Trojan.Siggen11.203

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\Heinote.txt\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.sql\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.diff\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.iss\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.nsi\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.nsh\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.json\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.makefile\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.yaml\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.md\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.lua\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.py\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.pl\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.xml\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.log\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.markdown\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'
[<HKLM>\Software\Classes\Heinote.rc\shell\open\command] '' = '%APPDATA%\Heinote\hnote.exe %1'

Creates or modifies the following files

<SYSTEM32>\tasks\hn_repair
<SYSTEM32>\tasks\hn_update

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\HEINOTEUPDATE] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\HEINOTEUPDATE] 'ImagePath' = '<SYSTEM32>\svchost.exe -k HEINOTEUPDATE'
[<HKLM>\SYSTEM\CurrentControlSet\Services\HEINOTEUPDATE\Parameters] 'ServiceDll' = '%APPDATA%\Heinote\HNChecker.dll'

Creates the following services

'HEINOTEUPDATE' <SYSTEM32>\svchost.exe -k HEINOTEUPDATE

Modifies file system

Creates the following files

%TEMP%\peblokbuzheinote85000910alin001.exe
%TEMP%\funinstaller_ps_0107004.exe
%TEMP%\fmpskin\configuration.7z
%TEMP%\fmpskin\configuration\installerdefault.skin
%TEMP%\funaccesetupfiles\setupfiles.7z
%TEMP%\funaccesetupfiles\funacce\seedicon.ico
%TEMP%\funaccesetupfiles\funacce\acceclient.exe
%TEMP%\funaccesetupfiles\funacce\uninst.exe
%TEMP%\funaccesetupfiles\funacce\风行视频加速器.exe
%TEMP%\funaccesetupfiles\funacce\aptnail.dll
%TEMP%\funaccesetupfiles\funacce\dicengjiasu.dll
%TEMP%\funaccesetupfiles\funacce\dicengjiasu64.dll
%TEMP%\funaccesetupfiles\funacce\fireman.dll
%APPDATA%\microsoft\windows\start menu\小黑记事本\卸载小黑记事本.lnk
%TEMP%\ldsgamemaster.exe
%TEMP%\funaccesetupfiles\funacce\funaccelerator.dll
%TEMP%\funaccesetupfiles\funacce\funworks.dll
%TEMP%\funaccesetupfiles\funacce\funworks64.dll
%TEMP%\funaccesetupfiles\funacce\gma.dll
%TEMP%\funaccesetupfiles\funacce\aenvclear.daw
%TEMP%\funaccesetupfiles\funacce\sfunworks.daw
%TEMP%\funaccesetupfiles\funacce\ssdodge.daw
%TEMP%\{71842ce5-f4f3-4979-a5ed-f51338f26c6a}.tf
%TEMP%\{e7c2dc59-b30b-4a07-b944-b9985586a7f7}.tmp
%TEMP%\{b317f349-1250-4ce6-973c-4fe7e2cc7a75}.tmp\7z.dll
%TEMP%\{6bc58abe-0d3b-4359-9000-fc2d5f0a2ff2}.tmp
%TEMP%\{c0675084-5510-4213-b924-629a5034ad20}.tmp\360base.dll
%TEMP%\{c0675084-5510-4213-b924-629a5034ad20}.tmp\360netul.dll
%TEMP%\funaccesetupfiles\funacce\funaccelerator64.dll
%TEMP%\funaccesetupfiles\funacce\fundodge.dll
%APPDATA%\microsoft\windows\start menu\小黑记事本\启动小黑记事本.lnk
%HOMEPATH%\desktop\小黑记事本.lnk
%APPDATA%\heinote\uninst.tmp
%TEMP%\{f0020af3-b381-4347-bf3e-0d62b3940331}.tf
%TEMP%\lud2b63.tmp
%TEMP%\360base.dll
%TEMP%\{56598054-9f8e-4ba8-b847-955d1b681d65}.tf
%TEMP%\lud2c10.tmp
%TEMP%\360net.dll
%TEMP%\{78fad67c-f79a-4bbf-9a4f-6c6bc33ffc4c}.tf
%APPDATA%\heinote\autosave.tmp
%APPDATA%\heinote\feedback.tmp
%APPDATA%\heinote\filerelated.tmp
%APPDATA%\heinote\readmode.tmp
%APPDATA%\heinote\service.tmp
%APPDATA%\heinote\skinbox.tmp
%TEMP%\ldsgamemasterinstroad_214001.exe
%APPDATA%\heinote\hnote.tmp
%APPDATA%\heinote\report.tmp
%APPDATA%\heinote\update.tmp
%APPDATA%\heinote\upgrade.tmp
%APPDATA%\heinote\duilib.tmp
%APPDATA%\heinote\hnchecker.tmp
%APPDATA%\heinote\hnshell.tmp
%APPDATA%\heinote\hnshell64.tmp
%APPDATA%\heinote\hnpreview.tmp
%APPDATA%\heinote\hnpreview64.tmp
%APPDATA%\heinote\heinote.tmp
%APPDATA%\heinote\unuserchoise.tmp
%APPDATA%\heinote\userchoise.tmp
%APPDATA%\heinote\updatechecker.tmp
%APPDATA%\heinote\notepaper.tmp
%TEMP%\{c0675084-5510-4213-b924-629a5034ad20}.tmp\netbridge.dll
%TEMP%\{c0675084-5510-4213-b924-629a5034ad20}.tmp\utils\ldsbasic.dll

Deletes the following files

%TEMP%\{f0020af3-b381-4347-bf3e-0d62b3940331}.tf
%TEMP%\lud2b63.tmp
%TEMP%\360base.dll
%TEMP%\{56598054-9f8e-4ba8-b847-955d1b681d65}.tf
%TEMP%\lud2c10.tmp
%TEMP%\360net.dll
%TEMP%\{78fad67c-f79a-4bbf-9a4f-6c6bc33ffc4c}.tf
%TEMP%\{71842ce5-f4f3-4979-a5ed-f51338f26c6a}.tf
%TEMP%\{e7c2dc59-b30b-4a07-b944-b9985586a7f7}.tmp
%TEMP%\{6bc58abe-0d3b-4359-9000-fc2d5f0a2ff2}.tmp

Moves the following files

from %APPDATA%\heinote\autosave.tmp to %APPDATA%\heinote\autosave.exe
from %APPDATA%\heinote\updatechecker.tmp to %APPDATA%\heinote\updatechecker.dll
from %APPDATA%\heinote\update.tmp to %APPDATA%\heinote\update.dll
from %APPDATA%\heinote\userchoise.tmp to %APPDATA%\heinote\userchoise.reg
from %APPDATA%\heinote\unuserchoise.tmp to %APPDATA%\heinote\unuserchoise.reg
from %APPDATA%\heinote\heinote.tmp to %APPDATA%\heinote\heinote.ini
from %APPDATA%\heinote\hnpreview64.tmp to %APPDATA%\heinote\hnpreview64.dll
from %APPDATA%\heinote\hnpreview.tmp to %APPDATA%\heinote\hnpreview.dll
from %APPDATA%\heinote\hnshell64.tmp to %APPDATA%\heinote\hnshell64.dll
from %APPDATA%\heinote\hnshell.tmp to %APPDATA%\heinote\hnshell.dll
from %APPDATA%\heinote\hnchecker.tmp to %APPDATA%\heinote\hnchecker.dll
from %APPDATA%\heinote\duilib.tmp to %APPDATA%\heinote\duilib.dll
from %APPDATA%\heinote\upgrade.tmp to %APPDATA%\heinote\upgrade.exe
from %APPDATA%\heinote\update.tmp to %APPDATA%\heinote\update.exe
from %APPDATA%\heinote\report.tmp to %APPDATA%\heinote\report.exe
from %APPDATA%\heinote\notepaper.tmp to %APPDATA%\heinote\notepaper.exe
from %APPDATA%\heinote\hnote.tmp to %APPDATA%\heinote\hnote.exe
from %APPDATA%\heinote\skinbox.tmp to %APPDATA%\heinote\skinbox.exe
from %APPDATA%\heinote\service.tmp to %APPDATA%\heinote\service.exe
from %APPDATA%\heinote\readmode.tmp to %APPDATA%\heinote\readmode.exe
from %APPDATA%\heinote\filerelated.tmp to %APPDATA%\heinote\filerelated.exe
from %APPDATA%\heinote\feedback.tmp to %APPDATA%\heinote\feedback.exe
from %APPDATA%\heinote\report.tmp to %APPDATA%\heinote\report.dll
from %APPDATA%\heinote\uninst.tmp to %APPDATA%\heinote\uninst.exe

Substitutes the following files

%APPDATA%\heinote\update.tmp
%APPDATA%\heinote\report.tmp

Network activity

TCP

HTTP GET requests

http://d.###note.com/downloads/alin_1/pEbLokbuZheinote85000910alin001.exe
http://dl.##dashi.com/gamemaster/LDSGameMasterInstRoad_214001.exe
http://do#####ds.funshion.net/tools/cloudinstall_signature/7004/FunInstaller_PS_0107004.exe
http://dl.##dashi.com/gamemaster/buychannelFull.exe
http://s.###ashi.com/mgame?ty##########################################################################################################################
http://s.###ashi.com/mgame?ty#################################################################################################################################
http://tj#.#654.com/heinote/common_action?co#####################################################################################################################################################...
http://ky######on.dftoutiao.com/position/get02
http://do###.7654.com/n/heinote2.json
http://do####f.eastday.com/wnkt/qdb/setup_wnktwkb011.exe
http://do###.7654.com/n/logo/v1.0.0.2/ShellExtStrategyDll64.gif
http://s.###ashi.com/mgame?ty###################################################################################################################################
http://s.###ashi.com/mgame?ty################################################################################################################################

HTTP POST requests

http://ap#.#58pan.com/upgrape.php
http://tj#.#654.com/heinote/common_action?co#####################################################################################################################################################...

UDP

DNS ASK ap#.#58pan.com
DNS ASK d.###note.com
DNS ASK dl.##dashi.com
DNS ASK tj#.#654.com
DNS ASK do#####ds.funshion.net
DNS ASK s.###ashi.com
DNS ASK ky######on.dftoutiao.com
DNS ASK do###.7654.com
DNS ASK do####f.eastday.com
DNS ASK ne#####.funshion.com
DNS ASK st##.#unshion.net

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\peblokbuzheinote85000910alin001.exe'
'%TEMP%\ldsgamemasterinstroad_214001.exe'
'%APPDATA%\heinote\hnote.exe' -install
'%APPDATA%\heinote\hnote.exe' -schedule
'%APPDATA%\heinote\notepaper.exe' -install
'%TEMP%\funinstaller_ps_0107004.exe'
'%TEMP%\ldsgamemaster.exe' /PID="214001" /S /FROM=inst
'%APPDATA%\heinote\report.exe'
'%WINDIR%\syswow64\regedit.exe' /s "%APPDATA%\Heinote\UserChoise.reg"' (with hidden window)
'%APPDATA%\heinote\notepaper.exe' -install' (with hidden window)
'%APPDATA%\heinote\report.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\HNShell64.dll
'%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\HNPreview64.dll
'%WINDIR%\syswow64\regsvr32.exe' /s /u %APPDATA%\Heinote\hnchecker.dll
'%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\UserChoise.reg
'%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\HNShell64.dll
'<SYSTEM32>\regsvr32.exe' /s %APPDATA%\Heinote\HNShell64.dll
'%WINDIR%\syswow64\regedit.exe' /s "%APPDATA%\Heinote\UserChoise.reg"
'%WINDIR%\syswow64\regsvr32.exe' /s %APPDATA%\Heinote\HNPreview64.dll
'<SYSTEM32>\regsvr32.exe' /s %APPDATA%\Heinote\HNPreview64.dll
'%WINDIR%\syswow64\svchost.exe' -k HEINOTEUPDATE

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial