
%TEMP%\7ZipSfx.000\d3dx9_27.dll
%TEMP%\7ZipSfx.000\d3dx9_28.dll

Moves the following files:

from <SYSTEM32>\SET33.tmp to <SYSTEM32>\XactEngine2_4.dll
from <SYSTEM32>\SET34.tmp to <SYSTEM32>\XactEngine2_5.dll
from <SYSTEM32>\SET31.tmp to <SYSTEM32>\XactEngine2_2.dll
from <SYSTEM32>\SET32.tmp to <SYSTEM32>\XactEngine2_3.dll
from <SYSTEM32>\SET35.tmp to <SYSTEM32>\XactEngine2_6.dll
from <SYSTEM32>\SET38.tmp to <SYSTEM32>\XactEngine2_9.dll
from <SYSTEM32>\SET39.tmp to <SYSTEM32>\XactEngine2_10.dll
from <SYSTEM32>\SET36.tmp to <SYSTEM32>\XactEngine2_7.dll
from <SYSTEM32>\SET37.tmp to <SYSTEM32>\XactEngine2_8.dll
from <SYSTEM32>\SET2A.tmp to <SYSTEM32>\X3DAudio1_2.dll
from <SYSTEM32>\SET2B.tmp to <SYSTEM32>\X3DAudio1_3.dll
from <SYSTEM32>\SET28.tmp to <SYSTEM32>\X3DAudio1_0.dll
from <SYSTEM32>\SET29.tmp to <SYSTEM32>\X3DAudio1_1.dll
from <SYSTEM32>\SET2C.tmp to <SYSTEM32>\X3DAudio1_4.dll
from <SYSTEM32>\SET2F.tmp to <SYSTEM32>\XactEngine2_0.dll
from <SYSTEM32>\SET30.tmp to <SYSTEM32>\XactEngine2_1.dll
from <SYSTEM32>\SET2D.tmp to <SYSTEM32>\X3DAudio1_5.dll
from <SYSTEM32>\SET2E.tmp to <SYSTEM32>\X3DAudio1_6.dll
from <SYSTEM32>\SET45.tmp to <SYSTEM32>\XAudio2_2.dll
from <SYSTEM32>\SET46.tmp to <SYSTEM32>\XAudio2_3.dll
from <SYSTEM32>\SET43.tmp to <SYSTEM32>\XAudio2_0.dll
from <SYSTEM32>\SET44.tmp to <SYSTEM32>\XAudio2_1.dll
from <SYSTEM32>\SET47.tmp to <SYSTEM32>\XAudio2_4.dll
from <SYSTEM32>\SET4A.tmp to <SYSTEM32>\XInput1_3.dll
from <SYSTEM32>\SET4B.tmp to <SYSTEM32>\XInput9_1_0.dll
from <SYSTEM32>\SET48.tmp to <SYSTEM32>\XInput1_1.dll
from <SYSTEM32>\SET49.tmp to <SYSTEM32>\XInput1_2.dll
from <SYSTEM32>\SET3C.tmp to <SYSTEM32>\XactEngine3_2.dll
from <SYSTEM32>\SET3D.tmp to <SYSTEM32>\XactEngine3_3.dll
from <SYSTEM32>\SET3A.tmp to <SYSTEM32>\XactEngine3_0.dll
from <SYSTEM32>\SET3B.tmp to <SYSTEM32>\XactEngine3_1.dll
from <SYSTEM32>\SET3E.tmp to <SYSTEM32>\XactEngine3_4.dll
from <SYSTEM32>\SET41.tmp to <SYSTEM32>\XAPOFX1_2.dll
from <SYSTEM32>\SET42.tmp to <SYSTEM32>\XAPOFX1_3.dll
from <SYSTEM32>\SET3F.tmp to <SYSTEM32>\XAPOFX1_0.dll
from <SYSTEM32>\SET40.tmp to <SYSTEM32>\XAPOFX1_1.dll
from <SYSTEM32>\SET27.tmp to <SYSTEM32>\d3dx9_41.dll
from <SYSTEM32>\SETE.tmp to <SYSTEM32>\d3dx10_34.dll
from <SYSTEM32>\SETF.tmp to <SYSTEM32>\d3dx10_35.dll
from <SYSTEM32>\SETC.tmp to <SYSTEM32>\d3dx10.dll
from <SYSTEM32>\SETD.tmp to <SYSTEM32>\d3dx10_33.dll
from <SYSTEM32>\SET10.tmp to <SYSTEM32>\d3dx10_36.dll
from <SYSTEM32>\SET13.tmp to <SYSTEM32>\d3dx10_39.dll
from <SYSTEM32>\SET14.tmp to <SYSTEM32>\d3dx10_40.dll
from <SYSTEM32>\SET11.tmp to <SYSTEM32>\d3dx10_37.dll
from <SYSTEM32>\SET12.tmp to <SYSTEM32>\d3dx10_38.dll
from <SYSTEM32>\SET5.tmp to <SYSTEM32>\D3DCompiler_35.dll
from <SYSTEM32>\SET6.tmp to <SYSTEM32>\D3DCompiler_36.dll
from <SYSTEM32>\SET3.tmp to <SYSTEM32>\D3DCompiler_33.dll
from <SYSTEM32>\SET4.tmp to <SYSTEM32>\D3DCompiler_34.dll
from <SYSTEM32>\SET7.tmp to <SYSTEM32>\D3DCompiler_37.dll
from <SYSTEM32>\SETA.tmp to <SYSTEM32>\D3DCompiler_40.dll
from <SYSTEM32>\SETB.tmp to <SYSTEM32>\D3DCompiler_41.dll
from <SYSTEM32>\SET8.tmp to <SYSTEM32>\D3DCompiler_38.dll
from <SYSTEM32>\SET9.tmp to <SYSTEM32>\D3DCompiler_39.dll
from <SYSTEM32>\SET20.tmp to <SYSTEM32>\d3dx9_34.dll
from <SYSTEM32>\SET21.tmp to <SYSTEM32>\d3dx9_35.dll
from <SYSTEM32>\SET1E.tmp to <SYSTEM32>\d3dx9_32.dll
from <SYSTEM32>\SET1F.tmp to <SYSTEM32>\d3dx9_33.dll
from <SYSTEM32>\SET22.tmp to <SYSTEM32>\d3dx9_36.dll
from <SYSTEM32>\SET25.tmp to <SYSTEM32>\d3dx9_39.dll
from <SYSTEM32>\SET26.tmp to <SYSTEM32>\d3dx9_40.dll
from <SYSTEM32>\SET23.tmp to <SYSTEM32>\d3dx9_37.dll
from <SYSTEM32>\SET24.tmp to <SYSTEM32>\d3dx9_38.dll
from <SYSTEM32>\SET17.tmp to <SYSTEM32>\d3dx9_25.dll
from <SYSTEM32>\SET18.tmp to <SYSTEM32>\d3dx9_26.dll
from <SYSTEM32>\SET15.tmp to <SYSTEM32>\d3dx10_41.dll
from <SYSTEM32>\SET16.tmp to <SYSTEM32>\d3dx9_24.dll
from <SYSTEM32>\SET19.tmp to <SYSTEM32>\d3dx9_27.dll
from <SYSTEM32>\SET1C.tmp to <SYSTEM32>\d3dx9_30.dll
from <SYSTEM32>\SET1D.tmp to <SYSTEM32>\d3dx9_31.dll
from <SYSTEM32>\SET1A.tmp to <SYSTEM32>\d3dx9_28.dll
from <SYSTEM32>\SET1B.tmp to <SYSTEM32>\d3dx9_29.dll

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней