Trojan.PWS.Siggen3.29188

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%LOCALAPPDATA%\google\chrome\user data8tkq1\chrome_shutdown_ms.txt
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\aef7.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\aed6.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\ae97.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_3
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_2
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_1
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_0
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\index
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_3
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_2
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_1
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_0
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\index
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\91e2.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\000001.dbtmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\manifest-000001
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\000001.dbtmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\manifest-000001
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\manifest-000001
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\000001.dbtmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\8f82.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\session storage\log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\session storage\000001.dbtmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\session storage\manifest-000001
%LOCALAPPDATA%\google\chrome\user data8tkq1\4661.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\45b5.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\2112.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\1e05.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\1b84.tmp
%TEMP%\etilqs_zpypzftnsxmeyhu
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\e566.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\e1ad.tmp
%TEMP%\etilqs_pfjnhxa677dqzlu
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000003.log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000001
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\000003.log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\log
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\web data-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\web data
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\current tabs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\current session
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\chromedwritefontcache
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing uws list prefix set
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing uws list
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing ip blacklist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing inclusion whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing extension blacklist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing download whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing download
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing csd whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing cookies-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing cookies
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing bloom prefix set
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing bloom
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\favicons-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\google profile.ico
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\favicons
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\visited links
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history provider cache
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\transportsecurity
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\top sites-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\top sites
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\shortcuts-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\shortcuts
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\readme
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\quotamanager-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\47b.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\9399.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\network action predictor-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\network action predictor
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\login data-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\login data
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\last tabs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\last session
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\quotamanager
%LOCALAPPDATA%\google\chrome\user data8tkq1\ce3b.tmp

Deletes the following files

%LOCALAPPDATA%\google\chrome\user data8tkq1\chrome_shutdown_ms.txt
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\quotamanager
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\quotamanager-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\readme
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\shortcuts-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\top sites-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\transportsecurity
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\web data-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_0
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_1
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_2
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\data_3
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cache\index
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\current
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rff9388.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\current
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_0
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_1
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_2
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\data_3
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\gpucache\index
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff1b9b.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences~rff2136.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rff45a7.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff4672.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff8f82.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\current
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing download whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\91e2.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history provider cache
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\last session
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rfeaea6.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences~rfeaee4.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rfeaf03.tmp
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing bloom
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing bloom prefix set
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing cookies
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing cookies-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing csd whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing download
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing extension blacklist
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\network action predictor-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing inclusion whitelist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing ip blacklist
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing uws list
%LOCALAPPDATA%\google\chrome\user data8tkq1\safe browsing uws list prefix set
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\chromedwritefontcache
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\current tabs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\favicons-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\google profile.ico
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\last tabs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\login data-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rffce37.tmp

Moves the following files

from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension rules\current
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rff9388.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\9399.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
from %LOCALAPPDATA%\google\chrome\user data8tkq1\local state to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff8f82.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\8f82.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\session storage\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\session storage\current
from %LOCALAPPDATA%\google\chrome\user data8tkq1\local state to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff4672.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\4661.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rff45a7.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\45b5.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences~rff2136.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\ce3b.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\2112.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences
from %LOCALAPPDATA%\google\chrome\user data8tkq1\1b84.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\extension state\current
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences~rfeaf03.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\aef7.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences~rfeaee4.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\aed6.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences
from %LOCALAPPDATA%\google\chrome\user data8tkq1\local state to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rfeaea6.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\ae97.tmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state
from %LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\000001.dbtmp to %LOCALAPPDATA%\google\chrome\user data8tkq1\default\gcm store\current
from %LOCALAPPDATA%\google\chrome\user data8tkq1\local state to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rff1b9b.tmp
from %LOCALAPPDATA%\google\chrome\user data8tkq1\local state to %LOCALAPPDATA%\google\chrome\user data8tkq1\local state~rffce37.tmp

Substitutes the following files

%LOCALAPPDATA%\google\chrome\user data8tkq1\default\last session
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\current session
%LOCALAPPDATA%\google\chrome\user data8tkq1\local state
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\secure preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\preferences
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\origin bound certs
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\favicons-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\web data-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies-journal
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\cookies
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\transportsecurity
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\readme
%LOCALAPPDATA%\google\chrome\user data8tkq1\default\history-journal

Network activity

Connects to

'clients4.google.com':443
'tr######e.googleapis.com':443
'gs##tic.com':80
'clients3.google.com':443
'localhost':30026
'ss#.#static.com':443

TCP

HTTP GET requests

http://www.gs##tic.com/chrome/profile_avatars/NothingToDownload
http://12#.#.0.1:30026/json/version

Other

'clients2.google.com':443
'tr######e.googleapis.com':443
'localhost':49183
'localhost':49184
'localhost':49185
'localhost':49186
'localhost':49187
'localhost':49188
'localhost':49189
'localhost':49190
'localhost':49191
'localhost':49192
'accounts.google.com':443
'ss#.#static.com':443
'google.com':443
'gs##tic.com':443

UDP

DNS ASK clients2.google.com
DNS ASK clients4.google.com
DNS ASK google.com
DNS ASK go##le.ru
DNS ASK go###eapis.com
DNS ASK tr######e.googleapis.com
DNS ASK gs##tic.com
DNS ASK clients3.google.com
DNS ASK accounts.google.com
DNS ASK ss#.#static.com
'accounts.google.com':443
'google.com':443

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data8TKQ1'

Executes the following

'%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --remote-debugging-port=30026 --headless --user-data-dir="%LOCALAPPDATA%\Google\Chrome\User Data8TKQ1" --profile-directory="Default"
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="1496.0.1366229918\1622238684" --user-data-dir="%LOCALAPPDATA%\Google\Chrome\User Data8TKQ1" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-v...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
'%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial