Trojan.Siggen34.17405

To ensure autorun and distribution

Creates or modifies the following files

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\

Modifies file system

Creates the following files

Deletes following files that it created itself

Moves the following files

from %APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_f6fc92d9618c to %APPDATA%\comain_ev2f79\ev2f79.exe
from %APPDATA%\comain_ev2f79\ntrin.er.nhpart_9e6c3786fcd4 to %APPDATA%\comain_ev2f79\ntrin.er
from %APPDATA%\comain_ev2f79\otrm.oi.nhpart_7e6fc832474b to %APPDATA%\comain_ev2f79\otrm.oi
from %APPDATA%\comain_ev2f79\yinma.vc.nhpart_5b066b1843b9 to %APPDATA%\comain_ev2f79\yinma.vc
from %APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_114cbc113a9b to %APPDATA%\comain_ev2f79\dxyvnb.ti
from %APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_80e964c871c4 to %APPDATA%\comain_ev2c34\ev2c34.exe
from %APPDATA%\comain_ev2c34\bnymir.ou.nhpart_5ff8cf562dd9 to %APPDATA%\comain_ev2c34\bnymir.ou
from %APPDATA%\comain_ev2c34\bteuns.pt.nhpart_70ffc2b875a5 to %APPDATA%\comain_ev2c34\bteuns.pt
from %APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_db7e9d6410cf to %APPDATA%\comain_ev2c34\cmrsk.ce
from %APPDATA%\comain_ev2c34\fhkan.oi.nhpart_15e595a9976a to %APPDATA%\comain_ev2c34\fhkan.oi
from %APPDATA%\comain_ev2c34\ap.asin.nhpart_76994d912e87 to %APPDATA%\comain_ev2c34\ap.asin

Network activity

Connects to

TCP

Other

Miscellaneous

Searches for the following windows

Creates and executes the following

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\findstr.exe' /I /C:"360tray.exe" /C:"HipsTray.exe"
'%WINDIR%\syswow64\cmd.exe' /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"
'%WINDIR%\syswow64\cmd.exe' /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\useraccountbroker.exe'
'<SYSTEM32>\edpnotify.exe'
'%WINDIR%\syswow64\cmd.exe' /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"' (with hidden window)