Trojan.PWS.Siggen2.61092

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wapperupdate' = '%LOCALAPPDATA%\Microsoft\Internet Explorer\wrapper.exe'

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\lisp_success.doc

Modifies file system

Creates the following files

%TEMP%\temp.ini
%LOCALAPPDATA%\microsoft\internet explorer\1.cab
%LOCALAPPDATA%\microsoft\internet explorer\{105a1aa4-9832-4471-9248-59cd46efc17c}.exe
%LOCALAPPDATA%\microsoft\internet explorer\wrapper.exe
%LOCALAPPDATA%\microsoft\internet explorer\tmdbglog.dll
%LOCALAPPDATA%\microsoft\internet explorer\{5c29f891-91dd-4744-99ce-5d50e733bea6}
%LOCALAPPDATA%\microsoft\internet explorer\token.ini
%LOCALAPPDATA%\microsoft\internet explorer\rar.cab
%LOCALAPPDATA%\microsoft\internet explorer\$dpx$.tmp\b6ff9c584db5844a84b20dc83ea26a12.tmp
%LOCALAPPDATA%\microsoft\internet explorer\xlt
%LOCALAPPDATA%\microsoft\internet explorer\time
%LOCALAPPDATA%\microsoft\internet explorer\{360322e1-13dd-11e5-824f-dc9c5213ca21}
%LOCALAPPDATA%\microsoft\internet explorer\recoverys\11072012016060100000020210112184955.dat
%LOCALAPPDATA%\microsoft\internet explorer\recoverys\11072012016060100000020210112185012.dat

Deletes the following files

%LOCALAPPDATA%\microsoft\internet explorer\tmdbglog.dll.xlt
%LOCALAPPDATA%\microsoft\internet explorer\recoverys\11072012016060100000020210112185012.dat

Moves the following files

from %LOCALAPPDATA%\microsoft\internet explorer\{105a1aa4-9832-4471-9248-59cd46efc17c}.exe to %LOCALAPPDATA%\microsoft\internet explorer\ .exe
from %LOCALAPPDATA%\microsoft\internet explorer\tmdbglog.dll to %LOCALAPPDATA%\microsoft\internet explorer\tmdbglog.dll.xlt
from %LOCALAPPDATA%\microsoft\internet explorer\$dpx$.tmp\b6ff9c584db5844a84b20dc83ea26a12.tmp to %LOCALAPPDATA%\microsoft\internet explorer\rar.exe

Substitutes the following files

%LOCALAPPDATA%\microsoft\internet explorer\{105a1aa4-9832-4471-9248-59cd46efc17c}.exe
%LOCALAPPDATA%\microsoft\internet explorer\ .exe
%LOCALAPPDATA%\microsoft\internet explorer\tmdbglog.dll

Miscellaneous

Creates and executes the following

'%LOCALAPPDATA%\microsoft\internet explorer\{105a1aa4-9832-4471-9248-59cd46efc17c}.exe'
'%LOCALAPPDATA%\microsoft\internet explorer\wrapper.exe'
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112184955.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112185012.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112185028.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...
'%LOCALAPPDATA%\microsoft\internet explorer\{105a1aa4-9832-4471-9248-59cd46efc17c}.exe' ' (with hidden window)
'%LOCALAPPDATA%\microsoft\internet explorer\wrapper.exe' ' (with hidden window)
'%WINDIR%\syswow64\expand.exe' "%LOCALAPPDATA%\Microsoft\Internet Explorer\rar.cab" "%LOCALAPPDATA%\Microsoft\Internet Explorer\rar.exe" -F:*' (with hidden window)
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112184955.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...' (with hidden window)
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112185012.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...' (with hidden window)
'%LOCALAPPDATA%\microsoft\internet explorer\rar.exe' a -scu -y -inul -ta20160601000000 -hp"abcd!@#$" "%LOCALAPPDATA%\Microsoft\Internet Explorer\Recoverys\11072012016060100000020210112185028.dat" @"%LOCALAPPDATA%\Microsoft\Internet Explorer\{3603...' (with hidden window)