Trojan.Siggen17.29239

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Neptune Player' = '"%ProgramFiles%\Neptune Player\Neptune Player.exe"'

Malicious functions

Injects code into

the following user processes:

neptune player.exe

Modifies file system

Creates the following files

%TEMP%\nshfb02.tmp\system.dll
%APPDATA%\neptune player\gpucache\index
%APPDATA%\neptune player\code cache\js\index
%TEMP%\neptune player crashes\crashpadmetrics-active.pma
%TEMP%\neptune player crashes\settings.dat
%TEMP%\nshfb02.tmp\inetc.dll
C:\users\public\desktop\neptune player.lnk
%TEMP%\nshfb02.tmp\winshell.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\neptune player.lnk
%ProgramFiles%\neptune player\uninstall neptune player.exe
%LOCALAPPDATA%\neptune-player-updater\installer.exe
%ProgramFiles%\neptune player\vk_swiftshader.dll
%ProgramFiles%\neptune player\swiftshader\libglesv2.dll
%ProgramFiles%\neptune player\locales\vi.pak
%ProgramFiles%\neptune player\swiftshader\libegl.dll
%ProgramFiles%\neptune player\neptune player.exe
%ProgramFiles%\neptune player\libglesv2.dll
%ProgramFiles%\neptune player\libegl.dll
%ProgramFiles%\neptune player\ffmpeg.dll
%ProgramFiles%\neptune player\d3dcompiler_47.dll
%ProgramFiles%\neptune player\vk_swiftshader_icd.json
%ProgramFiles%\neptune player\v8_context_snapshot.bin
%ProgramFiles%\neptune player\snapshot_blob.bin
%ProgramFiles%\neptune player\resources\app.asar
%ProgramFiles%\neptune player\resources\app-update.yml
%ProgramFiles%\neptune player\resources.pak
%ProgramFiles%\neptune player\locales\zh-tw.pak
%ProgramFiles%\neptune player\resources\elevate.exe
%ProgramFiles%\neptune player\locales\zh-cn.pak
%APPDATA%\neptune player\gpucache\data_0
%APPDATA%\neptune player\de39a105-374c-48a9-aae0-f4a45bb1bdce.tmp
%APPDATA%\neptune player\795fd7e5-256c-4f1a-a617-5d9312dc730e.tmp
%APPDATA%\neptune player\fontlookuptablecache\font_unique_name_table.pb
%APPDATA%\neptune player\neptune-player.db
%APPDATA%\neptune player\neptune-player.db-journal
%TEMP%\86305542-d53f-4887-bb88-2be9fec6eee4.tmp.node
%APPDATA%\neptune player\00ed1760-b2ed-40c6-ae22-241e55aac2c8.tmp
%APPDATA%\neptune player\en-us-8-0.bdic
%APPDATA%\neptune player\local storage\leveldb\log
%APPDATA%\neptune player\local storage\leveldb\000001.dbtmp
%APPDATA%\neptune player\local storage\leveldb\manifest-000001
%APPDATA%\neptune player\cache\f_000002
%APPDATA%\neptune player\dictionaries\en-us-8-0.bdic
%APPDATA%\neptune player\gpucache\data_2
%APPDATA%\neptune player\gpucache\data_1
%APPDATA%\neptune player\cookies
%APPDATA%\neptune player\cookies-journal
%APPDATA%\neptune player\.updaterid
%APPDATA%\neptune player\logs\2022-03-25.main.log
%APPDATA%\neptune player\cache\data_3
%APPDATA%\neptune player\cache\data_2
%APPDATA%\neptune player\cache\data_1
%APPDATA%\neptune player\cache\data_0
%APPDATA%\neptune player\cache\index
%APPDATA%\neptune player\code cache\js\index-dir\temp-index
%APPDATA%\neptune player\sentry\scope_v2.json
%APPDATA%\neptune player\gpucache\data_3
%APPDATA%\neptune player\cache\f_000001
%ProgramFiles%\neptune player\locales\uk.pak
%ProgramFiles%\neptune player\locales\tr.pak
%ProgramFiles%\neptune player\locales\th.pak
%ProgramFiles%\neptune player\locales\fa.pak
%ProgramFiles%\neptune player\locales\et.pak
%ProgramFiles%\neptune player\locales\es.pak
%ProgramFiles%\neptune player\locales\es-419.pak
%ProgramFiles%\neptune player\locales\en-us.pak
%ProgramFiles%\neptune player\locales\en-gb.pak
%ProgramFiles%\neptune player\locales\el.pak
%ProgramFiles%\neptune player\locales\de.pak
%ProgramFiles%\neptune player\locales\da.pak
%ProgramFiles%\neptune player\locales\cs.pak
%ProgramFiles%\neptune player\locales\ca.pak
%ProgramFiles%\neptune player\locales\fil.pak
%ProgramFiles%\neptune player\locales\bn.pak
%ProgramFiles%\neptune player\locales\ar.pak
%ProgramFiles%\neptune player\locales\am.pak
%ProgramFiles%\neptune player\licenses.chromium.html
%ProgramFiles%\neptune player\license.electron.txt
%ProgramFiles%\neptune player\icudtl.dat
%ProgramFiles%\neptune player\chrome_200_percent.pak
%ProgramFiles%\neptune player\chrome_100_percent.pak
%TEMP%\nshfb02.tmp\nsis7z.dll
%TEMP%\nshfb02.tmp\app-64.7z
%TEMP%\nshfb02.tmp\nsprocess.dll
%TEMP%\nshfb02.tmp\spiderbanner.dll
%TEMP%\nshfb02.tmp\stdutils.dll
%ProgramFiles%\neptune player\locales\bg.pak
%ProgramFiles%\neptune player\locales\fr.pak
%ProgramFiles%\neptune player\locales\fi.pak
%ProgramFiles%\neptune player\locales\gu.pak
%ProgramFiles%\neptune player\locales\te.pak
%ProgramFiles%\neptune player\locales\nb.pak
%ProgramFiles%\neptune player\locales\ta.pak
%ProgramFiles%\neptune player\locales\sw.pak
%ProgramFiles%\neptune player\locales\sv.pak
%ProgramFiles%\neptune player\locales\sr.pak
%ProgramFiles%\neptune player\locales\sl.pak
%ProgramFiles%\neptune player\locales\sk.pak
%ProgramFiles%\neptune player\locales\ru.pak
%ProgramFiles%\neptune player\locales\ro.pak
%ProgramFiles%\neptune player\locales\pt-pt.pak
%ProgramFiles%\neptune player\locales\pt-br.pak
%ProgramFiles%\neptune player\locales\pl.pak
%ProgramFiles%\neptune player\locales\nl.pak
%ProgramFiles%\neptune player\locales\ms.pak
%ProgramFiles%\neptune player\locales\he.pak
%ProgramFiles%\neptune player\locales\mr.pak
%ProgramFiles%\neptune player\locales\ml.pak
%ProgramFiles%\neptune player\locales\lv.pak
%ProgramFiles%\neptune player\locales\lt.pak
%ProgramFiles%\neptune player\locales\ko.pak
%ProgramFiles%\neptune player\locales\kn.pak
%ProgramFiles%\neptune player\locales\ja.pak
%ProgramFiles%\neptune player\locales\it.pak
%ProgramFiles%\neptune player\locales\id.pak
%ProgramFiles%\neptune player\locales\hu.pak
%ProgramFiles%\neptune player\locales\hr.pak
%ProgramFiles%\neptune player\locales\hi.pak
%APPDATA%\neptune player\4bc6337f-b030-4d02-a95a-5cfb17e38dff.tmp
%APPDATA%\neptune player\local storage\leveldb\000003.log

Deletes the following files

%TEMP%\nshfb02.tmp\app-64.7z
%TEMP%\nshfb02.tmp\inetc.dll
%TEMP%\nshfb02.tmp\nsis7z.dll
%TEMP%\nshfb02.tmp\nsprocess.dll
%TEMP%\nshfb02.tmp\spiderbanner.dll
%TEMP%\nshfb02.tmp\stdutils.dll
%TEMP%\nshfb02.tmp\system.dll
%TEMP%\nshfb02.tmp\winshell.dll
%APPDATA%\neptune player\neptune-player.db-journal
%APPDATA%\neptune player\preferences~rf119858.tmp
%APPDATA%\neptune player\network persistent state~rf12a63d.tmp

Moves the following files

from %APPDATA%\neptune player\code cache\js\index-dir\temp-index to %APPDATA%\neptune player\code cache\js\index-dir\the-real-index
from %APPDATA%\neptune player\de39a105-374c-48a9-aae0-f4a45bb1bdce.tmp to %APPDATA%\neptune player\preferences
from %APPDATA%\neptune player\local storage\leveldb\000001.dbtmp to %APPDATA%\neptune player\local storage\leveldb\current
from %APPDATA%\neptune player\00ed1760-b2ed-40c6-ae22-241e55aac2c8.tmp to %APPDATA%\neptune player\network persistent state
from %APPDATA%\neptune player\795fd7e5-256c-4f1a-a617-5d9312dc730e.tmp to %APPDATA%\neptune player\preferences
from %APPDATA%\neptune player\preferences to %APPDATA%\neptune player\preferences~rf119858.tmp
from %APPDATA%\neptune player\4bc6337f-b030-4d02-a95a-5cfb17e38dff.tmp to %APPDATA%\neptune player\transportsecurity
from %APPDATA%\neptune player\network persistent state to %APPDATA%\neptune player\network persistent state~rf12a63d.tmp

Substitutes the following files

%APPDATA%\neptune player\neptune-player.db-journal
%APPDATA%\neptune player\preferences

Network activity

Connects to

'do#####d.teamviewer.com':443
're####ctor.gvt1.com':443
'r3######5hne6nsk.gvt1.com':443
'cd###.#loudflare.com':443
're######.player.neptunenow.com':443
'x.##2.us':80
'microsoft.com':80
'o3#####.ingest.sentry.io':443

TCP

HTTP GET requests

http://x.##2.us/x.cer
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'do#####d.teamviewer.com':443
're####ctor.gvt1.com':443
'r3######5hne6nsk.gvt1.com':443
'cd###.#loudflare.com':443
're######.player.neptunenow.com':443
'o3#####.ingest.sentry.io':443

UDP

DNS ASK do#####d.teamviewer.com
DNS ASK re####ctor.gvt1.com
DNS ASK r3######5hne6nsk.gvt1.com
DNS ASK ap#.####er.neptunenow.com
DNS ASK so###.##ayer.neptunenow.com
DNS ASK tr#######cured.neptunenow.com
DNS ASK vo#####.neptunenow.com
DNS ASK cd###.#loudflare.com
DNS ASK re######.player.neptunenow.com
DNS ASK x.##2.us
DNS ASK microsoft.com
DNS ASK o3#####.ingest.sentry.io

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Neptune Player'

Creates and executes the following

'%ProgramFiles%\neptune player\neptune player.exe'
'%ProgramFiles%\neptune player\neptune player.exe' --no-rate-limit --no-upload-gzip --type=crash-handler "--crashes-directory=%TEMP%\Neptune Player Crashes" "--database=%TEMP%\Neptune Player Crashes" "--metrics-dir=%TEMP%\Neptune Player Crashes...
'%ProgramFiles%\neptune player\neptune player.exe' --type=gpu-process --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-pre...
'%ProgramFiles%\neptune player\neptune player.exe' --type=utility --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US ...
'%ProgramFiles%\neptune player\neptune player.exe' --type=renderer --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US...
'%ProgramFiles%\neptune player\neptune player.exe' --type=gpu-process --field-trial-handle=1048,12632466480414741241,9937050309222561410,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable...
'<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player"' (with hidden window)
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player" /t REG_SZ /d "\"%ProgramFiles%\Neptune Player\Neptune Player.exe\"" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "chcp"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe csproduct get /value"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""' (with hidden window)

Executes the following

'<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player"
'<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\wmi path MS_SystemInformation get /value
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
'<SYSTEM32>\wbem\wmic.exe' logicaldisk get Caption,FileSystem,FreeSpace,Size
'<SYSTEM32>\wbem\wmic.exe' os get /value
'<SYSTEM32>\wbem\wmic.exe' csproduct get /value
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe csproduct get /value"
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
'<SYSTEM32>\chcp.com'
'<SYSTEM32>\cmd.exe' /d /s /c "chcp"
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Neptune Player" /t REG_SZ /d "\"%ProgramFiles%\Neptune Player\Neptune Player.exe\"" /f
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe logicaldisk get Caption,FileSystem,FreeSpace,Size"
'<SYSTEM32>\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней