Trojan.Siggen17.60383

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\dpapiprovider\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\wpcumi\csrss.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\wpcumi\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Documents and Settings\audiodg.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Documents and Settings\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\tcpipcfg\csrss.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\tcpipcfg\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\dpapiprovider\dwm.exe", "<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe", "C:\totalcmd\LANGUAGE\smss.exe",...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"C:\totalcmd\LANGUAGE\smss.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"C:\totalcmd\LANGUAGE\smss.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\dpapiprovider\dwm.exe", "<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe", "C:\totalcmd\LANGUAGE\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\dpapiprovider\dwm.exe", "<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\dpapiprovider\dwm.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\dpapiprovider\dwm.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\api-ms-win-core-handle-l1-1-0\wininit.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\api-ms-win-core-handle-l1-1-0\wininit.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\wmiprvse
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\wininit

Modifies file system

Creates the following files

%TEMP%\refnetcommonrefdlldhcp.exe
%TEMP%\yh24oadzvm
%TEMP%\6f9e54d155fa2c193b897b9fb2a806f71cfbb273991a606c5651bb24f9cf4697857b03604e773c8d
<SYSTEM32>\api-ms-win-core-handle-l1-1-0\560854153607923c4c5f107085a7db67be01f252
<SYSTEM32>\api-ms-win-core-handle-l1-1-0\wininit.exe
<SYSTEM32>\wpcumi\886983d96e3d3e31032c679b2d4ea91b6c05afef
<SYSTEM32>\wpcumi\csrss.exe
C:\documents and settings\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
%TEMP%\brhjfxyxmr.bat
C:\documents and settings\audiodg.exe
<SYSTEM32>\tcpipcfg\csrss.exe
C:\totalcmd\language\69ddcba757bf72f7d36c464c71f42baab150b2b9
C:\totalcmd\language\smss.exe
<SYSTEM32>\wbem\ncsi\24dbde2999530ef5fd907494bc374d663924116c
<SYSTEM32>\wbem\ncsi\wmiprvse.exe
<SYSTEM32>\dpapiprovider\6cb0b6c459d5d3455a3da700e713f2e2529862ff
<SYSTEM32>\dpapiprovider\dwm.exe
<SYSTEM32>\tcpipcfg\886983d96e3d3e31032c679b2d4ea91b6c05afef
nul

Sets the 'hidden' attribute to the following files

%TEMP%\refnetcommonrefdlldhcp.exe

Deletes the following files

%TEMP%\yh24oadzvm

Network activity

Connects to

'cd#.##scordapp.com':443
'46.##3.214.92':80

TCP

Other

'cd#.##scordapp.com':443

UDP

DNS ASK cd#.##scordapp.com

Miscellaneous

Creates and executes the following

'%TEMP%\refnetcommonrefdlldhcp.exe'
'<SYSTEM32>\api-ms-win-core-handle-l1-1-0\wininit.exe'
'<SYSTEM32>\cmd.exe' /C "%TEMP%\BrhJFxYXmr.bat"' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\dpapiprovider\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\ncsi\WmiPrvSE.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\tcpipcfg\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Documents and Settings\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\wpcumi\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\api-ms-win-core-handle-l1-1-0\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\cmd.exe' /C "%TEMP%\BrhJFxYXmr.bat"
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\ping.exe' -n 5 localhost