Trojan.MulDrop11.17945

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\DNE] 'ImagePath' = 'system32\DRIVERS\dne64x.sys'
[<HKLM>\System\CurrentControlSet\Services\CVPNDRVA] 'ImagePath' = '<DRIVERS>\CVPNDRVA.sys'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\osu library vpn.pcf
%CommonProgramFiles%\deterministic networks\dne\dne64x.sys
%CommonProgramFiles%\deterministic networks\dne\dnei64x.dll
%CommonProgramFiles%\deterministic networks\dne\dnes64x.exe
%ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.cat
%ProgramFiles(x86)%\cisco systems\vpn client\vpnapi.dll
%ProgramFiles(x86)%\cisco systems\vpn client\resources\enable_log.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\modify_profile_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\verify_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\connect.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\export_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\export_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\modify_profile.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\new_profile.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\status_down_arrow.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\show_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\title_bar.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\notifications.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\arrow_up.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\disable_log.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\password_logo.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\notifications_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnect.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\enroll_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\options_log.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\profile_logo.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\connect_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\connected.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\unconnected.ico
%ProgramFiles(x86)%\cisco systems\vpn client\resources\disable_log_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\enable_log_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\clear_log_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\import_profile.png
%CommonProgramFiles%\deterministic networks\common files\dneinst.exe
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set4217.tmp
%TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\set5f37.tmp
%TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\set6022.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%WINDIR%\inf\oem2.pnf
<SYSTEM32>\set7a2d.tmp
<DRIVERS>\set7a4d.tmp
%WINDIR%\inf\oem1.pnf
%ProgramFiles(x86)%\cisco systems\vpn client\languages\autoinstallgui_fc.qm
%WINDIR%\inf\oem3.pnf
%WINDIR%\temp\fwtsqmfile00.sqm
%ProgramFiles(x86)%\cisco systems\vpn client\vpnclient.ini
%WINDIR%\temp\udd2021.tmp
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2bf8.tmp
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2ce4.tmp
%CommonProgramFiles%\deterministic networks\dne\dne2000.inf
%CommonProgramFiles%\deterministic networks\dne\dne2000.cat
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set40ee.tmp
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set3ff3.tmp
%WINDIR%\temp\dneinst.log
%PROGRAMDATA%\microsoft\windows\start menu\programs\cisco systems vpn client\vpn client.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\startup\vpngui.exe.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\cisco systems vpn client\set mtu.lnk
%WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icon09db8a851.exe
%WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icond4cbeb74.exe
%WINDIR%\installer\{5fdc06bf-3d3d-4367-8ffb-4fafcb61972d}\icon09db8a85.exe
%ProgramFiles(x86)%\cisco systems\vpn client\profiles\osu on-campus (full tunnel).pcf
%ProgramFiles(x86)%\cisco systems\vpn client\profiles\osu off-campus (split tunnel).pcf
%ProgramFiles(x86)%\cisco systems\vpn client\profiles\osu library vpn.pcf
%CommonProgramFiles%\deterministic networks\dne\dne2000m.cat
%CommonProgramFiles%\deterministic networks\dne\dne2000m.inf
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set4303.tmp
%ProgramFiles(x86)%\cisco systems\vpn client\resources\cancel.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_profile.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnect_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\vpngui.exe
%ProgramFiles(x86)%\cisco systems\vpn client\vpnclient.exe
%ProgramFiles(x86)%\cisco systems\vpn client\setmtu.exe
%ProgramFiles(x86)%\cisco systems\vpn client\ppptool.exe
%ProgramFiles(x86)%\cisco systems\vpn client\ipseclog.exe
%ProgramFiles(x86)%\cisco systems\vpn client\ipsecdialer.exe
%ProgramFiles(x86)%\cisco systems\vpn client\cvpnd.exe
%ProgramFiles(x86)%\cisco systems\vpn client\cisco_cert_mgr.exe
%ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.sys
%ProgramFiles(x86)%\cisco systems\vpn client\setup\cvirta64.inf
%ProgramFiles(x86)%\cisco systems\vpn client\vainst64.exe
<DRIVERS>\cvpndrva.sys
%WINDIR%\temp\dneca.log
%ProgramFiles(x86)%\cisco systems\vpn client\accessible\qtwidgets100.dll
%WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisedata.ini
%TEMP%\_5fdc06bf_3d3d_4367_8ffb_4fafcb61972d_.tmp
%WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcalla1.dll
%WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcalla.dll
%WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustcall64.dll
%WINDIR%\5fdc06bf3d3d43678ffb4fafcb61972d.tmp\wisecustomcall.dll
%TEMP%\rarsfx0\vpnclient_setup.sms
%TEMP%\rarsfx0\vpnclient_setup.pdf
%TEMP%\rarsfx0\vpnclient_setup.msi
%TEMP%\rarsfx0\vpnclient_setup.ini
%TEMP%\rarsfx0\vpnclient_setup.exe
%TEMP%\rarsfx0\vpnclient_jp.mst
%TEMP%\rarsfx0\vpnclient_fc.mst
%TEMP%\rarsfx0\osu on-campus (full tunnel).pcf
%TEMP%\rarsfx0\osu off-campus (split tunnel).pcf
%WINDIR%\vpninstall.mif
%ProgramFiles(x86)%\cisco systems\vpn client\include\windows_stdint.h
%ProgramFiles(x86)%\cisco systems\vpn client\qt-mt335.dll
%ProgramFiles(x86)%\cisco systems\vpn client\include\vpnapi.h
%ProgramFiles(x86)%\cisco systems\vpn client\resources\options_log_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\logo.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\show_log.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\simple_mode_logo.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\show_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\splash_screen.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\connected.ico
%ProgramFiles(x86)%\cisco systems\vpn client\resources\enroll_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\import_profile_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\cancel_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\disconnecting.ico
%ProgramFiles(x86)%\cisco systems\vpn client\resources\import_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\import_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\vpn_panel.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_profile_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\new_profile_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\languages\vainstaller_fc.qm
%ProgramFiles(x86)%\cisco systems\vpn client\resources\arrow_down.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\clear_log.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\delete_certificate_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\show_log_pressed.png
%ProgramFiles(x86)%\cisco systems\vpn client\resources\verify_certificate.png
%ProgramFiles(x86)%\cisco systems\vpn client\languages\vainstaller_jp.qm
%WINDIR%\inf\oem0.pnf
%ProgramFiles(x86)%\cisco systems\vpn client\languages\vpngui_jp.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\qt_fc.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\ppptool_jp.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\autoinstallgui_jp.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\vpngui_fc.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\qt_jp.qm
%ProgramFiles(x86)%\cisco systems\vpn client\languages\ppptool_fc.qm
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2dee.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Deletes the following files

%TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\dne2000m.cat
%TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\dne2000m.inf
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne2000.cat
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne2000.inf
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne64x.sys
%TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dnei64x.dll
%WINDIR%\temp\udd2021.tmp
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.cat
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.inf
%TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.sys

Moves the following files

from %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set3ff3.tmp to %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne2000.cat
from %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set40ee.tmp to %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne2000.inf
from %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set4217.tmp to %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dne64x.sys
from %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\set4303.tmp to %TEMP%\{2375058d-6557-6cb9-74ad-0b664a8e8522}\dnei64x.dll
from %TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\set5f37.tmp to %TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\dne2000m.cat
from %TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\set6022.tmp to %TEMP%\{4953885b-46b3-7408-000c-535b61bdf938}\dne2000m.inf
from <SYSTEM32>\set7a2d.tmp to <SYSTEM32>\dnei64x.dll
from <DRIVERS>\set7a4d.tmp to <DRIVERS>\dne64x.sys
from %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2bf8.tmp to %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.cat
from %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2ce4.tmp to %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.inf
from %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\set2dee.tmp to %TEMP%\{7577dbea-bd0e-04e0-3690-075d50c3661f}\cvirta64.sys

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%WINDIR%\installer\msi129c.tmp' -cmd NormalizeDneRefCounts -osver 601
'%WINDIR%\installer\msi3202.tmp' -cmd CopyAndBackupFiles -src "%TEMP%\RarSFX0\" -dst "%ProgramFiles(x86)%\Cisco Systems\VPN Client\Profiles" -file *.pcf -rb 0
'%WINDIR%\installer\msi32a0.tmp' -cmd CopyAndBackupFiles -src "%TEMP%\RarSFX0\" -dst "%ProgramFiles(x86)%\Cisco Systems\VPN Client\" -file vpnclient.ini -rb 0
'%CommonProgramFiles%\deterministic networks\common files\dneinst.exe' -Install -InstallPath "%CommonProgramFiles%\Deterministic Networks\DNE"
'%CommonProgramFiles%\deterministic networks\dne\dnes64x.exe' networks\DNE\dnes64x.exe -c s -l "%CommonProgramFiles%\deterministic networks\DNE\dne2000.inf" -i dni_dne
'%WINDIR%\installer\msi165b.tmp' -cmd SetClientLanguage -lang 1033
'%CommonProgramFiles%\deterministic networks\common files\dneinst.exe' -AddPlugin CVPNDRVA -Description "Cisco Systems Inc. IPSec Driver" -InstallPath <DRIVERS> -Verbose
'%ProgramFiles(x86)%\cisco systems\vpn client\vainst64.exe' nopopup i "%ProgramFiles(x86)%\Cisco Systems\VPN Client\Setup\CVirtA64.inf" CS_VirtA
'%CommonProgramFiles%\deterministic networks\dne\dnes64x.exe' networks\DNE\dnes64x.exe -c s -l "%CommonProgramFiles%\deterministic networks\DNE\dne2000.inf" -i dni_dne' (with hidden window)

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\RarSFX0\vpnclient_setup.msi" /passive

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial