Trojan.MulDrop8.29957

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Classic Start Menu' = '"%ProgramFiles%\Classic Start\ClassicStartMenu.exe" -autorun'

Modifies file system:

Creates the following files:

%TEMP%\RarSFX0\Menu_Settings_mod.xml
%ProgramFiles%\Classic Start\Skins\is-LSQ51.tmp
%ProgramFiles%\Classic Start\Skins\is-6QLJI.tmp
%ProgramFiles%\Classic Start\Skins\is-N4UEH.tmp
%ProgramFiles%\Classic Start\Skins\is-8RGGI.tmp
%ProgramFiles%\Classic Start\Skins\is-MVG2V.tmp
%ProgramFiles%\Classic Start\Skins\is-R3G88.tmp
%ProgramFiles%\Classic Start\Skins\is-E3J3K.tmp
%ProgramFiles%\Classic Start\is-VB6CC.tmp
%ProgramFiles%\Classic Start\Skins\is-3UI59.tmp
%ProgramFiles%\Classic Start\Skins\is-1J42S.tmp
<SYSTEM32>\is-7RN14.tmp
%ProgramFiles%\Classic Start\is-91SBG.tmp
%ProgramFiles%\Classic Start\is-63VVO.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Classic Start.lnk
%ProgramFiles%\Classic Start\Skins\is-3SJ1I.tmp
%ProgramFiles%\Classic Start\Skins\is-9SSG4.tmp
%ProgramFiles%\Classic Start\Skins\is-LVTM3.tmp
%ProgramFiles%\Classic Start\Skins\is-2J3RN.tmp
%ProgramFiles%\Classic Start\Skins\is-UA9PT.tmp
%ProgramFiles%\Classic Start\is-016G0.tmp
%ProgramFiles%\Classic Start\is-73RL2.tmp
%ProgramFiles%\Classic Start\is-FPLRA.tmp
%ProgramFiles%\Classic Start\is-19EGQ.tmp
%ProgramFiles%\Classic Start\Skins\is-2P4GU.tmp
%ProgramFiles%\Classic Start\is-AHM9O.tmp
%TEMP%\is-7VFS2.tmp\Logo.bmp
%TEMP%\is-7VFS2.tmp\Windows10Dark.vsf
%TEMP%\is-7VFS2.tmp\VclStylesInno.dll
%TEMP%\is-6BHU7.tmp\ClassicStart_4.4.118.tmp
%TEMP%\RarSFX0\Copy-Settings_DE-IT.cmd
%TEMP%\RarSFX0\ClassicStart_4.4.118.exe
%ProgramFiles%\Classic Start\unins000.dat
%ProgramFiles%\Classic Start\Menu_Settings.xml

Sets the 'hidden' attribute to the following files:

%ProgramFiles%\Classic Start\Desktop.ini
%ProgramFiles%\Classic Start\ClassicShell.ico

Deletes the following files:

%TEMP%\is-7VFS2.tmp\Logo.bmp
%TEMP%\is-7VFS2.tmp\VclStylesInno.dll
%TEMP%\is-7VFS2.tmp\Windows10Dark.vsf
%TEMP%\is-6BHU7.tmp\ClassicStart_4.4.118.tmp

Moves the following files:

from %ProgramFiles%\Classic Start\is-AHM9O.tmp to %ProgramFiles%\Classic Start\unins000.exe
from <SYSTEM32>\is-7RN14.tmp to <SYSTEM32>\StartMenuHelper32.dll
from %ProgramFiles%\Classic Start\Skins\is-1J42S.tmp to %ProgramFiles%\Classic Start\Skins\Windows XP Luna.skin
from %ProgramFiles%\Classic Start\Skins\is-3UI59.tmp to %ProgramFiles%\Classic Start\Skins\Windows Basic.skin
from %ProgramFiles%\Classic Start\Skins\is-E3J3K.tmp to %ProgramFiles%\Classic Start\Skins\Windows Aero.skin7
from %ProgramFiles%\Classic Start\Skins\is-2P4GU.tmp to %ProgramFiles%\Classic Start\Skins\Windows Aero.skin
from %ProgramFiles%\Classic Start\Skins\is-R3G88.tmp to %ProgramFiles%\Classic Start\Skins\Windows 8.skin7
from %ProgramFiles%\Classic Start\Skins\is-MVG2V.tmp to %ProgramFiles%\Classic Start\Skins\Windows 8.skin
from %ProgramFiles%\Classic Start\Skins\is-8RGGI.tmp to %ProgramFiles%\Classic Start\Skins\Smoked Glass.skin
from %ProgramFiles%\Classic Start\Skins\is-N4UEH.tmp to %ProgramFiles%\Classic Start\Skins\Midnight.skin7
from %ProgramFiles%\Classic Start\Skins\is-6QLJI.tmp to %ProgramFiles%\Classic Start\Skins\Metro.skin7
from %ProgramFiles%\Classic Start\Skins\is-LSQ51.tmp to %ProgramFiles%\Classic Start\Skins\Metro.skin
from %ProgramFiles%\Classic Start\Skins\is-3SJ1I.tmp to %ProgramFiles%\Classic Start\Skins\Metallic.skin7
from %ProgramFiles%\Classic Start\Skins\is-9SSG4.tmp to %ProgramFiles%\Classic Start\Skins\Full Glass.skin
from %ProgramFiles%\Classic Start\Skins\is-LVTM3.tmp to %ProgramFiles%\Classic Start\Skins\Dark.skin7
from %ProgramFiles%\Classic Start\Skins\is-2J3RN.tmp to %ProgramFiles%\Classic Start\Skins\Classic Skin.skin7
from %ProgramFiles%\Classic Start\Skins\is-UA9PT.tmp to %ProgramFiles%\Classic Start\Skins\Classic Skin.skin
from %ProgramFiles%\Classic Start\is-016G0.tmp to %ProgramFiles%\Classic Start\StartMenuL10N.ini
from %ProgramFiles%\Classic Start\is-73RL2.tmp to %ProgramFiles%\Classic Start\StartMenuHelperL10N.ini
from %ProgramFiles%\Classic Start\is-FPLRA.tmp to %ProgramFiles%\Classic Start\de-DE.dll
from %ProgramFiles%\Classic Start\is-19EGQ.tmp to %ProgramFiles%\Classic Start\ClassicShell.ico
from %ProgramFiles%\Classic Start\is-VB6CC.tmp to %ProgramFiles%\Classic Start\Desktop.ini
from %ProgramFiles%\Classic Start\is-91SBG.tmp to %ProgramFiles%\Classic Start\ClassicStartMenu.exe
from %ProgramFiles%\Classic Start\is-63VVO.tmp to %ProgramFiles%\Classic Start\ClassicStartMenuDLL.dll

Miscellaneous:

Searches for the following windows:

ClassName: 'EDIT' WindowName: ''

Creates and executes the following:

'%TEMP%\RarSFX0\ClassicStart_4.4.118.exe' /VERYSILENT /LANG=de
'%TEMP%\is-6BHU7.tmp\ClassicStart_4.4.118.tmp' /SL5="$2010A,3419438,205312,%TEMP%\RarSFX0\ClassicStart_4.4.118.exe" /VERYSILENT /LANG=de

Executes the following: