Trojan.Siggen18.48398

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\07572552-3ffa-22a4-8634-2443e7bfaf221
<SYSTEM32>\tasks\d82a6a2c-8639-5691-86a2-49fa5bb860e9

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Executes the following

'<SYSTEM32>\netsh.exe' firewall set notifications mode = disable profile = all

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe

Modifies file system

Creates the following files

%APPDATA%\07572552-3ffa-22a4-8634-2443e7bfaf22\07572552-3ffa-22a4-8634-2443e7bfaf22
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\sptzfxlxfyvzjuqionmpdzdssiwefesk563642862131931795.png
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jkgjemniiyfoymslxy225082580577318143.pptx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ladqsftylrgpxruxqovbacbx516413461213137283.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\aicbxnsbbxzsdejljdpidfa757910469027834023.docx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\njxgvruawxncdxskhkueaarwk930393268534675256.odt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\gujrrujutjnwsimvekarsplibvpkdiuexlm42389836585921403.png
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ycdgypyfdwijocdmawaqqftpk404071457863358693.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\seivcodxtfcyvkgxhg19101582045311938.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\qquffurlxuygjelyoqabqbgyon571467910974366685.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\fkw325861285006336247.pptx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ekbjrhfvpnyzbvlxhpqcnsokbxkigmp427328827025988023.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\gdfnrtdwslevwwlwv998459232981381445.dat
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\opuxefdsnjjwjkmcsmc861400581933696321.mdb
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\hanxlpoeuhkrlnmylzogic889929759404919286.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ctcxxktmilxxuwbzbkalyegmjsp223474837744855199.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\utkvbuvccnwbl916702728444276972.aspx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\waehzuvxewqkvyhsdzyyklfdm559344902016482989.aspx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\sflvmfnlmrtiyqagnw675730413568150074.sql
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\hoanbmjcdcrxpjhnvmsudbchtboq191975337187895612.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\pasgbspjojyauc462248443528539592.dat
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\drgxgwhievjlqnakpyyhdcxerjbmyrbu436641819954264691.xml
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\xtoqrkwcbggugtunobovqnixbr488339575131413742.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\hrhnyiictzpzaznia390623250647291932.xls
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\xydtlwnrhkdrzmtrssctnkyuljdmbgkd64129533413631993.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\cscntosmlbgfomujpnhrhmysrtciyodibt499284112602894086.odt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\vtspawxsdsvxiglqmylcjkb183767761603878837.sql
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\eiwwsyqlw983716210899761269.png
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\falhcyqkhqa592395394566510895.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\rcymygbegnrxvynayedymoug700463227413154627.php
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\mwhdmtumbarwrkmyr200594207282686187.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\qmuxnqqvvkhfmtdmfibhzsiyjpilia309656964277489825.dat
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\cebaxulvvvoeoonxdvrwploofaguezze93776691601865421.txt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\flqeluutvjucex914380721660831953.xlsx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\piccmwlnqdf136264718126831204.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\uzvmxgvxccf618846345365883962.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\qbsvsnsmfbya48998676153576099.xml
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\yltijxhzzvs521740814250446196.mdb
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\wrnrcvrpznimbjjsjaiwcsdylyvawozfw812280395796246276.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\smwksdlp90064560262831732.pptx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\povfymlzheqjxxxoiykigqrsrntycvkm477081132364715639.dat
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\shlxxuafulpihmsawvkguecrj96942117900728511.doc
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\hwbweaewevxeqpmyodacmxhlmjdmta65297420073933567.docx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\enjmhqettrmqrcesondovvqipdpyvo418648731671326770.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\vklpbscskxbgyeyosti76255845974558620.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\lqlpwipviwqqadxgkuoqor699111532563913280.aspx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\gotzgxjxpwu694644465295376965.mdb
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\tbqyprjifstmjqnceuamvryftiqqtiefgxkqvir509752562258975937.pptx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\pfynhyrqm92640360932592673.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ikhdgnpck1573241877849459.mdb
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\nlgzkoseorymnuagvfxfgjfsihekegj161763299866798152.xlsx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\zbibslyewilndsmmtawt716342728145570608.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\mfwygfjvbpulzykf781777741688154936.xml
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\kqfmjfbofoab349316399904323303.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jai259205280575366051.xml
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\dldpbbqlgfyokjcouykk221524774856849133.odt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\zazsxhpielu833015646157520564.txt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\bawprqteiffnarwioa700943815413875091.doc
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\yfuesctixqxxisjbdcdqhbhujlcpky9285658505731638.php
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\xrqppphfsaxajtbfaq673384368189862154.keys
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\bbhrefgymvhtnpiwfbentlmallej945009923535256092.txt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\nrwsxknlqlw959009815128627882.xls
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\mlkokvoyli558015481713344355.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\hpyeyqo477787279329998232.jpg
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\vrcasxsvfnuczes786688318718963922.xlsx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\invtxqwqmdcunbyhchckf361240447254462885.xls
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\awnogiegyq923454469158774653.ppt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\dlxoddjkoowponsdldzxndojywveepw51945794774764879.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\knjspixr260112183460881573.png
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\tqxeba526725211414312800.png
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ldhwczgrbuijaahyiadugjb525111912246339339.pptx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\vqaelmomuyvmuopvceri897198579987876079.asp
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\dgmeigcbroyyj966151540710232152.txt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\lcivzssrizrrxavvfpgbtbxbivkl296242665713362054.sql
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jhhresykfntb772524767450929809366164042e07
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\afbqgndyrripmkduakfuiladiyunxxwjfk32141853695342107231940977.ico
%APPDATA%\exceptions\exception.txt
C:\07572552-3ffa-22a4-8634-2443e7bfaf221\07572552-3ffa-22a4-8634-2443e7bfaf221.vbs
%TEMP%\is-pfijb.tmp\_isetup\_shfoldr.dll
%TEMP%\is-pfijb.tmp\_isetup\_setup64.tmp
%TEMP%\setup log 2022-09-19 #001.txt
%APPDATA%\07572552-3ffa-22a4-8634-2443e7bfaf22\07572552-3ffa-22a4-8634-2443e7bfaf22t.bin
%TEMP%\is-rrsbl.tmp\07572552-3ffa-22a4-8634-2443e7bfaf220.tmp
%APPDATA%\adobe\07572552-3ffa-22a4-8634-2443e7bfaf220.exe
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\nxxijitobn189930910243520499.sln
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\whkkpnceuaksvbvntrnevzgqkungphlx220043428087148234.html
C:\d82a6a2c-8639-5691-86a2-49fa5bb860e9\d82a6a2c-8639-5691-86a2-49fa5bb860e9.vbs
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\buauzvnmolhwepbvleoqtysgspiwbaor175616859106497566.csv
%TEMP%\kuql0nhw.dll
%TEMP%\res272f.tmp
%TEMP%\csce82c9ee14f694a288d2ad9c0dae5ea9a.tmp
%TEMP%\kuql0nhw.out
%TEMP%\kuql0nhw.cmdline
%TEMP%\kuql0nhw.0.cs
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\buavclctuu11124022176421365.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\dzfnegqmtcvbicgunmh946868884940448890.xml
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\pwoostv677302246631992321.xlsx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\zvvinbjtya876279411412770950.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\sgaypwmvc73568906527974992.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\kchehpjbgpnmpr628520700756128306.keys
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\dtmi61508442746758926.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\lcnpehclvetnboaekjlhwzmqeqkvea55128539993082242.ppt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\ysccwwrmynpn870839938780692530.xls
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\tnpeteowcuqrazugxx263454929235630443.aspx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\bveuspufcjrpjprwnzhymedbw987406457499689567.doc
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\grmmozhjjmxanolpgurtdrloxe20241528488617045.keys
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\wpuffghjwbqmacurnwakqfnnjxhoqqoj893083122721876295.php
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\kqyxsafnsezpxqthodugkdhbvcmdlwml864643551778944245.csv
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\srxmqcmmfp319365679991137353.txt
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\cppilwpjdvytnlnnjotjgx578646882197974726.html
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jlulmzcikrtqykbwbrbwkhuedbdmx62269021567442140.aspx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jxiz102741355184457509.xlsx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\btbklplnvonfmixawtad130790141329262354.docx
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\jizpvfgcsgyaqkrmsuvaoyhawrjnyrborlyuixmdaezwtxt406789590894379959621052794
%TEMP%\07572552-3ffa-22a4-8634-2443e7bfaf22\kdspff425692582320683643.asp

Deletes the following files

%TEMP%\res272f.tmp
%TEMP%\csce82c9ee14f694a288d2ad9c0dae5ea9a.tmp
%TEMP%\kuql0nhw.out
%TEMP%\kuql0nhw.0.cs
%TEMP%\kuql0nhw.dll
%TEMP%\kuql0nhw.cmdline

Network activity

Connects to

'my######ain394863467.com':81
'bi###cket.org':443
'bb#######oads.s3.amazonaws.com':443

TCP

HTTP GET requests

http://my######ain394863467.com:81/gpuF.html via my######ain394863467.com

Other

'bi###cket.org':443
'bb#######oads.s3.amazonaws.com':443

UDP

DNS ASK my######ain394863467.com
DNS ASK bi###cket.org
DNS ASK bb#######oads.s3.amazonaws.com

Miscellaneous

Creates and executes the following

'%APPDATA%\adobe\07572552-3ffa-22a4-8634-2443e7bfaf220.exe'
'%TEMP%\is-rrsbl.tmp\07572552-3ffa-22a4-8634-2443e7bfaf220.tmp' /SL5="$C022A,2952592,69120,%APPDATA%\Adobe\07572552-3ffa-22a4-8634-2443e7bfaf220.exe"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kuql0nhw.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:%TEMP%\RES272F.tmp" "%TEMP%\CSCE82C9EE14F694A288D2AD9C0DAE5EA9A.TMP"' (with hidden window)

Executes the following

'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe'
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:%TEMP%\RES272F.tmp" "%TEMP%\CSCE82C9EE14F694A288D2AD9C0DAE5EA9A.TMP"
'<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kuql0nhw.cmdline"
'<SYSTEM32>\powercfg.exe' /CHANGE monitor-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /CHANGE hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /CHANGE standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /CHANGE disk-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\schtasks.exe' /create /f /sc daily /st 12:00 /rl highest /tn 07572552-3ffa-22a4-8634-2443e7bfaf221 /tr C:\07572552-3ffa-22a4-8634-2443e7bfaf221\07572552-3ffa-22a4-8634-2443e7bfaf221.vbs
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' /C $settingsSet = New-ScheduledTaskSettingsSet -Hidden -DontStopIfGoingOnBatteries -AllowStartIfOnBatteries -Priority 0 -StartWhenAvailable -DisallowHardTerminate;$settingsSet.ExecutionTimeLimi...
'<SYSTEM32>\cmd.exe' /C schtasks /create /f /sc daily /st 12:00 /rl highest /tn 07572552-3ffa-22a4-8634-2443e7bfaf221 /tr C:\07572552-3ffa-22a4-8634-2443e7bfaf221\07572552-3ffa-22a4-8634-2443e7bfaf221.vbs
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
'<SYSTEM32>\cmd.exe' /C schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
'<SYSTEM32>\cmd.exe' /C schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
'<SYSTEM32>\cmd.exe' /C schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
'<SYSTEM32>\cmd.exe' /C schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
'<SYSTEM32>\cmd.exe' /C schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' /C powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c;POWERCFG /CHANGE disk-timeout-ac 0;POWERCFG /CHANGE standby-timeout-ac 0;POWERCFG /CHANGE hibernate-timeout-ac 0;POWERCFG /CHANGE monitor-tim...
'<SYSTEM32>\cmd.exe' /C schtasks /create /f /sc onlogon /rl highest /tn d82a6a2c-8639-5691-86a2-49fa5bb860e9 /tr C:\d82a6a2c-8639-5691-86a2-49fa5bb860e9\d82a6a2c-8639-5691-86a2-49fa5bb860e9.vbs
'<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn d82a6a2c-8639-5691-86a2-49fa5bb860e9 /tr C:\d82a6a2c-8639-5691-86a2-49fa5bb860e9\d82a6a2c-8639-5691-86a2-49fa5bb860e9.vbs

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial