Trojan.Siggen17.59428

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,50,72,6f,67,72,61,6d,44,61,74,61,5c,54,61,6f,54,61...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,50,72,6f,67,72,61,6d,44,61,74,61,5c,54,61,6f,54,61...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{43,3a,5c,50,72,6f,67,72,61,6d,44,61,74,61,5c,54,61,6f,54,61...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{43,3a,5c,50,72,6f,67,72,61,6d,44,61,74,61,5c,54,61,6f,54,61...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{43,3a,5c,50,72,6f,67,72,61,6d,44,61,74,61,5c,54,61,6f,54,61...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Creates or modifies the following files

%WINDIR%\tasks\taotongkuanupdatetask.job
<SYSTEM32>\tasks\taotongkuanupdatetask

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\TtsSvczzl] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\TtsSvczzl] 'ImagePath' = '%LOCALAPPDATA%\TaoTaoSou\TTK\TTSService.exe'
[<HKLM>\System\CurrentControlSet\Services\ws2ifsl] 'Start' = '00000001'

Creates the following services

'TtsSvczzl' %LOCALAPPDATA%\TaoTaoSou\TTK\TTSService.exe
'WS2IFSL' <DRIVERS>\ws2ifsl.sys

Modifies file system

Creates the following files

%TEMP%\nsra8fc.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\meta-inf\zigbert.sf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\meta-inf\zigbert.rsa
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\meta-inf\manifest.mf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\chrome\content\ttk.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\chrome\content\icon.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\chrome\content\contentscript.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\chrome.manifest
%TEMP%\nswa91c.tmp\zipdll.dll
%TEMP%\nswa91c.tmp\internet.dll
%APPDATA%\microsoft\windows\start menu\programs\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)\Г°В¶ГґГёГ¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®).lnk
%APPDATA%\microsoft\windows\start menu\programs\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)\ВёГјГ°ГўГ¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®).lnk
%APPDATA%\microsoft\windows\start menu\programs\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)Г¶Г·ГІВі.lnk
%APPDATA%\microsoft\windows\start menu\programs\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)ГЄВ№ГіГЈВ№ВҐГўГґ.lnk
%APPDATA%\microsoft\windows\start menu\programs\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®)\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®).lnk
%HOMEPATH%\desktop\Г¬ГґГ¬ГґГ«Г±В±ГЁВјГ»(Г¬ГґГВ¬ВїГ®).lnk
%LOCALAPPDATA%\taotaosou\ttk_icon_s_2.ico
%APPDATA%\taotaosou\svcconfig.ini
%TEMP%\nswa91c.tmp\md5dll.dll
%LOCALAPPDATA%\taotaosou\ttk\netinfo.txt
%APPDATA%\taotaosou\runconfig.ini
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\ttk@taotaosou.com\plugins\nptaotaosouplugin.dll
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\css\popup.css
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\html\background.html
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\html\popup.html
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserrordiagoff_weboc[1]
%APPDATA%\taotaosou\ttsconfig.ini
%ALLUSERSPROFILE%\taotaosou\np_ab20.dll
%LOCALAPPDATA%\taotaosou\ttk\preferences.opera
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\plugin\nptaotaosouplugin.dll
%TEMP%\nswa91c.tmp\textreplace.dll
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\manifest.json
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\popup.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\login\loginframe.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\login\login.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\lib\jquery.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\content.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\config.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\js\background.js
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\img\icon.png
%APPDATA%\opera software\opera stable\extensions\kgjdldamaclconkgicdehfijmmkplcih\2.1.3_0\img\icon-128.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%LOCALAPPDATA%\taotaosou\ttk\logs\2022-05-29.log
%APPDATA%\taotaosou\ttsusign
%APPDATA%\taotaosou\hlog
%LOCALAPPDATA%\taotaosou\ttk\taotaosou.json
%LOCALAPPDATA%\taotaosou\ttk\rootcrt.dat
%LOCALAPPDATA%\taotaosou\ttk\nptaotaosouplugin.dll
%LOCALAPPDATA%\taotaosou\ttk\hlog
%LOCALAPPDATA%\taotaosou\ttk\extkey.ini
%LOCALAPPDATA%\taotaosou\ttk\uninstall.exe
%LOCALAPPDATA%\taotaosou\ttk\ttsunregplugin.bat
%LOCALAPPDATA%\taotaosou\ttk\ttsregplugin.bat
%LOCALAPPDATA%\taotaosou\ttk\ttsieplugin_64.dll
%LOCALAPPDATA%\taotaosou\ttk\ttsieplugin.dll
%LOCALAPPDATA%\taotaosou\ttk\ttshostchrome.exe
%LOCALAPPDATA%\taotaosou\ttk\ttksextins.exe
%LOCALAPPDATA%\taotaosou\ttk\ttkinsassistant.dll
%LOCALAPPDATA%\taotaosou\ttk\chrome_2
%LOCALAPPDATA%\taotaosou\ttk\chrome_1
%TEMP%\nswa91c.tmp\findprocdll.dll
%TEMP%\nswa91c.tmp\system.dll
%TEMP%\nswa91c.tmp\npextins.dll
%TEMP%\nswa91c.tmp\ttkinsassistant.dll
%TEMP%\nswa91c.tmp\closebrowerpage.ini
%TEMP%\nswa91c.tmp\cpage.ini
%LOCALAPPDATA%\taotaosou\ttk\ttk_icon.ico
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.chrome.crx
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.firefox.xpi
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.liebao.crx
%LOCALAPPDATA%\taotaosou\ttk\default.dat
%LOCALAPPDATA%\taotaosou\ttk\ttkmonitor.exe
%LOCALAPPDATA%\taotaosou\ttk\localpage\styles\network.css
%LOCALAPPDATA%\taotaosou\ttk\localpage\scripts\redirect.js
%LOCALAPPDATA%\taotaosou\ttk\localpage\scripts\network.js
%LOCALAPPDATA%\taotaosou\ttk\localpage\mustache\redirect.html
%LOCALAPPDATA%\taotaosou\ttk\localpage\mustache\network.html
%LOCALAPPDATA%\taotaosou\ttk\localpage\images\network.png
%LOCALAPPDATA%\taotaosou\ttk\localpage\images\client_bg.png
%LOCALAPPDATA%\taotaosou\ttk\localpage\images\ajax_load.gif
%LOCALAPPDATA%\taotaosou\ttk\dump.dll
%LOCALAPPDATA%\taotaosou\ttk\license.txt
%LOCALAPPDATA%\taotaosou\ttk\taotaosou.exe
%LOCALAPPDATA%\taotaosou\ttk\ttsservice.exe
%LOCALAPPDATA%\taotaosou\ttk\duilib.dll
%LOCALAPPDATA%\taotaosou\ttk\crashreport.exe
%LOCALAPPDATA%\taotaosou\ttk\npext.dll
%LOCALAPPDATA%\taotaosou\ttk\npextins.dll
%LOCALAPPDATA%\taotaosou\ttk\uninst128.ico
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.sogou.sext
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.sogou.chromecore.sext
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.maxthon.mxaddon
%LOCALAPPDATA%\taotaosou\ttk\monitor.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bullet[1]

Deletes the following files

%LOCALAPPDATA%\taotaosou\ttk\hlog
%TEMP%\nswa91c.tmp\zipdll.dll
%TEMP%\nswa91c.tmp\ttkinsassistant.dll
%TEMP%\nswa91c.tmp\textreplace.dll
%TEMP%\nswa91c.tmp\system.dll
%TEMP%\nswa91c.tmp\npextins.dll
%TEMP%\nswa91c.tmp\md5dll.dll
%TEMP%\nswa91c.tmp\internet.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%TEMP%\nswa91c.tmp\findprocdll.dll
%TEMP%\nswa91c.tmp\closebrowerpage.ini
%LOCALAPPDATA%\taotaosou\ttk\extkey.ini
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.maxthon.mxaddon
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.firefox.xpi
%LOCALAPPDATA%\taotaosou\ttk\tts.browser.chrome.crx
%LOCALAPPDATA%\taotaosou\ttk\chrome_2
%LOCALAPPDATA%\taotaosou\ttk\preferences.opera
%TEMP%\nswa91c.tmp\cpage.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]

Modifies the following files

Substitutes the following files

%APPDATA%\Opera Software\Opera Stable\Preferences
%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\0U8LPYU9\ErrorPageTemplate[1]

Network activity

Connects to

'ba##u.com':80
'lo#.##sunion.com':80
'hu###omains.com':443

TCP

HTTP GET requests

http://lo#.##sunion.com/install_statistics.do?ty#################################################################################################################################################
http://lo#.##sunion.com/install_statistics.do?ty#################################################################################################################################################...

HTTP POST requests

http://lo#.##sunion.com/install_log.do

Other

'hu###omains.com':443

UDP

DNS ASK re.###taosou.com
DNS ASK ba##u.com
DNS ASK lo#.##sunion.com
DNS ASK hu###omains.com
DNS ASK lo#.##otaosou.com
DNS ASK dc.####.taotaosou.com
DNS ASK cl####.re.taotaosou.com

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: '360se5_Frame' WindowName: ''
ClassName: '360se6_Frame' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\taotaosou\ttk\ttkmonitor.exe' -install
'%LOCALAPPDATA%\taotaosou\ttk\taotaosou.exe' -hide
'%WINDIR%\syswow64\cmd.exe' /c sc config Schedule start= auto' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net start Schedule' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s %LOCALAPPDATA%\TaoTaoSou\TTK\TTSIEPlugin_64.dll' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c sc config Schedule start= auto
'%WINDIR%\syswow64\cmd.exe' /c net start Schedule
'%WINDIR%\syswow64\net.exe' start Schedule
'%WINDIR%\syswow64\sc.exe' config Schedule start= auto
'%WINDIR%\syswow64\net1.exe' start Schedule
'%WINDIR%\syswow64\regsvr32.exe' /s %LOCALAPPDATA%\TaoTaoSou\TTK\TTSIEPlugin_64.dll
'<SYSTEM32>\regsvr32.exe' /s %LOCALAPPDATA%\TaoTaoSou\TTK\TTSIEPlugin_64.dll

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней