Trojan.MulDrop24.12124

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Movie Archive] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Movie Archive] 'ImagePath' = '%ALLUSERSPROFILE%\Movie Archive\Movie Archive.exe'

Creates the following services

'Movie Archive' %ALLUSERSPROFILE%\Movie Archive\Movie Archive.exe

Modifies file system

Creates the following files

%TEMP%\is-bhjm7.tmp\is-pv9rq.tmp
%ProgramFiles(x86)%\vobrules\unins000.dat
%ProgramFiles(x86)%\vobrules\is-n9h59.tmp
%ProgramFiles(x86)%\vobrules\plugins\is-l17q9.tmp
%ProgramFiles(x86)%\vobrules\plugins\is-j29v4.tmp
%ProgramFiles(x86)%\vobrules\plugins\is-bm5oh.tmp
%ProgramFiles(x86)%\vobrules\plugins\is-6go52.tmp
%ProgramFiles(x86)%\vobrules\help\is-tuii1.tmp
%ProgramFiles(x86)%\vobrules\online\is-kidvl.tmp
%ProgramFiles(x86)%\vobrules\online\is-mcorl.tmp
%ProgramFiles(x86)%\vobrules\lang\is-b9lcm.tmp
%ProgramFiles(x86)%\vobrules\lang\is-cb6ei.tmp
%ProgramFiles(x86)%\vobrules\lang\is-i7ah6.tmp
%ProgramFiles(x86)%\vobrules\lang\is-gfhi5.tmp
%ProgramFiles(x86)%\vobrules\lang\is-c7srd.tmp
%ProgramFiles(x86)%\vobrules\lang\is-seim3.tmp
%ProgramFiles(x86)%\vobrules\lang\is-1jqks.tmp
%ProgramFiles(x86)%\vobrules\lang\is-oq6s9.tmp
%ProgramFiles(x86)%\vobrules\lang\is-eob4d.tmp
%ProgramFiles(x86)%\vobrules\lang\is-kkeit.tmp
%ProgramFiles(x86)%\vobrules\lang\is-2qr01.tmp
%ProgramFiles(x86)%\vobrules\lang\is-jasua.tmp
%ProgramFiles(x86)%\vobrules\lang\is-7tvf1.tmp
%ProgramFiles(x86)%\vobrules\lang\is-hvbj7.tmp
%ProgramFiles(x86)%\vobrules\lang\is-7cjrt.tmp
%ProgramFiles(x86)%\vobrules\lang\is-mr70g.tmp
%ProgramFiles(x86)%\vobrules\is-q3lmf.tmp
%TEMP%\is-nc79a.tmp\_iscrypt.dll
%TEMP%\is-nc79a.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nc79a.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\vobrules\vobrules.exe
%ALLUSERSPROFILE%\movie archive\movie archive.exe

Moves the following files

from %ProgramFiles(x86)%\vobrules\is-q3lmf.tmp to %ProgramFiles(x86)%\vobrules\unins000.exe
from %ProgramFiles(x86)%\vobrules\plugins\is-j29v4.tmp to %ProgramFiles(x86)%\vobrules\plugins\vob.rules
from %ProgramFiles(x86)%\vobrules\plugins\is-bm5oh.tmp to %ProgramFiles(x86)%\vobrules\plugins\various.rules
from %ProgramFiles(x86)%\vobrules\plugins\is-6go52.tmp to %ProgramFiles(x86)%\vobrules\plugins\libwim-15.dll
from %ProgramFiles(x86)%\vobrules\help\is-tuii1.tmp to %ProgramFiles(x86)%\vobrules\help\isobuster.chm
from %ProgramFiles(x86)%\vobrules\online\is-kidvl.tmp to %ProgramFiles(x86)%\vobrules\online\order now.html
from %ProgramFiles(x86)%\vobrules\online\is-mcorl.tmp to %ProgramFiles(x86)%\vobrules\online\isobuster online.html
from %ProgramFiles(x86)%\vobrules\lang\is-b9lcm.tmp to %ProgramFiles(x86)%\vobrules\lang\vietnamese.dll
from %ProgramFiles(x86)%\vobrules\lang\is-cb6ei.tmp to %ProgramFiles(x86)%\vobrules\lang\turkish.dll
from %ProgramFiles(x86)%\vobrules\lang\is-i7ah6.tmp to %ProgramFiles(x86)%\vobrules\lang\suomi_finnish.dll
from %ProgramFiles(x86)%\vobrules\lang\is-gfhi5.tmp to %ProgramFiles(x86)%\vobrules\lang\slovenian.dll
from %ProgramFiles(x86)%\vobrules\plugins\is-l17q9.tmp to %ProgramFiles(x86)%\vobrules\plugins\pfctoc.dll
from %ProgramFiles(x86)%\vobrules\lang\is-c7srd.tmp to %ProgramFiles(x86)%\vobrules\lang\romana.dll
from %ProgramFiles(x86)%\vobrules\lang\is-1jqks.tmp to %ProgramFiles(x86)%\vobrules\lang\polski.dll
from %ProgramFiles(x86)%\vobrules\lang\is-oq6s9.tmp to %ProgramFiles(x86)%\vobrules\lang\nederlands.dll
from %ProgramFiles(x86)%\vobrules\lang\is-eob4d.tmp to %ProgramFiles(x86)%\vobrules\lang\magyar.dll
from %ProgramFiles(x86)%\vobrules\lang\is-kkeit.tmp to %ProgramFiles(x86)%\vobrules\lang\italiano.dll
from %ProgramFiles(x86)%\vobrules\lang\is-2qr01.tmp to %ProgramFiles(x86)%\vobrules\lang\hindi.dll
from %ProgramFiles(x86)%\vobrules\lang\is-jasua.tmp to %ProgramFiles(x86)%\vobrules\lang\greek.dll
from %ProgramFiles(x86)%\vobrules\lang\is-7tvf1.tmp to %ProgramFiles(x86)%\vobrules\lang\francais.dll
from %ProgramFiles(x86)%\vobrules\lang\is-hvbj7.tmp to %ProgramFiles(x86)%\vobrules\lang\espanol.dll
from %ProgramFiles(x86)%\vobrules\lang\is-7cjrt.tmp to %ProgramFiles(x86)%\vobrules\lang\deutsch.dll
from %ProgramFiles(x86)%\vobrules\lang\is-mr70g.tmp to %ProgramFiles(x86)%\vobrules\lang\dansk.dll
from %ProgramFiles(x86)%\vobrules\lang\is-seim3.tmp to %ProgramFiles(x86)%\vobrules\lang\portugues.dll
from %ProgramFiles(x86)%\vobrules\is-n9h59.tmp to %ProgramFiles(x86)%\vobrules\vobrules.exe

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Hb3721_PHE1171_FlashFixClass_Hb3721'

Creates and executes the following

'%TEMP%\is-bhjm7.tmp\is-pv9rq.tmp' /SL4 $50238 "<Full path to file>" 3960385 270848
'%ProgramFiles(x86)%\vobrules\vobrules.exe' -i
'%ProgramFiles(x86)%\vobrules\vobrules.exe' -s

Executes the following