Trojan.Siggen10.32024

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\chrome updater.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\dns client.exe
<SYSTEM32>\tasks\winupdate
<SYSTEM32>\tasks\microsoft\windows\media center\startrecording
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks

Sets the following service settings

[<HKLM>\SYSTEM\CurrentControlSet\Services\TermService\Parameters] 'ServiceDll' = '<SYSTEM32>\termhlpr.dll'
[<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\clr_optimization_v2.0.50727_32] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\clr_optimization_v2.0.50727_64] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\iScsiPrt] 'ImagePath' = 'system32\DRIVERS\msiscsi.sys'

Creates the following services

'umbus' system32\DRIVERS\umbus.sys
'iScsiPrt' system32\DRIVERS\msiscsi.sys

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Remote Desktop Port" dir=in action=allow protocol=TCP localport=3389

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\svchost.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKLM>\Software\Wow6432Node\Microsoft\Internet Account Manager]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\fraqbc8ws
<SYSTEM32>\microsoft\protect\s-1-5-20\856d0f6d-d3d6-436e-b1d6-8ba25e5d9887
%WINDIR%\registration\{02d4b3f1-fd88-11d1-960d-00805fc79235}.{f601ddf5-4a99-4204-ae38-cf0fca0728f5}.crmlog
<SYSTEM32>\termhlpr.dll
%ALLUSERSPROFILE%\838dc6407d532214332168\upd.exe
%APPDATA%\microsoft sdk\microsoft wim.exe
nul
%TEMP%\bltrnbyjrd.exe
%TEMP%\xqmdwyzqtr.exe
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\fx6ojkfk6-shm
%LOCALAPPDATA%low\fx6ojkfk6
%LOCALAPPDATA%low\v6yqztbtk-shm
%LOCALAPPDATA%low\v6yqztbtk
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\u8r6yqr2f-shm
%LOCALAPPDATA%low\u8r6yqr2f
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ia2marshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\freebl3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\breakpadinjector.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblemarshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblehandler.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\vcruntime140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ucrtbase.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\softokn3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\qipcap.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\prldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssdbm3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\hv8745939v498h.zip
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%LOCALAPPDATA%low\3098htrhpen8ifg0\lgpllibs.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\libegl.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldif60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\rgysr3livr4.zip
<SYSTEM32>\microsoft\protect\s-1-5-20\preferred
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssckbi.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nss3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\msvcp140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozglue.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-1.dll
%ALLUSERSPROFILE%\microsoft\ehome\recoverytasks\recoverytasks.smem

Sets the 'hidden' attribute to the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\chrome updater.exe
%APPDATA%\microsoft sdk\microsoft wim.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\dns client.exe

Deletes the following files

%LOCALAPPDATA%low\3098htrhpen8ifg0\hv8745939v498h.zip
%LOCALAPPDATA%low\3098htrhpen8ifg0\freebl3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\breakpadinjector.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ia2marshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\msvcp140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\vcruntime140.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\lgpllibs.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ucrtbase.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\softokn3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\qipcap.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\prldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssdbm3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nssckbi.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\nss3.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozmapi32.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mozglue.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy_inuse.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\mapiproxy.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\libegl.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldap60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\ldif60.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblemarshal.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\accessiblehandler.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\rgysr3livr4.zip
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\fx6ojkfk6
%LOCALAPPDATA%low\v6yqztbtk
%LOCALAPPDATA%low\v6yqztbtk-shm
%LOCALAPPDATA%low\u8r6yqr2f
%LOCALAPPDATA%low\u8r6yqr2f-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fx6ojkfk6-shm
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\3098htrhpen8ifg0\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\registration\{02d4b3f1-fd88-11d1-960d-00805fc79235}.{70c8e9a1-71ac-4642-8c00-42bb5ae4e409}.crmlog

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://93.##7.63.41/onu.exe
http://93.##7.63.41/ene.exe
http://te###wms.com/view/unit/img2.php?ve########

HTTP POST requests

http://te###wms.com/view/unit/img2.php

'te##te.in':443

'rs##rs.site':443

UDP

DNS ASK te##te.in
DNS ASK rs##rs.site
DNS ASK microsoft.com
DNS ASK te###wms.com

Miscellaneous

Searches for the following windows

ClassName: 'Media Center SSO' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''

Creates and executes the following

'%TEMP%\xqmdwyzqtr.exe'
'%TEMP%\bltrnbyjrd.exe'
'%APPDATA%\microsoft\windows\start menu\programs\startup\dns client.exe'
'%ALLUSERSPROFILE%\838dc6407d532214332168\upd.exe'
'%TEMP%\xqmdwyzqtr.exe' ' (with hidden window)
'%TEMP%\bltrnbyjrd.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /F /tn WinUpdate /tr "%ALLUSERSPROFILE%\838DC6407D532214332168\upd.exe" /sc MINUTE /ru SYSTEM' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall add rule name="Remote Desktop Port" dir=in action=allow protocol=TCP localport=3389' (with hidden window)
'%ALLUSERSPROFILE%\838dc6407d532214332168\upd.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C timeout /T 10 /NOBREAK > Nul & Del /f /q "<Full path to file>"
'<SYSTEM32>\fxssvc.exe'
'%WINDIR%\ehome\ehtray.exe' /nav:-2
'%WINDIR%\ehome\ehsched.exe'
'%WINDIR%\ehome\ehprivjob.exe' /DoUpdateRecordPath /Event:Global\MediaCenter_UpdateRecordPath_944a0c118bf9
'%WINDIR%\ehome\ehprivjob.exe' /DRMInit
'%WINDIR%\ehome\ehrecvr.exe'
'<SYSTEM32>\svchost.exe' -k defragsvc
'<SYSTEM32>\dllhost.exe' /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
'<SYSTEM32>\svchost.exe' -k bthsvcs
'<SYSTEM32>\svchost.exe' -k AxInstSVGroup
'<SYSTEM32>\alg.exe'
'%WINDIR%\syswow64\schtasks.exe' /create /F /tn WinUpdate /tr "%ALLUSERSPROFILE%\838DC6407D532214332168\upd.exe" /sc MINUTE /ru SYSTEM
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall add rule name="Remote Desktop Port" dir=in action=allow protocol=TCP localport=3389
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /F /tn WinUpdate /tr "%ALLUSERSPROFILE%\838DC6407D532214332168\upd.exe" /sc MINUTE /ru SYSTEM
'%WINDIR%\syswow64\timeout.exe' /T 10 /NOBREAK
'%WINDIR%\ehome\ehprivjob.exe' /DoRecoveryTasks
'%ProgramFiles%\microsoft office\office14\groove.exe' /auditservice

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial