Trojan.Siggen3.45974

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\exefile\shell\open\command] '' = '%1 %*'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '<SYSTEM32>\\SET7.tmp.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe %WINDIR%\System.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%WINDIR%\\System.76'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '<SYSTEM32>\SET7.tmp.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = 'C:\{7A1CD8A9-B708-4C8D-BF71-E45R48U20123}.eco'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\system] 'Shell' = 'C:\Enum.zeth D:\Enum.zeth E:\Enum.zeth <SYSTEM32>\SET7.tmp.exe %WINDIR%\76.exe C:\{7A1CD8A9-B708-4C8D-B...
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe] 'Debugger' = '<SYSTEM32>\\SET7.tmp.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Tugu' = 'C:\{7A1CD8A9-B708-4C8D-BF71-E45R48U20123}.eco'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Tondano' = '<SYSTEM32>\SET7.tmp.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'C:\New Folder.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'TuguMonasTondano' = '%WINDIR%\SET6.tmp.exe'
[<HKLM>\Software\Classes\batfile\shell\open\command] '' = '%1 %*'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Data user.exe] 'Debugger' = 'Notepad.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe'
[<HKLM>\Software\Classes\comfile\shell\open\command] '' = '%1 %*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = '%WINDIR%\\76.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '%WINDIR%\\Enum.zeth'
[<HKLM>\Software\Classes\ecofile\shell\open\command] '' = '%1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'UNIMA-UNSRAT' = '%WINDIR%\\76.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Notepad.exe' = '%WINDIR%\\system32\Notepad.exe'
[<HKLM>\Software\Classes\piffile\shell\open\command] '' = '%1 %*'
[<HKLM>\Software\Classes\existfile\shell\open\command] '' = '%1'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'

Searches for windows to

detect analytical utilities: