Trojan.Siggen30.28245

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe] 'Debugger' = 'msiexecs.exe -sb'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe] 'Debugger' = 'msiexecs.exe -sb'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = 'msiexecs.exe -sb'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = 'msiexecs.exe -sb'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe] 'Debugger' = 'msiexecs.exe -sb'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'E-Set 2011' = '%ProgramFiles(x86)%\E-Set 2011\e-set.exe'

Malicious functions

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Searches for registry branches where third party applications store passwords

[HKCU\SOFTWARE\Far\Plugins\FTP\Hosts]
[HKCU\SOFTWARE\RIT\The Bat!]
[HKCU\Software\RimArts\B2\Settings]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKCU\Software\Microsoft\Internet Account Manager\Accounts]
[HKCU\Software\FTPClient\Sites]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\ExpanDrive\Sessions]
[HKCU\Software\Cryer\WebSitePublisher]
[HKCU\Software\VanDyke\SecureFX]
[HKCU\Software\FTP Explorer\Profiles]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
[HKCU\Identities\{1BBA5DCD-58F3-46AE-861D-68CF42722C36}\Software\Microsoft\Internet Account Manager\Accounts]
[HKCU\Software\AIM\AIMPro]
[HKCU\Software\Paltalk]
[HKCU\Software\Google\Google Talk\Accounts]
[HKCU\Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users]
[HKCU\Software\Yahoo\Pager]
[HKCU\Software\Microsoft\MSNMessenger]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\SOFTWARE\RIT\The Bat!\Users depot]
[HKLM\SOFTWARE\Wow6432Node\Miranda]
[HKCU\Software\ORL\WinVNC3]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[HKCU\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[HKLM\Software\Microsoft\Internet Account Manager]
[HKLM\SOFTWARE\Miranda]
[HKLM\Software\Wow6432Node\Microsoft\Internet Account Manager]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\TurboFTP]
[HKCU\Software\BPFTP]
[HKLM\Software\Ghisler\Total Commander]
[HKCU\SOFTWARE\Far2\Plugins\FTP\Hosts]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKCU\SOFTWARE\Mirabilis\ICQ\NewOwners]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKLM\Software\FlashFXP\3]
[HKLM\Software\FlashFXP]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
[HKCU\Software\FlashFXP]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]
[HKCU\Software\FileZilla]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Modifies file system

Creates the following files

%WINDIR%\syswow64\msiexecs.exe
%ProgramFiles(x86)%\e-set 2011\e-set.exe
%HOMEPATH%\desktop\e-set antivirus 2011.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\e-set 2011\e-set antivirus 2011.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\e-set 2011\uninstall.lnk

Network activity

Connects to

'he##.yahoo.com':80
'he##.yahoo.com':443

TCP

HTTP GET requests

http://he##.yahoo.com/

Other

'he##.yahoo.com':443

UDP

DNS ASK he##.yahoo.com
DNS ASK cp####akswin7.com
DNS ASK ti###update.com

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial