Trojan.MulDrop17.49575

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop sppsvc /y
'<SYSTEM32>\net.exe' stop osppsvc /y

Modifies file system

Creates the following files

%TEMP%\autd5c5.tmp
%TEMP%\cyberspace\kms vl all x86.exe
%TEMP%\autd672.tmp
%TEMP%\cyberspace\kms vl all x64.exe
%TEMP%\autdb41.tmp
%TEMP%\cyberspace\kms vl all.cmd
nul
%TEMP%\fqkci0fn.0.cs
%TEMP%\fqkci0fn.cmdline
%TEMP%\fqkci0fn.out
%TEMP%\cscab.tmp
%TEMP%\resac.tmp
%TEMP%\fqkci0fn.dll
<SYSTEM32>\sppextcomobjhook.dll
%WINDIR%\migration\wtr\kms_vl_all.inf
%WINDIR%\temp\sppchk.txt

Deletes the following files

%TEMP%\autd5c5.tmp
%TEMP%\autd672.tmp
%TEMP%\autdb41.tmp
%TEMP%\resac.tmp
%TEMP%\cscab.tmp
%TEMP%\fqkci0fn.pdb
%TEMP%\fqkci0fn.dll
%TEMP%\fqkci0fn.out
%TEMP%\fqkci0fn.0.cs
%TEMP%\fqkci0fn.cmdline
%WINDIR%\temp\sppchk.txt
%TEMP%\cyberspace\kms vl all x64.exe
%TEMP%\cyberspace\kms vl all x86.exe
%TEMP%\cyberspace\kms vl all.cmd

Miscellaneous

Creates and executes the following

'%TEMP%\cyberspace\kms vl all x64.exe'
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fqkci0fn.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC.tmp" "%TEMP%\CSCAB.tmp"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\CyberSpace\KMS VL ALL.cmd" /u /a"
'<SYSTEM32>\find.exe' /i "Office 16" "%WINDIR%\Temp\sppchk.txt"
'<SYSTEM32>\find.exe' /i "Office 19" "%WINDIR%\Temp\sppchk.txt"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%') get Name /value
'<SYSTEM32>\net1.exe' start osppsvc /y
'<SYSTEM32>\net.exe' start osppsvc /y
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus='1' ) get Name /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus='1' ) get Name /VALUE"
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value
'<SYSTEM32>\findstr.exe' /i "Windows"
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (LicenseStatus='1' and Description like '%KMSCLIENT%' ) get Name /value
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID /value
'<SYSTEM32>\findstr.exe' "1"
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where ID='ae2ee509-1b34-41c0-acb7-6d4650168915' get LicenseStatus /value
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' ) get ID /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' ) get ID /VALUE"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "0.0.0.0"
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService get Version /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path SoftwareLicensingService get Version /VALUE"
'<SYSTEM32>\findstr.exe' /i Windows
'<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /value
'<SYSTEM32>\findstr.exe' /i "ae2ee509-1b34-41c0-acb7-6d4650168915"
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
'<SYSTEM32>\find.exe' /i "Office 15" "%WINDIR%\Temp\sppchk.txt"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%') get ID /VALUE
'<SYSTEM32>\net1.exe' stop sppsvc /y
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableDnsPublishing
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get GracePeriodRemaining /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get GracePeriodRemaining /VALUE"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' call Activate
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get Name /VALUE"
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\6f327760-8c5c-417c-9b61-836a98287e0c" /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663\6f327760-8c5c-417c-9b61-836a98287e0c" /f
'<SYSTEM32>\findstr.exe' /i "6f327760-8c5c-417c-9b61-836a98287e0c"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (PartialProductKey is not NULL) get ID /value
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%') get Name /value
'<SYSTEM32>\find.exe' /i "Office 14" "%WINDIR%\Temp\sppchk.txt"
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%') get ID /VALUE"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionService get Version /VALUE" 2>nul
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPro-MAK') get LicenseStatus /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPro-MAK') get LicenseStatus /VALUE" 2>nul
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPrem-MAK') get LicenseStatus /VALUE
'<SYSTEM32>\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPrem-MAK') get LicenseStatus /VALUE" 2>nul
'<SYSTEM32>\find.exe' /i "Office 15"
'<SYSTEM32>\find.exe' /i "Office 16"
'<SYSTEM32>\find.exe' /i "Office 19"
'<SYSTEM32>\find.exe' /i "R_Retail" "%WINDIR%\Temp\sppchk.txt"
'<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get Name /value
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 0x00000100
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v VerifierFlags /t REG_DWORD /d 0x80000000
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v VerifierDebug /t REG_DWORD /d 0x00000000
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC.tmp" "%TEMP%\CSCAB.tmp"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDebug /t REG_DWORD /d 0x00000000
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fqkci0fn.cmdline"
'<SYSTEM32>\find.exe' /i "STOPPED"
'<SYSTEM32>\sc.exe' query sppsvc
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
'<SYSTEM32>\mode.com' con cols=100 lines=32
'<SYSTEM32>\cmd.exe' /c dir /b /ad <SYSTEM32>\spp\tokens\channels
'<SYSTEM32>\sc.exe' query osppsvc
'<SYSTEM32>\cmd.exe' /c dir /b /ad <SYSTEM32>\spp\tokens\skus
'<SYSTEM32>\cmd.exe' /c ver
'<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
'<SYSTEM32>\reg.exe' query HKU\S-1-5-19
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c "$d='<SYSTEM32>';$f=[IO.File]::ReadAllText('%TEMP%\CyberSpace\KMS VL ALL.cmd') -split ':embdbin\:.*';iex ($f[1]);X 2"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierFlags /t REG_DWORD /d 0x80000000
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 0x00000100
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
'<SYSTEM32>\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath
'<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "0.0.0.0"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v GlobalFlag /t REG_DWORD /d 0x00000100
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierFlags /t REG_DWORD /d 0x80000000
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDebug /t REG_DWORD /d 0x00000000
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v Debugger
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
'<SYSTEM32>\net1.exe' stop osppsvc /y
'<SYSTEM32>\sc.exe' start sppsvc trigger=timer;sessionid=0

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней