Trojan.Siggen18.34359

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'xijiy' = '%HOMEPATH%\xijiy.exe /p'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'xijiy' = '%HOMEPATH%\xijiy.exe /n'

Creates the following files on removable media

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\arrow-down.exe
<Drive name for removable media>:\cbz.exe
<Drive name for removable media>:\dissolveanother.exe
<Drive name for removable media>:\lom602.exe
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.exe
<Drive name for removable media>:\fil_20060629111052.exe
<Drive name for removable media>:\spib_pima.exe
<Drive name for removable media>:\ff_ot_user_guide.exe
<Drive name for removable media>:\video.exe
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.exe
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.exe
<Drive name for removable media>:\51.exe
<Drive name for removable media>:\210252809.exe
<Drive name for removable media>:\region-north-karelia.exe
<Drive name for removable media>:\cleanlyrics.exe
<Drive name for removable media>:\parnas_01.exe
<Drive name for removable media>:\fi51.exe
<Drive name for removable media>:\508softwareandos.exe
<Drive name for removable media>:\cveuropeo.exe
<Drive name for removable media>:\february_catalogue__2015.exe
<Drive name for removable media>:\hanni_umami_chapter.exe
<Drive name for removable media>:\dashborder_192.exe
<Drive name for removable media>:\dashborder_96.exe
<Drive name for removable media>:\tileimage.exe
<Drive name for removable media>:\coffee.exe
<Drive name for removable media>:\default.exe
<Drive name for removable media>:\archer.exe
<Drive name for removable media>:\000814251_video_01.exe
<Drive name for removable media>:\split.exe
<Drive name for removable media>:\xijiy.exe
<Drive name for removable media>:\3.exe
<Drive name for removable media>:\babyboymaintonotesbackground_pal.exe

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

Injects code into

the following user processes:

xijiy.exe

Modifies file system

Creates the following files

%HOMEPATH%\xijiy.exe
%HOMEPATH%\1.exe
%HOMEPATH%\2.exe
%HOMEPATH%\3.exe
%HOMEPATH%\4.exe

Sets the 'hidden' attribute to the following files

%HOMEPATH%\xijiy.exe
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\xijiy.exe

Network activity

Connects to

'ns#.#nsfor.net':7001
'ns#.#nsfor3.com':7001

UDP

DNS ASK ns#.#nsfor0.com
DNS ASK ns#.#nsfor1.com
DNS ASK ns#.#nsfor1.net
DNS ASK ns#.#nsfor1.org
DNS ASK ns#.#nsfor2.com
DNS ASK ns#.#nsfor.net
DNS ASK ns#.#nsfor3.com

Miscellaneous

Searches for the following windows

ClassName: 'WindowsScreenSaverClass' WindowName: 'Screen Saver'

Creates and executes the following

'%HOMEPATH%\xijiy.exe'
'%HOMEPATH%\xijiy.exe' "%HOMEPATH%\xijiy.exe" 71
'%WINDIR%\syswow64\cmd.exe' /c route add 216.239.32.21 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 216.239.34.21 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 216.239.36.21 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 216.239.38.21 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 74.125.34.46 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 173.194.72.121 0.0.0.0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c route add 5.39.93.201 0.0.0.0' (with hidden window)

Executes the following