Trojan.Siggen11.52405

To ensure autorun and distribution

Creates or modifies the following files

Creates the following files on removable media

Modifies file system

Creates the following files

%HOMEPATH%\desktop\dcratbuild.exe
%ProgramFiles(x86)%\windows sidebar\en-us\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
%ProgramFiles(x86)%\windows sidebar\en-us\explorer.exe
%ALLUSERSPROFILE%\application data\560854153607923c4c5f107085a7db67be01f252
%ALLUSERSPROFILE%\application data\wininit.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe
<Current directory>\9db6e019d4f04ef534d0f91b3462d805c40e9d20
<Current directory>\iexplore.exe
%ProgramFiles%\savprogress\dwm.exe
C:\far2\documentation\rus\69ddcba757bf72f7d36c464c71f42baab150b2b9
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\101b941d020240259ca4912829b53995ad543df6
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\lsm.exe
%APPDATA%\adobe\qkvuuag7qymyzexybqdr7ppydeprvz.vbe
%APPDATA%\adobe\runtimeperf.exe
%APPDATA%\adobe\hfw5cwqkeqofjcecs6mzqzfdecodkq.bat
%APPDATA%\adobe\6kpkitf1w77pn1r3t9fw2rewvyocee.bat
%APPDATA%\adobe\ugn3eyowgzcbxyify0wdrlbjelfauz.vbe
%APPDATA%\adobe\sxt07qvqma7xcsroczvy.exe
C:\far2\documentation\rus\smss.exe
%ProgramFiles%\savprogress\6cb0b6c459d5d3455a3da700e713f2e2529862ff

Sets the 'hidden' attribute to the following files

Network activity

TCP

HTTP GET requests

http://cw####2.tmweb.ru/kxzo08fdhv4eqs4tqlod6zvh4pvjn1wrya9ldeglx0xgpaoo51u8khfdws23t7p9/psfww4sd529cwfn1qrehurj7gailv/c768b40be611ed991ec5d8bbc13959bc542400ad.php?b2###########################...
http://cw####2.tmweb.ru/kxzo08fdhv4eqs4tqlod6zvh4pvjn1wrya9ldeglx0xgpaoo51u8khfdws23t7p9/psfww4sd529cwfn1qrehurj7gailv/n53ftcslgddto20foseni379b7rrl2v6384nl6q/d307c018a20c4e44fc6cfeb8c8fc1557.p...

'ip##fo.io':443

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%HOMEPATH%\desktop\dcratbuild.exe'
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Adobe\Ugn3eYowgzcBxYIfy0WdrLbjeLfAuZ.vbe"
'%APPDATA%\adobe\sxt07qvqma7xcsroczvy.exe' -p70b855f982ab4d127fe0865acb8eb1767e387ec3
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Adobe\qKvuUAg7QYmYZExybQdr7ppyDEPRvZ.vbe"
'%APPDATA%\adobe\runtimeperf.exe'
'%ProgramFiles%\savprogress\dwm.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Adobe\6KPKITf1w77PN1r3T9Fw2RewvyOceE.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Adobe\Hfw5CWqkeqoFjcecS6MzQzFdeCODkq.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Adobe\6KPKITf1w77PN1r3T9Fw2RewvyOceE.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Adobe\Hfw5CWqkeqoFjcecS6MzQzFdeCODkq.bat" "
'<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'<Current directory>\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Application Data\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Sidebar\en-US\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles%\savprogress\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose