Trojan.Siggen18.29374

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WNSoftSerV1] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WNSoftSerV1] 'ImagePath' = '%ProgramFiles(x86)%\WanNengSoftManager\WNSoftSer.exe 05e'

Creates the following services

'WNSoftSerV1' %ProgramFiles(x86)%\WanNengSoftManager\WNSoftSer.exe 05e

Malicious functions

Searches for registry branches where third party applications store passwords

[<HKLM>\Software\Microsoft\IdentityCRL]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKLM>\Software\Microsoft\Windows Mail]

Modifies file system

Creates the following files

%LOCALAPPDATA%low\wannengsoftmanager\softconfig\softuse.ini
%ProgramFiles(x86)%\wannengsoftmanager\wnkernel.dll
%ProgramFiles(x86)%\wannengsoftmanager\wnsvdarme.dll
%CommonProgramFiles(x86)%\wannengsoftmanager\wannengsoftmanager.ini
%ProgramFiles(x86)%\wannengsoftmanager\wannengsoftmanager.ini
%ProgramFiles(x86)%\wannengsoftmanager\wnsoftser.exe
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_d14b79b440cdc26d7d21c81855e2c04d
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_d14b79b440cdc26d7d21c81855e2c04d
%LOCALAPPDATA%low\wannengsoftmanager\softconfig\7f70110c47e5.bae
%LOCALAPPDATA%low\wannengsoftmanager\softconfig\usecache.ini
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\69c6f6ec64e114822df688dc12cdd86c
D:\psmdownloads\icons\microsoft .net framework .png.temp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\465cdfb13433b6b0aa6a0083a07cff69
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\465cdfb13433b6b0aa6a0083a07cff69
D:\psmdownloads\icons\adobe acrobat reader dc.png.temp
D:\psmdownloads\icons\谷歌浏览器稳定版.png.temp
D:\psmdownloads\icons\winrar 64位.png.temp
D:\psmdownloads\icons\mozilla thunderbird.png.temp
D:\psmdownloads\icons\steam.png.temp
D:\psmdownloads\icons\pidgin.png.temp
D:\psmdownloads\icons\adobe flash player npapi.png.temp
%ProgramFiles(x86)%\wannengsoftmanager\wnferous64.dll
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\69c6f6ec64e114822df688dc12cdd86c
%ProgramFiles(x86)%\wannengsoftmanager\wnferous.dll
%ProgramFiles(x86)%\wannengsoftmanager\wnpatemar.exe
%TEMP%\91rd427\dhjk.bce.temp
%ProgramFiles(x86)%\wannengsoftmanager\icon\main.ico
%ProgramFiles(x86)%\wannengsoftmanager\icon\allicon\normal.ico
%ProgramFiles(x86)%\wannengsoftmanager\icon\allicon\update.ico
%ProgramFiles(x86)%\wannengsoftmanager\wnfghshmndf.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnfsupd.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnhghshtol.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnhghshtp.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnmfgohsht.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnsoftdown.exe
%ProgramFiles(x86)%\wannengsoftmanager\wncosemism.dll
%ProgramFiles(x86)%\wannengsoftmanager\wnsoftguider.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnsoftmanager.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnsvccen.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnsvceous.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe
%ProgramFiles(x86)%\wannengsoftmanager\wnuninst.exe
%ProgramFiles(x86)%\wannengsoftmanager\wke.dll
%ProgramFiles(x86)%\wannengsoftmanager\wnacelein.dll
%ProgramFiles(x86)%\wannengsoftmanager\wnacelein64.dll
%ProgramFiles(x86)%\wannengsoftmanager\wncosemism64.dll
D:\psmdownloads\icons\icq.png.temp

Deletes the following files

%ProgramFiles(x86)%\wannengsoftmanager\icon\main.ico

Moves the following files

from %TEMP%\91rd427\dhjk.bce.temp to %TEMP%\91rd427\dhjk.bce
from D:\psmdownloads\icons\adobe acrobat reader dc.png.temp to D:\psmdownloads\icons\adobe acrobat reader dc.png
from D:\psmdownloads\icons\谷歌浏览器稳定版.png.temp to D:\psmdownloads\icons\谷歌浏览器稳定版.png
from D:\psmdownloads\icons\winrar 64位.png.temp to D:\psmdownloads\icons\winrar 64位.png
from D:\psmdownloads\icons\mozilla thunderbird.png.temp to D:\psmdownloads\icons\mozilla thunderbird.png
from D:\psmdownloads\icons\steam.png.temp to D:\psmdownloads\icons\steam.png
from D:\psmdownloads\icons\pidgin.png.temp to D:\psmdownloads\icons\pidgin.png
from D:\psmdownloads\icons\adobe flash player npapi.png.temp to D:\psmdownloads\icons\adobe flash player npapi.png
from D:\psmdownloads\icons\microsoft .net framework .png.temp to D:\psmdownloads\icons\microsoft .net framework .png
from D:\psmdownloads\icons\icq.png.temp to D:\psmdownloads\icons\icq.png

Substitutes the following files

%ProgramFiles(x86)%\wannengsoftmanager\icon\main.ico

Network activity

Connects to

'localhost':49174
'dl.##stb.com':80
'do##.#hxusong.com':80
'ow###.shuuw.com':443
'ji###.shuuw.com':80
'localhost':49229
'localhost':49225
'localhost':49222
'localhost':49219
'do##.shuuw.com':443
'localhost':49216
'localhost':49213
'localhost':49210
'localhost':49206
'dp#####shou.shuuw.com':80
'localhost':49202
'in#.#iald.com':443
'localhost':49197
'do##.shuuw.com':80
'localhost':49194
'localhost':49191
'ym###.shuuw.com':443
'wz###.shuuw.com':80
'localhost':49187
'localhost':49185
'microsoft.com':80
'wz###.shuuw.com':443
'localhost':49177
'ji###.shuuw.com':443
'localhost':49200
'tj###.shuuw.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://do##.shuuw.com/soft/manager/download/ef21cd270de1de024674cf65812d7efe/ef21cd270de1de024674cf65812d7efe_48.png
http://do##.shuuw.com/soft/manager/download/7c61deccba4c6eb9c13bf779613311c1/7c61deccba4c6eb9c13bf779613311c1_48.png
http://do##.shuuw.com/soft/manager/download/b44f99aa986012ccd53542bb697bd96a/b44f99aa986012ccd53542bb697bd96a_48.png
http://do##.shuuw.com/soft/manager/download/e8858fc5daf9fa133832c375131bd9a5/e8858fc5daf9fa133832c375131bd9a5_48.png
http://do##.shuuw.com/soft/manager/download/5752c04e30fa2ec669cc2b82671ca822/5752c04e30fa2ec669cc2b82671ca822_64.png
http://do##.shuuw.com/soft/manager/download/7eaec58a88dfc3c753aaff7ab517d03a/7eaec58a88dfc3c753aaff7ab517d03a_64.png
http://do##.shuuw.com/soft/manager/download/5c70066d5d2f1dc09ea939398cff0b6d/5c70066d5d2f1dc09ea939398cff0b6d_64.png
http://do##.shuuw.com/soft/manager/api/v1/html/img/Download_JT_23X23_BJT.png
http://do##.shuuw.com/soft/manager/download/d93fe4fa09a57b94f69ca72a4dcc4cc0/d93fe4fa09a57b94f69ca72a4dcc4cc0_48.png
http://do##.shuuw.com/soft/manager/download/527c460bead9692ff8536c0bdf94fac1/527c460bead9692ff8536c0bdf94fac1_64.png
http://do##.shuuw.com/soft/manager/download/9501105e816559a175aec55beb6bb990/9501105e816559a175aec55beb6bb990_48.png
http://do##.shuuw.com/soft/manager/download/d658d37790e93c94154847cdd961131f/d658d37790e93c94154847cdd961131f_48.png
http://do##.shuuw.com/soft/manager/download/5233aca617b0732305d0e8f8bd8a5f92/5233aca617b0732305d0e8f8bd8a5f92_48.png
http://do##.shuuw.com/soft/manager/download/2e02ad72843310373d76dc9d68d2e806/2e02ad72843310373d76dc9d68d2e806_48.png
http://do##.shuuw.com/soft/manager/api/v1/cat/icon/4a0aabd54f1239a3e420270d28509929.png
http://do##.shuuw.com/soft/manager/download/74d17fc6214b5cace91df9c64fd3a7e5/74d17fc6214b5cace91df9c64fd3a7e5_32.png
http://do##.shuuw.com/soft/manager/api/v1/cat/icon/063e899b74aadde0115f3fd8453aef2d.png
http://do##.shuuw.com/soft/manager/api/v1/html/img/tuijian.png
http://do##.shuuw.com/soft/manager/api/v1/html/img/ph.png
http://do##.shuuw.com/soft/manager/api/v1/html/img/1.jpg
http://do##.shuuw.com/soft/manager/api/v1/html/img/Download_Gif_26X26.gif
http://do##.shuuw.com/soft/manager/api/v1/html/img/zhuanti.png
http://do##.shuuw.com/soft/manager/api/v1/html/img/p_bg.png
http://do##.shuuw.com/soft/manager/download/3dcf1fdbade1db1a65d638a4c6987f31/3dcf1fdbade1db1a65d638a4c6987f31_48.png
http://do##.shuuw.com/soft/manager/download/fcc51fff8ab12b951142b54d4590def9/fcc51fff8ab12b951142b54d4590def9_48.png
http://do##.shuuw.com/soft/manager/download/d382014a44912a76db6b967bd7c64d86/d382014a44912a76db6b967bd7c64d86_48.png
http://do##.shuuw.com/soft/manager/download/81448c2e730b50b597bbd5e43007ce6a/81448c2e730b50b597bbd5e43007ce6a_48.png
http://do##.shuuw.com/soft/manager/download/a1640a42588917efdf57c501d3a8e037/a1640a42588917efdf57c501d3a8e037_48.png
http://do##.shuuw.com/soft/manager/download/33f38fe70eb2493fd2d72c8de0a8dc62/33f38fe70eb2493fd2d72c8de0a8dc62_48.png
http://do##.shuuw.com/soft/manager/download/d481cda2625d9dd2731a00f482484d86/d481cda2625d9dd2731a00f482484d86_48.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//825e6c8d6bb62b96ef76bf755ef786e2.png
http://do##.shuuw.com/soft/manager/api/v1/cat/icon/ecd1e1c4f51c825b1b606aa2196d0b41.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//a5758c16eaa89b0640669c27d5710c52.png
http://do##.#hxusong.com/soft/manager/api/v1/banner/all.json?ti################
http://wz###.shuuw.com/gj/wn/6760310aa84c.bae?ra#######
http://do##.shuuw.com/soft/manager/match/f899139df5e1059396431415e770c6dd.bae?ra#######
http://wz###.shuuw.com/xzrj/wn/dhjk.bce
http://do##.shuuw.com/soft/manager/api/v1/cat/all.json?ra########
http://do##.shuuw.com/soft/manager/api/v1/html/change/hot.html?29###
http://do##.shuuw.com/soft/manager/api/v1/html/js/lib/jquery183.js
http://do##.shuuw.com/soft/manager/api/v1/html/css/common/base.css
http://do##.shuuw.com/soft/manager/api/v1/html/css/page/Necessary.css
http://do##.shuuw.com/soft/manager/api/v1/html/js/lib/crypto-js.js
http://do##.shuuw.com/soft/manager/api/v1/html/js/lib/jquery.nicescroll.js
http://do##.shuuw.com/soft/manager/api/v1/html/js/lib/common.js
http://do##.shuuw.com/soft/manager/api/v1/html/js/page/Necessary.js
http://do##.shuuw.com/soft/manager/api/v1/html/img/loading.gif
http://do##.#hxusong.com/soft/manager/api/v1/soft/100/sort/1.json?ti################
http://do##.#hxusong.com/soft/manager/api/v1/soft/114/sort/1.json?ti################
http://dl.##stb.com/soft/manager/api/v1/banner/img//1cb2422c24b325a056713d4376fb8491.png
http://do##.#hxusong.com/soft/manager/api/v1/soft/112/sort/1.json?ti################
http://do##.shuuw.com/soft/manager/download/4a23efbd3f7f7b5252c9587130a8ba7d/4a23efbd3f7f7b5252c9587130a8ba7d_48.png
http://do##.shuuw.com/soft/manager/download/a6273221731e7d253d6273c5de452e72/a6273221731e7d253d6273c5de452e72_48.png
http://do##.shuuw.com/soft/manager/download/27cc4892b8941fe95dfda6add7ef0fdb/27cc4892b8941fe95dfda6add7ef0fdb_48.png
http://do##.shuuw.com/soft/manager/download/ecd2cbce6f497f045e7920e3c7468db2/ecd2cbce6f497f045e7920e3c7468db2_48.png
http://do##.#hxusong.com/soft/manager/api/v1/cat/seminar.json?ti################
http://dl.##stb.com/soft/manager/api/v1/banner/img//8848d5664d2536be26e826f26ad47d7d.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//d8886a7ce39213df7c504f26c00223cb.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//fdd906ae9da767251dbc2865832f4c0a.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//feeb95055be61392b000552b68d625cc.png
http://do##.shuuw.com/soft/manager/download/267d7a05aa7254b78a7b4a04cf675613/267d7a05aa7254b78a7b4a04cf675613_48.png
http://do##.shuuw.com/soft/manager/download/0f9264bbe0c9a361d28c2ac0084608e2/0f9264bbe0c9a361d28c2ac0084608e2_48.png
http://do##.shuuw.com/soft/manager/download/6d2a151967a161b61e1ef56392e77b95/6d2a151967a161b61e1ef56392e77b95_48.png
http://do##.shuuw.com/soft/manager/download/868d35fbbd37b294090c513900ca1127/868d35fbbd37b294090c513900ca1127_48.png
http://dl.##stb.com/soft/manager/api/v1/banner/img//fb9444fa054902a59ded3dae57981d1b.png
http://do##.shuuw.com/soft/manager/download/3655a18b3399a6017b9b892bfd92498a/3655a18b3399a6017b9b892bfd92498a_48.png

HTTP POST requests

http://dp#####shou.shuuw.com/softQuery.php
http://dp#####shou.shuuw.com/softUp.php
http://tj###.shuuw.com/sfc.php

Other

'localhost':49175
'localhost':49223
'localhost':49220
'localhost':49217
'localhost':49214
'localhost':49211
'localhost':49207
'localhost':49201
'localhost':49226
'localhost':49203
'localhost':49195
'localhost':49192
'ym###.shuuw.com':443
'localhost':49186
'localhost':49188
'localhost':49178
'ji###.shuuw.com':443
'localhost':49198
'localhost':49230

UDP

DNS ASK ji###.shuuw.com
DNS ASK wz###.shuuw.com
DNS ASK microsoft.com
DNS ASK ym###.shuuw.com
DNS ASK do##.shuuw.com
DNS ASK in#.#iald.com
DNS ASK ow###.shuuw.com
DNS ASK do##.#hxusong.com
DNS ASK dl.##stb.com
DNS ASK dp#####shou.shuuw.com
DNS ASK tj###.shuuw.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: '万能软件管家'
ClassName: 'TimerWindowClass' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\wannengsoftmanager\wnsoftser.exe' 05e
'%ProgramFiles(x86)%\wannengsoftmanager\wnsoftmanager.exe'
'%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe' e18
'%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe' 0b2 --9fa1=1
'%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe' a80 --9fa1=1
'%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe' 0f2
'%ProgramFiles(x86)%\wannengsoftmanager\wnfsupd.exe' d1d
'%ProgramFiles(x86)%\wannengsoftmanager\wnumanlike.exe' 0b2 --9fa1=0

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial