Trojan.MulDrop38.23048

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Registry Editor (RegEdit)

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im taskmgr.exe

Modifies file system

Creates the following files

%TEMP%\_mei16842\vcruntime140.dll
%TEMP%\_mei16842\vcruntime140_1.dll
%TEMP%\_mei16842\_bz2.pyd
%TEMP%\_mei16842\_ctypes.pyd
%TEMP%\_mei16842\_decimal.pyd
%TEMP%\_mei16842\_hashlib.pyd
%TEMP%\_mei16842\_lzma.pyd
%TEMP%\_mei16842\_socket.pyd
%TEMP%\_mei16842\_ssl.pyd
%TEMP%\_mei16842\_zstd.pyd
%TEMP%\_mei16842\base_library.zip
%TEMP%\_mei16842\libcrypto-3.dll
%TEMP%\_mei16842\libffi-8.dll
%TEMP%\_mei16842\libssl-3.dll
%TEMP%\_mei16842\python314.dll
%TEMP%\_mei16842\pywin32_system32\pywintypes314.dll
%TEMP%\_mei16842\select.pyd
%TEMP%\_mei16842\unicodedata.pyd
%TEMP%\_mei16842\win32\win32api.pyd
%TEMP%\_mei16842\win32\win32gui.pyd
%TEMP%\_mei16842\win32\win32process.pyd
nul
<Current directory>\fakebios.bin
C:\fill9214.tmp
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6.dat
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat.log1
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log1
%LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat.log1
%ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat
\device\harddiskvolume1\boot\bcd.log
\device\harddiskvolume1\boot\bcd

Deletes following files that it created itself

%TEMP%\_mei16842\base_library.zip
%TEMP%\_mei16842\libcrypto-3.dll
%TEMP%\_mei16842\libffi-8.dll
%TEMP%\_mei16842\libssl-3.dll
%TEMP%\_mei16842\python314.dll
%TEMP%\_mei16842\pywin32_system32\pywintypes314.dll
%TEMP%\_mei16842\select.pyd
%TEMP%\_mei16842\unicodedata.pyd
%TEMP%\_mei16842\vcruntime140.dll
%TEMP%\_mei16842\vcruntime140_1.dll
%TEMP%\_mei16842\win32\win32api.pyd
%TEMP%\_mei16842\win32\win32gui.pyd
%TEMP%\_mei16842\win32\win32process.pyd
%TEMP%\_mei16842\_bz2.pyd
%TEMP%\_mei16842\_ctypes.pyd
%TEMP%\_mei16842\_decimal.pyd
%TEMP%\_mei16842\_hashlib.pyd
%TEMP%\_mei16842\_lzma.pyd
%TEMP%\_mei16842\_socket.pyd
%TEMP%\_mei16842\_ssl.pyd
%TEMP%\_mei16842\_zstd.pyd

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f >nul 2>&1
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c taskkill /f /im taskmgr.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32> /r /d y >nul 2>&1
'<SYSTEM32>\cmd.exe' /c copy /y NUL fakebios.bin
'<SYSTEM32>\cmd.exe' /c "cmd /c "start /b /high python -c \"import ctypes; ctypes.windll.opengl32.wglCreateContext(0); while True: pass\"""
'<SYSTEM32>\takeown.exe' /f <SYSTEM32> /r /d y
'<SYSTEM32>\cmd.exe' /c "start /b /high python -c \"import ctypes; ctypes.windll.opengl32.wglCreateContext(0); while True: pass\""
'<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f >nul 2>&1
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
'%ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appinstallerpythonredirector.exe' -c \"import ctypes; ctypes.windll.opengl32.wglCreateContext(0); while True: pass\"
'<SYSTEM32>\cmd.exe' /c shutdown /r /t 0 /f
'<SYSTEM32>\shutdown.exe' /r /t 0 /f
'<SYSTEM32>\cmd.exe' /c "cmd /c "start /b /high python -c \"import ctypes; ctypes.windll.opengl32.wglCreateContext(0); while True: pass\"""' (with hidden window)