Trojan.Siggen10.48678

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\software\microsoft\windows\currentversion\run] 'NAAUIMYE.exe' = '%HOMEPATH%\BowEowUY\NAAUIMYE.exe'
[<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'JUYkEYok.exe' = '%ALLUSERSPROFILE%\QMswIQYU\JUYkEYok.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\QMswIQYU\JUYkEYok.exe,'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%ALLUSERSPROFILE%\QMswIQYU\JUYkEYok.exe,'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\QAkkkgAx] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\QAkkkgAx] 'ImagePath' = '%ALLUSERSPROFILE%\mSoAwQUE\HIccQAcI.exe'

Creates the following services

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

blocks the following features:

Modifies file system

Creates the following files

Deletes the following files

Network activity

TCP

HTTP GET requests

'bl##k.io':443

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%HOMEPATH%\boweowuy\naauimye.exe'
'%ALLUSERSPROFILE%\qmswiqyu\juykeyok.exe'
'%ALLUSERSPROFILE%\msoawque\hiccqaci.exe'
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c "<PATH_SAMPLE>"
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f