Trojan.MulDrop32.43491

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\st.exe
%TEMP%\rarsfx0\rr.exe
%TEMP%\_mei45962\vcruntime140.dll
%TEMP%\_mei45962\_bz2.pyd
%TEMP%\_mei45962\_decimal.pyd
%TEMP%\_mei45962\_hashlib.pyd
%TEMP%\_mei45962\_lzma.pyd
%TEMP%\_mei45962\_socket.pyd
%TEMP%\_mei45962\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei45962\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei45962\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei45962\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei45962\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei45962\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei45962\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei45962\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei45962\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei45962\base_library.zip
%TEMP%\_mei45962\config.ini
%TEMP%\_mei45962\libcrypto-1_1.dll
%TEMP%\_mei45962\python311.dll
%TEMP%\_mei45962\select.pyd
%TEMP%\_mei45962\ucrtbase.dll
%TEMP%\_mei45962\unicodedata.pyd
%TEMP%\rarsfx1\r.bat
%TEMP%\rarsfx1\r.vbs
nul
%TEMP%\msg.vbs

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\st.exe'
'%TEMP%\rarsfx0\rr.exe' -prestorebysm1le -d%LOCALAPPDATA%\Temp
'<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX1\r.vbs"
'<SYSTEM32>\cscript.exe' //nologo "%TEMP%\msg.vbs"

Executes the following

'<SYSTEM32>\cmd.exe' /c ""rr.exe" -prestorebysm1le -d%temp%"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX1\r.bat" "
'<SYSTEM32>\net.exe' session
'<SYSTEM32>\net1.exe' session
'<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f
'<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f
'<SYSTEM32>\cmd.exe' /c ""rr.exe" -prestorebysm1le -d%temp%"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX1\r.bat" "' (with hidden window)