Trojan.MulDrop8.24439

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ANIWZCS2Service' = '%ProgramFiles%\ANI\ANIWZCS2 Service\WZCSLDR2.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ANIWZCSdService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ANIWZCSdService] 'ImagePath' = '%ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSdS.exe'

Modifies file system:

Creates the following files:

%TEMP%\ext2.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data7881.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layo7872.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data78a1.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse2c94.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
<SYSTEM32>\ANIC7ce6.rra
<SYSTEM32>\aIPH7ca8.rra
<SYSTEM32>\wnic7c5a.rra
<SYSTEM32>\wlan7c0c.rra
<SYSTEM32>\odSu7b21.rra
<SYSTEM32>\JJAK7b02.rra
%ProgramFiles%\ANI\ANIWZCS2 Service\ANIW7ae3.rra
%ProgramFiles%\ANI\ANIWZCS2 Service\WZCS7ab4.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\ANI\ANIWZCS2 Service\Ctrl7aa4.rra
%ProgramFiles%\ANI\ANIWZCS2 Service\ANIW79e9.rra
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.ini
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setu792d.rra
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu790e.rra
%ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu78ef.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\233d.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3~tmp\Disk1\setup.iss
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\layout.bin
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2a61.rra
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\plf1.tmp
<SYSTEM32>\ANIW7d06.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje2c46.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setu36e5.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core29d5.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\pft3~tmp\Disk1\setup.log
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR46d3.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c44.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c15.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setu3b2a.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsR3a7e.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR3a30.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\defa39a4.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3984.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt3927.rra
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt38b9.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\valu381d.rra
%CommonProgramFiles%\InstallShield\IScript\iscr2ef5.rra
<SYSTEM32>\AQCK7d83.rra

Deletes the following files:

%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\plf1.tmp
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
%TEMP%\pft3~tmp\Disk1\setup.iss
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setup.inx
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\value.shl
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt.dll
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\default.pal
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt.dll
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\default.pal
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsRes.dll
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll
%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c15.rra
%TEMP%\IEC4.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\value.shl
%TEMP%\pft3~tmp\Disk1\setup.log

Moves the following files:

from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu790e.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.ini
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setu792d.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
from %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW79e9.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSd.dll
from %ProgramFiles%\ANI\ANIWZCS2 Service\Ctrl7aa4.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\CtrlSrv.exe
from %ProgramFiles%\ANI\ANIWZCS2 Service\WZCS7ab4.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\WZCSLDR2.exe
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data78a1.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1.cab
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu78ef.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.exe
from %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW7ae3.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
from <SYSTEM32>\wlan7c0c.rra to <SYSTEM32>\wlanapp.dll
from <SYSTEM32>\wnic7c5a.rra to <SYSTEM32>\wnicapi.dll
from <SYSTEM32>\aIPH7ca8.rra to <SYSTEM32>\aIPH.dll
from <SYSTEM32>\ANIC7ce6.rra to <SYSTEM32>\ANICtl.dll
from <SYSTEM32>\ANIW7d06.rra to <SYSTEM32>\ANIWZCS2.dll
from <SYSTEM32>\JJAK7b02.rra to <SYSTEM32>\JJAKEn.dll
from <SYSTEM32>\odSu7b21.rra to <SYSTEM32>\odSupp_M.dll
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data7881.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1.hdr
from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layo7872.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layout.bin
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR46d3.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2a61.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje2c46.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse2c94.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
from %CommonProgramFiles%\InstallShield\IScript\iscr2ef5.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setu36e5.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\valu381d.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\value.shl
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core29d5.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt3927.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt.dll
from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\defa39a4.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\default.pal
from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsR3a7e.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsRes.dll
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setu3b2a.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setup.inx
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c44.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\value.shl
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt38b9.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt.dll
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3975.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\default.pal
from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3984.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3975.rra
from <SYSTEM32>\AQCK7d83.rra to <SYSTEM32>\AQCKGen.dll
from %TEMP%\233d.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.ilg

Substitutes the following files:

%TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll

Miscellaneous:

Creates and executes the following:

'%TEMP%\pft3~tmp\Disk1\Setup.exe' /s
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial