Trojan.MulDrop5.3071

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AtiTrayTools' = '"%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray.exe"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\atitray] 'Start' = '00000001'

Malicious functions:

Creates and executes the following:

'%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\srvinst.exe' I
'%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\srvinst.exe' S
'%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\srvinst.exe' U
'%TEMP%\RarSFX0\WinborgXP-App-Installer.exe'
'%TEMP%\RarSFX0\attsetup.exe' /S

Executes the following:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attext.dll"
'%WINDIR%\regedit.exe' /S reg.reg
'<SYSTEM32>\rundll32.exe' "%TEMP%\nsb3.tmp\OCSetupHlp.dll",_OCPRD306RunOpenCandyDLL@16 2904
'<SYSTEM32>\regsvr32.exe' /s /u "%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attext.dll"

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\plugins.pas
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\readme.txt
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\example\plugin1\plugin1.dpr
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\hddtemp\hddtemp.dpr
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\example\plugin1\plugin1.res
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\Delphi\attshmem.res
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\Delphi\uMain.dfm
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\res\attsharedmem.rc2
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\Delphi\attshmem.dof
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\Delphi\uMain.pas
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\Delphi\attshmem.dpr
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\pciinfo.dsp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\pciinfo.def
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\pciinfo.dsw
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\StdAfx.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\resource.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\StdAfx.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\hddtemp\strtoicon.pas
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\hddtemp\smart_drv.pas
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\delphi\hddtemp\hddtemp.res
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\pciinfo.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\plugins.h
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Download plugins.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\WEB Support Russian.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Shell Integration\Integrate into Windows Shell.lnk
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.clw
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Shell Integration\Remove Windows Shell Integration.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\WEB Support English.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\ATI Tray Tools.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Uninstall ATI Tray.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\ATI XCoder.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Read me first.lnk
%HOMEPATH%\Start Menu\Programs\ATI Tray Tools\Low Level Driver Installation.lnk
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\resource.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmemDlg.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\StdAfx.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\res\attsharedmem.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.rc
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmemDlg.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\StdAfx.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.dsw
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\VC\attsharedmem.dsp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\pciinfo\resources.rc
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.dsw
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.dsp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\StdAfx.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\resource.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.rc
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.def
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon9.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon8.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\cpuload.rc
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\StdAfx.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\resource.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.dsw
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\StdAfx.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.rc
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.mak
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.dsp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\osdtime\osdtime.mak
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\StdAfx.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.dep
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\mongraphs\mongraphsexample.def
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\resource.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\PerfCounters.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\StdAfx.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon10.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon1.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\CpuUsage.h
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\CpuUsage.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\cpuload.cpp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\cpuload.def
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\cpuload.dsw
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\cpuload.dsp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon4.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon3.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon5.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon7.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon6.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon2.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon12.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon11.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon13.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon15.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\api\vc++\example\cpuload\icon14.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins.url
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\radeon.url
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\guru3d.url
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Finnish.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Belarussian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\License.rtf
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\WhatsNew.txt
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\readme.htm
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\kbdhook.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\support.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\raphook.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Simplified Chinese.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Russian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Spanish.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\bulgarian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Ukrainian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Romanian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Japanese.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Hungarian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Korean.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Portugues_BR.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\Polish.ini
%TEMP%\nsb3.tmp\System.dll
%TEMP%\nsb3.tmp\OCSetupHlp.dll
%TEMP%\nsb3.tmp\splash.bmp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\srvinst.exe
%TEMP%\nsb3.tmp\AdvSplash.dll
%TEMP%\nsg2.tmp
%TEMP%\RarSFX0\WinborgXP-App-Installer.exe
%TEMP%\RarSFX0\attsetup.exe
%TEMP%\RarSFX0\WinborgXP-App-Installer.au3
%TEMP%\RarSFX0\reg.reg
%TEMP%\RarSFX0\icon.ico
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attrest.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\utils64.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\ATIXcoder.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray.hlp
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attdrv64.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray64.sys
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray.sys
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attsio.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\atitray.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\attext.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\czech.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mg_cpuload.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\pciinfo.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\pciset.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\osdtime.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\hddtemp.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\spark.dds
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\vertices.dat
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\normals.dat
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\fur2.dds
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\bench.res
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\rain2.dds
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mg_amdcore.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mg_xvlt.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mg_intelcpu.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\uninstall.exe
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\shared memory\readme.txt
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mg_hdddtemp.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\osd_cpuload.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\osd_intelcpu.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\osdminfo.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\mongraphsexample.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\plugins\osd_amdcore.dll
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\d3d Balanced.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\OGL Max Speed.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\d3d Max Quality.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Advanced CrossFire.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\d3d Max Speed.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\OGL Max Quality.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\french.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\english.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\german.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Presets\OGL Balanced.reg
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\lng\italian.ini
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Video Tweaks.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\New AA and AF Methods.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Vista Avivo.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\3d\face_indicies.dat
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\readme.txt
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Multi Thread Support.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Advanced OGL Tweaks.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Advanced D3D Tweaks.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\CCC Mode Switch.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Display Tweaks.dtb
%PROGRAM_FILES%\Ray Adams\ATI Tray Tools\Database\Compatibility Tweaks.dtb

Deletes the following files:

%TEMP%\RarSFX0\reg.reg
%TEMP%\RarSFX0\icon.ico
%TEMP%\RarSFX0\WinborgXP-App-Installer.exe
%TEMP%\RarSFX0\WinborgXP-App-Installer.au3
%TEMP%\RarSFX0\attsetup.exe
%TEMP%\nsb3.tmp\OCSetupHlp.dll
%TEMP%\nsb3.tmp\AdvSplash.dll
%TEMP%\nsb3.tmp\System.dll
%TEMP%\nsb3.tmp\splash.bmp

Miscellaneous:

Searches for the following windows:

ClassName: 'TfrmMainATT' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: '(null)' WindowName: 'ati_tray_tools'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '995D92B2-4ED9-43A7-9338-8CC7D1746F96' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial