Trojan.Siggen29.34353

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'O00ucSib3oGaHW78234A' = '<SYSTEM32>\AV Protection 2011v121.exe'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'hXXwVlOtz0yAiD2' = '%APPDATA%\dwme.exe'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'VivD3nF4aHJ7EgZ8234A' = '%APPDATA%\Lcc11ibDoG4m6W7\AV Protection 2011v121.exe'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '0A1.exe' = '%ProgramFiles(x86)%\LP\649A\0A1.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center
Windows Defender

blocks the following features:

Windows Action Center

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

Searches for registry branches where third party applications store passwords

[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\BPFTP]
[HKCU\Software\TurboFTP]
[HKCU\Software\Sota\FFFTP]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[HKCU\Software\VanDyke\SecureFX]
[HKCU\Software\Cryer\WebSitePublisher]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKCU\SOFTWARE\NCH Software\Fling\Accounts]
[HKCU\Software\FTPClient\Sites]
[HKLM\Software\Wow6432Node\FTPClient\Sites]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\Software\FileZilla Client]
[HKCU\Software\Far\SavedDialogHistory\FTPHost]
[HKCU\Software\Far2\SavedDialogHistory\FTPHost]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKLM\Software\Ghisler\Total Commander]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\FlashFXP]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKLM\Software\FlashFXP\3]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKLM\Software\FlashFXP]
[HKCU\Software\FileZilla]
[HKCU\Software\FileZilla Client]
[HKLM\Software\Wow6432Node\FileZilla]
[HKLM\Software\FileZilla]
[HKLM\Software\Wow6432Node\FileZilla Client]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Modifies file system

Creates the following files

%TEMP%\pijc64b.tmp
%ProgramFiles(x86)%\lp\649a\0a1.exe
%HOMEPATH%\desktop\av protection 2011.lnk
%APPDATA%\microsoft\windows\start menu\programs\av protection 2011\av protection 2011.lnk
%APPDATA%\pwkk8frl9\av protection 2011.ico
%APPDATA%\ldr.ini
%TEMP%\pij147a.tmp
%APPDATA%\ab488\861a.b48
%TEMP%\pij144b.tmp
%TEMP%\pijee55.tmp
%TEMP%\pijee44.tmp
%APPDATA%\dwme.exe
%TEMP%\dwme.exe
%WINDIR%\syswow64\av protection 2011v121.exe
%TEMP%\pijc66b.tmp
%APPDATA%\lcc11ibdog4m6w7\av protection 2011v121.exe
%ProgramFiles(x86)%\lp\649a\7510.tmp

Deletes the following files

%TEMP%\pijc64b.tmp
%TEMP%\pijc66b.tmp
%TEMP%\pijee44.tmp
%TEMP%\pijee55.tmp
%TEMP%\pij144b.tmp
%TEMP%\pij147a.tmp
%WINDIR%\syswow64\av protection 2011v121.exe

Modifies the HOSTS file.

Network activity

Connects to

'google.com':80
'ar####dlegion.com':80

TCP

HTTP GET requests

http://google.com/
http://ar####dlegion.com/716354_m61.png?pr#########################################

UDP

DNS ASK google.com
DNS ASK pi####ewonline.com
DNS ASK re###esys5.com
DNS ASK ar####dlegion.com
DNS ASK gi####oolstome.com
DNS ASK re####frommains.com
DNS ASK li###klubs.com
DNS ASK TR#####SDATAFORME.COM

Miscellaneous

Searches for the following windows

ClassName: 'npkjangh' WindowName: 'jbaohnjmedhkg'
ClassName: '' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: '' WindowName: 'View Available Networks'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Creates and executes the following

'%TEMP%\dwme.exe'
'%APPDATA%\dwme.exe' auto
'%WINDIR%\syswow64\av protection 2011v121.exe' Protection 2011v121.exe 5985<Full path to file>
'%APPDATA%\lcc11ibdog4m6w7\av protection 2011v121.exe' Protection 2011v121.exe 5985%WINDIR%\SysWOW64\AV Protection 2011v121.exe
'%APPDATA%\dwme.exe' start%APPDATA%\AB488\1EB64.exe%%APPDATA%\AB488
'%ProgramFiles(x86)%\lp\649a\7510.tmp'
'%APPDATA%\dwme.exe' start%ProgramFiles(x86)%\8861A\lvvm.exe%%ProgramFiles(x86)%\8861A

Executes the following