Trojan.Siggen17.38210

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"<Current directory>\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\AppCompat\Programs\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe", "%WINDIR%\AppCompat\Programs\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\sro_client\firefox.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe", "%WINDIR%\AppCompat\Programs\csrss.exe", "%ProgramFiles%\sro_client\f...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%WINDIR%\PolicyDefinitions\en-US\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%HOMEPATH%\Saved Games\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Users\Public\Downloads\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<Current directory>\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\totalcmd\LANGUAGE\wininit.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\wmiprvsew
<SYSTEM32>\tasks\wmiprvse
<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\smsss
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\systems
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\wininitw
<SYSTEM32>\tasks\wininit
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\wudfhostw
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\iexplore

Malicious functions

Reads files which store third party applications passwords

%ProgramFiles(x86)%\steam\config\config.vdf
%ProgramFiles(x86)%\steam\config\dialogconfig.vdf
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

<Current directory>\wudfhost.exe
<Current directory>\cc11b995f2a76d
C:\totalcmd\language\wininit.exe
C:\totalcmd\language\56085415360792
%TEMP%\7avjy2orpa
%TEMP%\fzbocqhbdj
%TEMP%\0ob8tzuoid
%TEMP%\kxzqs3vlhf
%TEMP%\xpskvvnygf
%TEMP%\vst98bdswn
%TEMP%\7gihvqg3b0
%TEMP%\xk50n8mgsm
%TEMP%\ufgs6qfsg5
%TEMP%\kewsm3r4c2
%TEMP%\o1yetjf6zf
%TEMP%\9zkrpd5lvf
%TEMP%\hiv5m3ymot
%TEMP%\rsdzx2rbix
%TEMP%\vitk5u3pdt
<Current directory>\winlogon.exe
%TEMP%\to1hubxcem
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\9db6e019d4f04e
%WINDIR%\policydefinitions\en-us\cc11b995f2a76d
<Current directory>\480b7989c529f6
%WINDIR%\appcompat\programs\csrss.exe
%WINDIR%\appcompat\programs\886983d96e3d3e
%ProgramFiles%\sro_client\firefox.exe
%ProgramFiles%\sro_client\0fc223bdacedc3
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\56085415360792
%WINDIR%\policydefinitions\en-us\winlogon.exe
%WINDIR%\installer\{eb9bd1d5-8dfb-48c4-927b-10bb47ca59b3}\system.exe
%ProgramFiles%\symantecrootinstaller\24dbde2999530e
%WINDIR%\installer\{eb9bd1d5-8dfb-48c4-927b-10bb47ca59b3}\27d1bcfc3c54e0
%HOMEPATH%\saved games\smss.exe
%HOMEPATH%\saved games\69ddcba757bf72
C:\users\public\downloads\audiodg.exe
C:\users\public\downloads\42af1c969fbb7b
%ALLUSERSPROFILE%\oracle\java\installcache_x64\audiodg.exe
%ALLUSERSPROFILE%\oracle\java\installcache_x64\42af1c969fbb7b
%ProgramFiles%\symantecrootinstaller\wmiprvse.exe
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\iexplore.exe
%TEMP%\vtspyrvvtx

Deletes the following files

%TEMP%\7avjy2orpa
%TEMP%\vitk5u3pdt
%TEMP%\rsdzx2rbix
%TEMP%\hiv5m3ymot
%TEMP%\9zkrpd5lvf
%TEMP%\o1yetjf6zf
%TEMP%\kewsm3r4c2
%TEMP%\7gihvqg3b0
%TEMP%\ufgs6qfsg5
%TEMP%\vst98bdswn
%TEMP%\to1hubxcem
%TEMP%\xpskvvnygf
%TEMP%\kxzqs3vlhf
%TEMP%\0ob8tzuoid
%TEMP%\fzbocqhbdj
%TEMP%\xk50n8mgsm
%TEMP%\vtspyrvvtx

Network activity

Connects to

'87.##1.77.63':80

TCP

HTTP GET requests

http://87.##1.77.63/cpulongpollflowerpublicCdn.php?xx############################################################################################################################################...
http://87.##1.77.63/cpulongpollflowerpublicCdn.php?BX############################################################################################################################################...

Miscellaneous

Creates and executes the following

'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'
'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 14 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 14 /tr "'%HOMEPATH%\Saved Games\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONSTART /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 5 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'<Current directory>\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONSTART /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'<Current directory>\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 7 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONSTART /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\sro_client\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc MINUTE /mo 12 /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONSTART /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /f

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial