Trojan.Siggen9.11339

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\tmcomm] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\tmcomm] 'ImagePath' = 'system32\DRIVERS\tmcomm.sys'

Modifies file system

Creates the following files

<Current directory>\trendmicro antithreat toolkit\supporttool.log
<Current directory>\trendmicro antithreat toolkit\updater\audaemon.log
%LOCALAPPDATA%\housecall.guid.cache
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmebc64.sys
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmcomm.sys
<Current directory>\trendmicro antithreat toolkit\hc_attk\vsapi64.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\utilclientloader.dll
<Current directory>\trendmicro antithreat toolkit\output\2020.02.13-0131.05_34507013-0039-00c2-0055-00d85aa26dfd_10568.zip
<Current directory>\trendmicro antithreat toolkit\hc_attk\tscdll64.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmfbeng.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmengdrv.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\symsrv.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\libexpatw.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin\irobot.plugin.uninstallsoftwarelister.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin\irobot.plugin.filedumper.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmufeng.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\kv.repos
<Current directory>\trendmicro antithreat toolkit\hc_attk\hccli.log
<Current directory>\trendmicro antithreat toolkit\hc_attk\hclib.log
<Current directory>\trendmicro antithreat toolkit\hc_attk\report\20200213.log
%TEMP%\trendmicro\attk\log\096f629c-3ed0-432c-b2a8-a905d5fcc454\uninstallsoftwarelister.xml
%TEMP%\trendmicro\attk\log\096f629c-3ed0-432c-b2a8-a905d5fcc454\filedump.log
%TEMP%\trendmicro\attk\log\096f629c-3ed0-432c-b2a8-a905d5fcc454\avproductinfo.xml
%WINDIR%\temp\uddec08.tmp
%TEMP%\trendmicro\attk\log\096f629c-3ed0-432c-b2a8-a905d5fcc454\configuration.xml
%TEMP%\trendmicro\attk\log\history.log
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin.uninstallsoftwarelister.log
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin.filedumper.log
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin.avproductinfocollector.log
<DRIVERS>\sete07e.tmp
%WINDIR%\temp\olde06f.tmp
<DRIVERS>\tmcomm.sys
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmfbep\b.23f4efa68e2eec8b6d5c122271021a1e6d8885d1
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmfbep\t.91606350-4e43-11ea-a7aa-283cea26855a
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin\irobot.plugin.avproductinfocollector.dll
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
<Current directory>\trendmicro antithreat toolkit\hc_attk\hc_core.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\bpmnt.dll
<Current directory>\trendmicro antithreat toolkit\hc_attk\license.txt
<Current directory>\trendmicro antithreat toolkit\internal\sis_packing_config.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\linkrule.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\languagemap.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\housecall.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\profile\full.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\debuglogoff.reg
<Current directory>\trendmicro antithreat toolkit\hc_attk\dlstr.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\profile\custom.template.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\config.xml
<Current directory>\trendmicro antithreat toolkit\attk.xml
<Current directory>\trendmicro antithreat toolkit\updater\audaemon.bin
<Current directory>\trendmicro antithreat toolkit\hc_attk\attkcli.bin
<Current directory>\trendmicro antithreat toolkit\real.7z
<Current directory>\trendmicro antithreat toolkit\updater\dlconfig.xml
<Current directory>\trendmicro antithreat toolkit\hc_attk\debuglogon.reg
<Current directory>\trendmicro antithreat toolkit\hc_attk\tsc.ini
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\ptn$agg.999
<Current directory>\trendmicro antithreat toolkit\hc_attk\symsrv.yes
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\tmwlchk.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcpolicy.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcfrs.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcclean.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\crcz.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\avproductinfo.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\ar.ptn
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmebc.inf
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmcomm.inf
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\whitelist.in
<Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\blacklist.in
<Current directory>\trendmicro antithreat toolkit\hc_attk\plugin\filedumper.cfg
<Current directory>\trendmicro antithreat toolkit\hc_attk\housecall70.cert
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmcomm.cat
<Current directory>\trendmicro antithreat toolkit\hc_attk\dbghelp.dll
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Deletes the following files

<Current directory>\trendmicro antithreat toolkit\real.7z
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmfbep\t.91606350-4e43-11ea-a7aa-283cea26855a
%WINDIR%\temp\olde06f.tmp
%WINDIR%\temp\uddec08.tmp
<Current directory>\trendmicro antithreat toolkit\hc_attk\tmfbep\b.23f4efa68e2eec8b6d5c122271021a1e6d8885d1

Moves the following files

from <Current directory>\trendmicro antithreat toolkit\updater\audaemon.bin to <Current directory>\trendmicro antithreat toolkit\updater\<File name>.exe
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\ar.ptn to %TEMP%\trendmicro\attk\pattern\ar.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\avproductinfo.ptn to %TEMP%\trendmicro\attk\pattern\avproductinfo.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\blacklist.in to %TEMP%\trendmicro\attk\pattern\blacklist.in
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\crcz.ptn to %TEMP%\trendmicro\attk\pattern\crcz.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcclean.ptn to %TEMP%\trendmicro\attk\pattern\hcclean.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcfrs.ptn to %TEMP%\trendmicro\attk\pattern\hcfrs.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\hcpolicy.ptn to %TEMP%\trendmicro\attk\pattern\hcpolicy.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\ptn$agg.999 to %TEMP%\trendmicro\attk\pattern\ptn$agg.999
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\tmwlchk.ptn to %TEMP%\trendmicro\attk\pattern\tmwlchk.ptn
from <Current directory>\trendmicro antithreat toolkit\hc_attk\pattern\whitelist.in to %TEMP%\trendmicro\attk\pattern\whitelist.in
from <Current directory>\trendmicro antithreat toolkit\hc_attk\attkcli.bin to <Current directory>\trendmicro antithreat toolkit\hc_attk\<File name>.exe
from <DRIVERS>\sete07e.tmp to <DRIVERS>\tmcomm.sys

Substitutes the following files

<Current directory>\trendmicro antithreat toolkit\updater\audaemon.bin

Network activity

Connects to

'oc##.thawte.com':80

TCP

HTTP GET requests

http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
http://cr#.#hawte.com/ThawtePCA.crl
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBIoxICyaC43MRYCecL3P84%3D
http://cs#####rl.thawte.com/ThawteCSG2.crl

'ho#########0-en.fbs20.trendmicro.com':443

UDP

DNS ASK ho#########0-en.fbs20.trendmicro.com
DNS ASK 14#.###.70.150.in-addr.arpa
DNS ASK oc##.thawte.com
DNS ASK cr#.#hawte.com
DNS ASK cs#####rl.thawte.com

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'<Current directory>\trendmicro antithreat toolkit\updater\<File name>.exe' -config_file=DLConfig.xml -noupdate
'<Current directory>\trendmicro antithreat toolkit\hc_attk\<File name>.exe' -Profile=Quick -NC -SRC -FB -SS=200 -CONFIG=\..\..\config.ini

Executes the following

'%WINDIR%\regedit.exe' /s DebugLogOn.reg
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\ipconfig.exe' /displaydns

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial