Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IgAgent' = '"%ProgramFiles(x86)%\TFG\Agent\IgAgent.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IgFileJudge' = '"%ProgramFiles(x86)%\TFG\Agent\IgFileJudge.exe"'
- [<HKLM>\Software\Classes\olkfile\Shell\Open\Command] '' = '%ProgramFiles(x86)%\TFG\Agent\IgAgent.exe %1'
- [<HKLM>\Software\Classes\ipcfile\Shell\Open\Command] '' = '%ProgramFiles(x86)%\TFG\Agent\IgAgent.exe %1'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IGSvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\IGSvc] 'ImagePath' = '%ProgramFiles(x86)%\TFG\Agent\IgSvc.exe -start'
- [<HKLM>\System\CurrentControlSet\Services\RemoteThreadService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RemoteThreadService] 'ImagePath' = '%ProgramFiles(x86)%\TFG\Agent\IgRMT.exe'
- [<HKLM>\System\CurrentControlSet\Services\SecuFileX64] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SecuFileX64] 'ImagePath' = 'system32\DRIVERS\SecuFileX64.sys'
Creates the following services
- 'IGSvc' %ProgramFiles(x86)%\TFG\Agent\IgSvc.exe -start
- 'RemoteThreadService' %ProgramFiles(x86)%\TFG\Agent\IgRMT.exe
- 'SecuFileX64' system32\DRIVERS\SecuFileX64.sys
Malicious functions
Registers file system filter
- [<HKLM>\System\CurrentControlSet\Services\SecuFileX64] 'Group' = 'FSFilter Activity Monitor'
Modifies file system
Creates the following files
- %TEMP%\nsg7465.tmp
- %ProgramFiles(x86)%\tfg\agent\update\gdiplus.dll
- %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw.xml
- %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw-可解密&主管.xml
- %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw-不可解密.xml
- %ProgramFiles(x86)%\tfg\agent\update\language\lang_tw.xml
- %ProgramFiles(x86)%\tfg\agent\update\language\lang_jp.xml
- %ProgramFiles(x86)%\tfg\agent\update\language\lang_en.xml
- %ProgramFiles(x86)%\tfg\agent\update\log\logconfig.ini
- %ProgramFiles(x86)%\tfg\agent\update\language\lang_ch.xml
- %ProgramFiles(x86)%\tfg\agent\update\xerces-c_3_1.dll
- %ProgramFiles(x86)%\tfg\agent\update\xerces-depdom_2_6.dll
- %ProgramFiles(x86)%\tfg\agent\update\xerces-c_2_6.dll
- %ProgramFiles(x86)%\tfg\agent\update\exportagentconfig.dll
- %ProgramFiles(x86)%\tfg\agent\update\customize.ini
- %ProgramFiles(x86)%\tfg\agent\update\hkprint.ini
- %ProgramFiles(x86)%\tfg\agent\update\msvcp60.dll
- %ProgramFiles(x86)%\tfg\agent\update\xml.dll
- %ProgramFiles(x86)%\tfg\agent\update\backupfile\tfgfilebackup.exe
- %ProgramFiles(x86)%\tfg\agent\update\plugins\tfgofficeplus.dll
- %ProgramFiles(x86)%\tfg\agent\update\plugins\tfgofficeplusx64.dll
- %WINDIR%\temp\udde1ab.tmp
- %WINDIR%\temp\uddd9ce.tmp
- %TEMP%\~tfd7d8.tmp
- %APPDATA%\tfg\infoguard.lang
- %TEMP%\~tfd661.tmp
- %APPDATA%\tfg\igcfg.dat
- %WINDIR%\temp\uddd1f0.tmp
- %WINDIR%\temp\uddca13.tmp
- %WINDIR%\temp\uddc216.tmp
- <DRIVERS>\secufilex64.sys
- %ProgramFiles(x86)%\tfg\agent\log\igsvc.log
- %TEMP%\~tf8620.tmp
- %ProgramFiles(x86)%\tfg\agent\update\log\swinsttool.log
- %TEMP%\nsb7495.tmp\nsexec.dll
- %ProgramFiles(x86)%\tfg\agent\update\everyonepurview.exe
- %ProgramFiles(x86)%\tfg\agent\update\plugins\ie_office64.dll
- %ProgramFiles(x86)%\tfg\agent\update\plugins\ie_office.dll
- %ProgramFiles(x86)%\tfg\agent\update\agentfile.list
- %WINDIR%\temp\udde988.tmp
- %ProgramFiles(x86)%\tfg\agent\update\restartprocess.exe
- %ProgramFiles(x86)%\tfg\agent\update\dbghelp.dll
- %ProgramFiles(x86)%\tfg\agent\update\igace.dll
- %ProgramFiles(x86)%\tfg\agent\update\pkcs11dll.dll
- %ProgramFiles(x86)%\tfg\agent\update\eps2003csp11.dll
- %ProgramFiles(x86)%\tfg\agent\update\esfp_api.dll
- %ProgramFiles(x86)%\tfg\agent\update\dmssleay.dll
- %ProgramFiles(x86)%\tfg\agent\update\about.bmp
- %ProgramFiles(x86)%\tfg\agent\update\igiconx64.dll
- %ProgramFiles(x86)%\tfg\agent\update\igagent.dll
- %ProgramFiles(x86)%\tfg\agent\update\igicon.dll
- %ProgramFiles(x86)%\tfg\agent\update\igterm.exe
- %ProgramFiles(x86)%\tfg\agent\update\igagentsimpx64.dll
- %ProgramFiles(x86)%\tfg\agent\update\igagentx64.dll
- %ProgramFiles(x86)%\tfg\agent\update\exportagentconfigx64.dll
- %TEMP%\nsb7495.tmp\system.dll
- %ProgramFiles(x86)%\tfg\agent\update\tfginstalltool.exe
- <Current directory>\_free_inst.ini
- %ProgramFiles(x86)%\tfg\agent\update\igmenux64.dll
- %ProgramFiles(x86)%\tfg\agent\update\igagent.exe
- %ProgramFiles(x86)%\tfg\agent\update\igagentsimp.dll
- %ProgramFiles(x86)%\tfg\agent\update\igcfg.dat
- %ProgramFiles(x86)%\tfg\agent\update\secufilex64installer.exe
- %ProgramFiles(x86)%\tfg\agent\update\secufilex64_5.sys
- %ProgramFiles(x86)%\tfg\agent\update\secufilex64_6.sys
- %ProgramFiles(x86)%\tfg\agent\update\secufilex64.inf
- %ProgramFiles(x86)%\tfg\agent\update\secufile_8.sys
- %ProgramFiles(x86)%\tfg\agent\update\secufile.sys
- %ProgramFiles(x86)%\tfg\agent\update\infoguard.lang
- %ProgramFiles(x86)%\tfg\agent\update\igtoken_esafe.dll
- %ProgramFiles(x86)%\tfg\agent\update\igtoken_epass.dll
- %ProgramFiles(x86)%\tfg\agent\update\ft_nd_api.dll
- %ProgramFiles(x86)%\tfg\agent\update\igmenu.dll
- %ProgramFiles(x86)%\tfg\agent\update\igtoken.dll
- %ProgramFiles(x86)%\tfg\agent\update\igsvc.exe
- %ProgramFiles(x86)%\tfg\agent\update\igrmt.exe
- %ProgramFiles(x86)%\tfg\agent\update\iginject.exe
- %ProgramFiles(x86)%\tfg\agent\update\igfilejudge.exe
- %ProgramFiles(x86)%\tfg\agent\update\igdetour.dll
- %ProgramFiles(x86)%\tfg\agent\update\exceptionproc.dll
- %ProgramFiles(x86)%\tfg\agent\log\igagentoper.log
Deletes the following files
- <Current directory>\_free_inst.ini
- %TEMP%\nsb7495.tmp\nsexec.dll
- %TEMP%\nsb7495.tmp\system.dll
- %TEMP%\~tf8620.tmp
- %ProgramFiles(x86)%\tfg\agent\log\igsvc.log
- %WINDIR%\temp\uddc216.tmp
- %WINDIR%\temp\uddca13.tmp
- %TEMP%\~tfd661.tmp
- %TEMP%\~tfd7d8.tmp
- %WINDIR%\temp\uddd1f0.tmp
- %WINDIR%\temp\uddd9ce.tmp
- %WINDIR%\temp\udde1ab.tmp
- %WINDIR%\temp\udde988.tmp
Moves the following files
- from %ProgramFiles(x86)%\tfg\agent\update\about.bmp to %ProgramFiles(x86)%\tfg\agent\about.bmp
- from %ProgramFiles(x86)%\tfg\agent\update\igtoken_epass.dll to %ProgramFiles(x86)%\tfg\agent\igtoken_epass.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igtoken_esafe.dll to %ProgramFiles(x86)%\tfg\agent\igtoken_esafe.dll
- from %ProgramFiles(x86)%\tfg\agent\update\infoguard.lang to %ProgramFiles(x86)%\tfg\agent\infoguard.lang
- from %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw-不可解密.xml to %ProgramFiles(x86)%\tfg\agent\language\bk\lang_tw-不可解密.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw-可解密&主管.xml to %ProgramFiles(x86)%\tfg\agent\language\bk\lang_tw-可解密&主管.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\bk\lang_tw.xml to %ProgramFiles(x86)%\tfg\agent\language\bk\lang_tw.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\lang_ch.xml to %ProgramFiles(x86)%\tfg\agent\language\lang_ch.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\lang_en.xml to %ProgramFiles(x86)%\tfg\agent\language\lang_en.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\lang_jp.xml to %ProgramFiles(x86)%\tfg\agent\language\lang_jp.xml
- from %ProgramFiles(x86)%\tfg\agent\update\language\lang_tw.xml to %ProgramFiles(x86)%\tfg\agent\language\lang_tw.xml
- from %ProgramFiles(x86)%\tfg\agent\update\log\logconfig.ini to %ProgramFiles(x86)%\tfg\agent\log\logconfig.ini
- from %ProgramFiles(x86)%\tfg\agent\update\msvcp60.dll to %ProgramFiles(x86)%\tfg\agent\msvcp60.dll
- from %ProgramFiles(x86)%\tfg\agent\update\pkcs11dll.dll to %ProgramFiles(x86)%\tfg\agent\pkcs11dll.dll
- from %ProgramFiles(x86)%\tfg\agent\update\plugins\ie_office64.dll to %ProgramFiles(x86)%\tfg\agent\plugins\ie_office64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\xml.dll to %ProgramFiles(x86)%\tfg\agent\xml.dll
- from %ProgramFiles(x86)%\tfg\agent\update\plugins\tfgofficeplus.dll to %ProgramFiles(x86)%\tfg\agent\plugins\tfgofficeplus.dll
- from %ProgramFiles(x86)%\tfg\agent\update\plugins\tfgofficeplusx64.dll to %ProgramFiles(x86)%\tfg\agent\plugins\tfgofficeplusx64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\restartprocess.exe to %ProgramFiles(x86)%\tfg\agent\restartprocess.exe
- from %ProgramFiles(x86)%\tfg\agent\update\secufile.sys to %ProgramFiles(x86)%\tfg\agent\secufile.sys
- from %ProgramFiles(x86)%\tfg\agent\update\secufilex64.inf to %ProgramFiles(x86)%\tfg\agent\secufilex64.inf
- from %ProgramFiles(x86)%\tfg\agent\update\secufilex64installer.exe to %ProgramFiles(x86)%\tfg\agent\secufilex64installer.exe
- from %ProgramFiles(x86)%\tfg\agent\update\secufilex64_5.sys to %ProgramFiles(x86)%\tfg\agent\secufilex64_5.sys
- from %ProgramFiles(x86)%\tfg\agent\update\secufilex64_6.sys to %ProgramFiles(x86)%\tfg\agent\secufilex64_6.sys
- from %ProgramFiles(x86)%\tfg\agent\update\secufile_8.sys to %ProgramFiles(x86)%\tfg\agent\secufile_8.sys
- from %ProgramFiles(x86)%\tfg\agent\update\tfginstalltool.exe to %ProgramFiles(x86)%\tfg\agent\tfginstalltool.exe
- from %ProgramFiles(x86)%\tfg\agent\update\xerces-c_2_6.dll to %ProgramFiles(x86)%\tfg\agent\xerces-c_2_6.dll
- from %ProgramFiles(x86)%\tfg\agent\update\xerces-c_3_1.dll to %ProgramFiles(x86)%\tfg\agent\xerces-c_3_1.dll
- from %ProgramFiles(x86)%\tfg\agent\update\xerces-depdom_2_6.dll to %ProgramFiles(x86)%\tfg\agent\xerces-depdom_2_6.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igtoken.dll to %ProgramFiles(x86)%\tfg\agent\igtoken.dll
- from %ProgramFiles(x86)%\tfg\agent\update\plugins\ie_office.dll to %ProgramFiles(x86)%\tfg\agent\plugins\ie_office.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igterm.exe to %ProgramFiles(x86)%\tfg\agent\igterm.exe
- from %ProgramFiles(x86)%\tfg\agent\update\hkprint.ini to %ProgramFiles(x86)%\tfg\agent\hkprint.ini
- from %ProgramFiles(x86)%\tfg\agent\update\agentfile.list to %ProgramFiles(x86)%\tfg\agent\agentfile.list
- from %ProgramFiles(x86)%\tfg\agent\update\backupfile\tfgfilebackup.exe to %ProgramFiles(x86)%\tfg\agent\backupfile\tfgfilebackup.exe
- from %ProgramFiles(x86)%\tfg\agent\update\customize.ini to %ProgramFiles(x86)%\tfg\agent\customize.ini
- from %ProgramFiles(x86)%\tfg\agent\update\dbghelp.dll to %ProgramFiles(x86)%\tfg\agent\dbghelp.dll
- from %ProgramFiles(x86)%\tfg\agent\update\dmssleay.dll to %ProgramFiles(x86)%\tfg\agent\dmssleay.dll
- from %ProgramFiles(x86)%\tfg\agent\update\eps2003csp11.dll to %ProgramFiles(x86)%\tfg\agent\eps2003csp11.dll
- from %ProgramFiles(x86)%\tfg\agent\update\esfp_api.dll to %ProgramFiles(x86)%\tfg\agent\esfp_api.dll
- from %ProgramFiles(x86)%\tfg\agent\update\everyonepurview.exe to %ProgramFiles(x86)%\tfg\agent\everyonepurview.exe
- from %ProgramFiles(x86)%\tfg\agent\update\exceptionproc.dll to %ProgramFiles(x86)%\tfg\agent\exceptionproc.dll
- from %ProgramFiles(x86)%\tfg\agent\update\exportagentconfig.dll to %ProgramFiles(x86)%\tfg\agent\exportagentconfig.dll
- from %ProgramFiles(x86)%\tfg\agent\update\exportagentconfigx64.dll to %ProgramFiles(x86)%\tfg\agent\exportagentconfigx64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\ft_nd_api.dll to %ProgramFiles(x86)%\tfg\agent\ft_nd_api.dll
- from %ProgramFiles(x86)%\tfg\agent\update\gdiplus.dll to %ProgramFiles(x86)%\tfg\agent\gdiplus.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igace.dll to %ProgramFiles(x86)%\tfg\agent\igace.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igrmt.exe to %ProgramFiles(x86)%\tfg\agent\igrmt.exe
- from %ProgramFiles(x86)%\tfg\agent\update\igagent.dll to %ProgramFiles(x86)%\tfg\agent\igagent.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igagent.exe to %ProgramFiles(x86)%\tfg\agent\igagent.exe
- from %ProgramFiles(x86)%\tfg\agent\update\igagentsimp.dll to %ProgramFiles(x86)%\tfg\agent\igagentsimp.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igagentsimpx64.dll to %ProgramFiles(x86)%\tfg\agent\igagentsimpx64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igagentx64.dll to %ProgramFiles(x86)%\tfg\agent\igagentx64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igcfg.dat to %ProgramFiles(x86)%\tfg\agent\igcfg.dat
- from %ProgramFiles(x86)%\tfg\agent\update\igdetour.dll to %ProgramFiles(x86)%\tfg\agent\igdetour.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igfilejudge.exe to %ProgramFiles(x86)%\tfg\agent\igfilejudge.exe
- from %ProgramFiles(x86)%\tfg\agent\update\igicon.dll to %ProgramFiles(x86)%\tfg\agent\igicon.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igiconx64.dll to %ProgramFiles(x86)%\tfg\agent\igiconx64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\iginject.exe to %ProgramFiles(x86)%\tfg\agent\iginject.exe
- from %ProgramFiles(x86)%\tfg\agent\update\igmenu.dll to %ProgramFiles(x86)%\tfg\agent\igmenu.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igmenux64.dll to %ProgramFiles(x86)%\tfg\agent\igmenux64.dll
- from %ProgramFiles(x86)%\tfg\agent\update\igsvc.exe to %ProgramFiles(x86)%\tfg\agent\igsvc.exe
- from %ProgramFiles(x86)%\tfg\agent\secufilex64_6.sys to %ProgramFiles(x86)%\tfg\agent\secufilex64.sys
Substitutes the following files
- %ProgramFiles(x86)%\tfg\agent\log\igsvc.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'IgTerm'
Creates and executes the following
- '%ProgramFiles(x86)%\tfg\agent\update\everyonepurview.exe'
- '%ProgramFiles(x86)%\tfg\agent\igrmt.exe' Start
- '%ProgramFiles(x86)%\tfg\agent\igagent.exe'
- '%ProgramFiles(x86)%\tfg\agent\secufilex64installer.exe' -i
- '%ProgramFiles(x86)%\tfg\agent\update\tfginstalltool.exe'
- '%ProgramFiles(x86)%\tfg\agent\igfilejudge.exe'
- '%ProgramFiles(x86)%\tfg\agent\igrmt.exe' Install
- '%ProgramFiles(x86)%\tfg\agent\igsvc.exe'
- '%ProgramFiles(x86)%\tfg\agent\igrmt.exe'
- '%ProgramFiles(x86)%\tfg\agent\igsvc.exe' -start
- '%ProgramFiles(x86)%\tfg\agent\secufilex64installer.exe' -i' (with hidden window)
- '%ProgramFiles(x86)%\tfg\agent\update\everyonepurview.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|"<SYSTEM32>\cacls.exe" "%ProgramFiles(x86)%\TFG\Agent\Log" /G everyone:F' (with hidden window)
- '%ProgramFiles(x86)%\tfg\agent\igfilejudge.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\tfg\agent\igrmt.exe' Install' (with hidden window)
- '%ProgramFiles(x86)%\tfg\agent\igsvc.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\tfg\agent\igrmt.exe' Start' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|"<SYSTEM32>\cacls.exe" "%ProgramFiles(x86)%\TFG\Agent\Log\*" /G everyone:F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgIcon.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgMenu.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgIconX64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgIconX64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgMenuX64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\TFG\Agent\IgMenuX64.dll"
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|"<SYSTEM32>\cacls.exe" "%ProgramFiles(x86)%\TFG\Agent\Log" /G everyone:F
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|"<SYSTEM32>\cacls.exe" "%ProgramFiles(x86)%\TFG\Agent\Log\*" /G everyone:F
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\TFG\Agent\Log" /G everyone:F
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\TFG\Agent\Log\*" /G everyone:F
