Trojan.Siggen32.6026

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'ImagePath' = '<SYSTEM32>\winsvc.exe'

Creates the following services

'winsvc' <SYSTEM32>\winsvc.exe

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM winnet.exe
'<SYSTEM32>\taskkill.exe' /F /IM wincfg.exe

Modifies file system

Creates the following files

%TEMP%\<File name>-b09191cbca92726e\<File name>.exe
%TEMP%\<File name>-3ddc4a9f3cb1e862\<File name>.exe
<SYSTEM32>\.co7172.tmp
nul
%WINDIR%\temp\__psscriptpolicytest_rbwctlxo.3rb.ps1
%WINDIR%\temp\__psscriptpolicytest_ghxfxfrl.w4a.psm1
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-004.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-254.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-317.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-448.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-478.dump
%WINDIR%\temp\__psscriptpolicytest_klx40uog.wbi.ps1
%WINDIR%\temp\__psscriptpolicytest_jdqbtcqx.xcp.psm1
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-633.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-656.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-688.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-747.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-871.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-25-974.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-085.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-116.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-132.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-153.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-167.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-200.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-210.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-644.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-691.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-710.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-732.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-737.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-756.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-770.dump
%WINDIR%\temp\content\580-3212-powershell.exe-23-22-26-800.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\__psscriptpolicytest_sy3qhdbl.nn1.ps1
%WINDIR%\temp\__psscriptpolicytest_ksuylhuf.q3v.psm1
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-27-906.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-150.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-212.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-332.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-362.dump
%WINDIR%\temp\__psscriptpolicytest_0nxdvzrt.rr2.ps1
%WINDIR%\temp\__psscriptpolicytest_ndlogf2r.gk5.psm1
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-475.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-495.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-537.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-606.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-697.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-761.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-859.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-876.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-896.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-915.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-945.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-963.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-28-994.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-270.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-304.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-323.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-345.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-369.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-390.dump
%WINDIR%\temp\content\2872-1644-powershell.exe-23-22-29-406.dump
%WINDIR%\temp\__psscriptpolicytest_0fgsdhgx.xqu.ps1
%WINDIR%\temp\__psscriptpolicytest_0mldlue3.j40.psm1
%WINDIR%\temp\content\1800-4976-powershell.exe-23-22-30-626.dump
%WINDIR%\temp\content\1800-4976-powershell.exe-23-22-31-327.dump
%WINDIR%\temp\__psscriptpolicytest_zootou2n.str.ps1
%WINDIR%\temp\__psscriptpolicytest_duaxz1mh.xcn.psm1
%WINDIR%\temp\content\4864-5044-powershell.exe-23-22-35-316.dump
%WINDIR%\temp\content\4864-5044-powershell.exe-23-22-35-684.dump
<SYSTEM32>\winnet.exe
<SYSTEM32>\wincfg.exe
%WINDIR%\temp\__psscriptpolicytest_zgmnpfgv.ynp.ps1
%WINDIR%\temp\__psscriptpolicytest_zspzvz0o.b0f.psm1
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-40-500.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-40-728.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-40-799.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-40-909.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-40-937.dump
%WINDIR%\temp\__psscriptpolicytest_b1v0kuz3.hgy.ps1
%WINDIR%\temp\__psscriptpolicytest_d2sbvszw.dq5.psm1
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-054.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-077.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-109.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-180.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-283.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-401.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-433.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-492.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-519.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-557.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-816.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-870.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-41-981.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-034.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-220.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-340.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-392.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-429.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-452.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-459.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-483.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-500.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-520.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-546.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-577.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-601.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-641.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-673.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-703.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-722.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-751.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-773.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-805.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-826.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-846.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-42-877.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-114.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-289.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-320.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-342.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-362.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-382.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-400.dump
%WINDIR%\temp\content\3872-4948-powershell.exe-23-22-43-425.dump
%WINDIR%\temp\__psscriptpolicytest_hkikfkfr.gnj.ps1
%WINDIR%\temp\__psscriptpolicytest_w0o3rqxs.a0t.psm1
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-44-785.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-012.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-066.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-185.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-210.dump
%WINDIR%\temp\__psscriptpolicytest_nb2pdphs.gql.ps1
%WINDIR%\temp\__psscriptpolicytest_pon4apgs.0vp.psm1
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-344.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-358.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-391.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-469.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-554.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-659.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-685.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-725.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-745.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-45-779.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-049.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-096.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-226.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-280.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-461.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-597.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-638.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-657.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-686.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-717.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-737.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-758.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-778.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-799.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-827.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-857.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-893.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-927.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-967.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-46-989.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-028.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-051.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-072.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-092.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-114.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-138.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-704.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-738.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-760.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-782.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-808.dump
%WINDIR%\temp\content\984-2824-powershell.exe-23-22-47-836.dump

Deletes following files that it created itself

%TEMP%\<File name>-3ddc4a9f3cb1e862\<File name>.exe
%TEMP%\<File name>-b09191cbca92726e\<File name>.exe
%WINDIR%\temp\__psscriptpolicytest_rbwctlxo.3rb.ps1
%WINDIR%\temp\__psscriptpolicytest_ghxfxfrl.w4a.psm1
%WINDIR%\temp\__psscriptpolicytest_klx40uog.wbi.ps1
%WINDIR%\temp\__psscriptpolicytest_jdqbtcqx.xcp.psm1
%WINDIR%\temp\__psscriptpolicytest_sy3qhdbl.nn1.ps1
%WINDIR%\temp\__psscriptpolicytest_ksuylhuf.q3v.psm1
%WINDIR%\temp\__psscriptpolicytest_0nxdvzrt.rr2.ps1
%WINDIR%\temp\__psscriptpolicytest_ndlogf2r.gk5.psm1
%WINDIR%\temp\__psscriptpolicytest_0fgsdhgx.xqu.ps1
%WINDIR%\temp\__psscriptpolicytest_0mldlue3.j40.psm1
%WINDIR%\temp\__psscriptpolicytest_zootou2n.str.ps1
%WINDIR%\temp\__psscriptpolicytest_duaxz1mh.xcn.psm1
%WINDIR%\temp\__psscriptpolicytest_zgmnpfgv.ynp.ps1
%WINDIR%\temp\__psscriptpolicytest_zspzvz0o.b0f.psm1
%WINDIR%\temp\__psscriptpolicytest_b1v0kuz3.hgy.ps1
%WINDIR%\temp\__psscriptpolicytest_d2sbvszw.dq5.psm1
%WINDIR%\temp\__psscriptpolicytest_hkikfkfr.gnj.ps1
%WINDIR%\temp\__psscriptpolicytest_w0o3rqxs.a0t.psm1
%WINDIR%\temp\__psscriptpolicytest_nb2pdphs.gql.ps1
%WINDIR%\temp\__psscriptpolicytest_pon4apgs.0vp.psm1

Moves the following files

from <SYSTEM32>\.co7172.tmp to <SYSTEM32>\winsvc.exe

Network activity

Connects to

'mo#####.map.fastly.net':443
'co##############e-chains.prod.autograph.services.mozaws.net':443

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\<File name>-b09191cbca92726e\<File name>.exe'
'%TEMP%\<File name>-3ddc4a9f3cb1e862\<File name>.exe'
'<SYSTEM32>\winsvc.exe' "%TEMP%\<File name>-b09191cbca92726e\<File name>.exe"
'<SYSTEM32>\winsvc.exe'

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"<SYSTEM32>\winsvc.exe\"" "DisplayName=\"Windows System Service...
'<SYSTEM32>\sc.exe' create winsvc type=own start=auto error=ignore binPath=<SYSTEM32>\winsvc.exe "DisplayName=Windows System Service"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
'<SYSTEM32>\sc.exe' failure winsvc reset=0 actions=restart/0/restart/0/restart/0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "start" "winsvc"
'<SYSTEM32>\sc.exe' start winsvc
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"<SYSTEM32>\""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"%WINDIR%\Temp\""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "taskkill.exe" "/F" "/IM" "winnet.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "taskkill.exe" "/F" "/IM" "wincfg.exe"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"<SYSTEM32>\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTrave...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial