Trojan.MulDrop13.1729

Technical Information

Modifies file system

Creates the following files

<Current directory>\.sw402-2setup-retail.exe
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isr18c0.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isu18c0.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\defa18b0.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\isrt1891.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\stri1891.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\isbe1881.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\dotn1872.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\core1872.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\difx1872.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\font1862.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\lice1862.rra
%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\setu1853.rra
%TEMP%\1749.rra
%APPDATA%\die.bat
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\0x0409.ini
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\setup.inx
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\setup.ini
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\setup.exe
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\layout.bin
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\issetup.dll
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\data1.hdr
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\data1.cab
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\disk1\0x0409.ini
%APPDATA%\apachesrvin.vbs
%TEMP%\ic.exe
%TEMP%\nsd8f2.tmp\execdos.dll
%TEMP%\a.7z
%TEMP%\7za.exe
%TEMP%\{29112b96-101d-4e41-bc59-1746dd9d793e}\setup.ini
nul

Deletes the following files

%TEMP%\nsd8f2.tmp\execdos.dll

Moves the following files

from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\setu1853.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\setup.inx
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\lice1862.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\license.rtf
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\font1862.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\fontdata.ini
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\difx1872.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\difxdata.ini
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\core1872.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\corecomp.ini
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\dotn1872.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\dotnetinstaller.exe
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\isbe1881.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\isbew64.exe
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\stri1891.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\stringtable_0x0409.ips
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\isrt1891.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\isrt.dll
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\defa18b0.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\default.pal
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isu18c0.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isuser_0x0409.dll
from %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isr18c0.rra to %TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\{d770f0f3-650b-4d7a-945d-49adb1182bd9}\_isres_0x0409.dll

Deletes itself.

Miscellaneous

Creates and executes the following

'%TEMP%\7za.exe' x "%TEMP%\a.7z" -p7ScjXubbbB -o"%TEMP%\" -aoa
'<Current directory>\.sw402-2setup-retail.exe'
'%TEMP%\ic.exe'
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\apachesrvin.vbs"
'%TEMP%\{112fc0ed-c592-49d5-8f87-9384a4e557bf}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FCAA4542-777F-457E-94A0-5B96FC308EC1}
'%TEMP%\7za.exe' x "%TEMP%\a.7z" -p7ScjXubbbB -o"%TEMP%\" -aoa' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\die.bat" "' (with hidden window)

Executes the following