Trojan.Siggen15.1985

To ensure autorun and distribution

Creates or modifies the following files

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

blocks the following features:

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\312F.exe' = '00000000'

Injects code into

the following system processes:

Searches for registry branches where third party applications store passwords

Reads files which store third party applications passwords

Searches for windows to

detect analytical utilities:

Modifies file system

Creates the following files

%APPDATA%\fccruad
%TEMP%\9d86.tmp-shm
%TEMP%\9db6.tmp
%TEMP%\9fc9.tmp
%TEMP%\9fda.tmp
%TEMP%\9ffa.tmp
%TEMP%\a01a.tmp
%TEMP%\a0e6.tmp
%LOCALAPPDATA%low\bbsqwy6yhk
%TEMP%\9d86.tmp
%TEMP%\a106.tmp
%TEMP%\a128.tmp
%TEMP%\a139.tmp
%TEMP%\a14a.tmp
%TEMP%\a14b.tmp
%TEMP%\a16b.tmp
%TEMP%\a16b.tmp-shm
%LOCALAPPDATA%low\ad1rf3am8r\ej7xg7cq_5q.zip
%TEMP%\a117.tmp
%TEMP%\a118.tmp
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%TEMP%\685.exe
%TEMP%\19c7.exe
%TEMP%\312f.exe
%TEMP%\364e.exe
%TEMP%\3a07.exe
%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\advancedrun.exe
%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\test.bat
%TEMP%\44d1.exe
%APPDATA%\twtajic
%LOCALAPPDATA%low\sqlite3.dll
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\hwsi7f4qi-shm

Sets the 'hidden' attribute to the following files

Deletes the following files

Deletes itself.

Network activity

Connects to

TCP

HTTP GET requests

http://5.###.156.252//l/f/HhLLkHsBPvGyIjkLQ5KA/4d5a557923f4edd315933f65183ff9d5368a00a6
http://5.###.156.252//l/f/HhLLkHsBPvGyIjkLQ5KA/3e049529b61f948cf6742d2ed8631efa932b8d7a

HTTP POST requests

Other

UDP

Miscellaneous

Searches for the following windows

ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%TEMP%\685.exe'
'%TEMP%\19c7.exe'
'%TEMP%\312f.exe'
'%TEMP%\364e.exe'
'%TEMP%\3a07.exe'
'%TEMP%\44d1.exe'
'%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\advancedrun.exe' /EXEFilename "%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
'%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\advancedrun.exe' /SpecialRun 4101d8 1660
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\312F.exe" -Force
'%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\advancedrun.exe' /EXEFilename "%TEMP%\55f1c548-8323-46ca-b5cf-75ed5b7c7e26\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\312F.exe" -Force' (with hidden window)