Trojan.PWS.Siggen3.29799

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\hljknskoq.readme.txt
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pushkin.jpg
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\4f0bf7ff71f28.jpg

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\hljknskoq.ico
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\0001000a.wid
C:\kms\hljknskoq.readme.txt
%HOMEPATH%\contacts\hljknskoq.readme.txt
%HOMEPATH%\desktop\hljknskoq.readme.txt
%HOMEPATH%\documents\hljknskoq.readme.txt
%HOMEPATH%\downloads\hljknskoq.readme.txt
%HOMEPATH%\favorites\links\hljknskoq.readme.txt
%HOMEPATH%\favorites\links for united states\hljknskoq.readme.txt
%HOMEPATH%\favorites\microsoft websites\hljknskoq.readme.txt
%HOMEPATH%\favorites\msn websites\hljknskoq.readme.txt
%HOMEPATH%\favorites\windows live\hljknskoq.readme.txt
%HOMEPATH%\favorites\hljknskoq.readme.txt
%HOMEPATH%\links\hljknskoq.readme.txt
%HOMEPATH%\music\hljknskoq.readme.txt
%HOMEPATH%\pictures\hljknskoq.readme.txt
%HOMEPATH%\saved games\hljknskoq.readme.txt
%HOMEPATH%\searches\hljknskoq.readme.txt
%HOMEPATH%\videos\hljknskoq.readme.txt
%HOMEPATH%\hljknskoq.readme.txt
C:\users\hljknskoq.readme.txt
<Current directory>\hljknskoq.readme.txt
D:\hljknskoq.readme.txt
C:\hljknskoq.readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\0001000a.ci
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\0001000a.dir

Modifies the following files

C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
%HOMEPATH%\favorites\windows live\xacqep5.hljknskoq
%HOMEPATH%\favorites\windows live\uswi8by.hljknskoq
%HOMEPATH%\favorites\windows live\jfc3a2z.hljknskoq
%HOMEPATH%\favorites\windows live\wjxmvqh.hljknskoq
D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
%HOMEPATH%\searches\fu5zxxn.hljknskoq
%HOMEPATH%\searches\ewsd6bw.hljknskoq
<Drive name for removable media>:\y1cd36y.hljknskoq
<Drive name for removable media>:\qc33ezv.hljknskoq
<Drive name for removable media>:\lqeqqtj.hljknskoq
<Drive name for removable media>:\gys31ip.hljknskoq
<Drive name for removable media>:\t2onvjj.hljknskoq
<Drive name for removable media>:\lcfxnqm.hljknskoq
<Drive name for removable media>:\w0ni7rz.hljknskoq
<Drive name for removable media>:\qfqj6to.hljknskoq
<Drive name for removable media>:\ohwhyu3.hljknskoq
<Drive name for removable media>:\dch1hea.hljknskoq
<Drive name for removable media>:\zuxutz3.hljknskoq
<Drive name for removable media>:\xw0qflp.hljknskoq
<Drive name for removable media>:\z9kicrz.hljknskoq
<Drive name for removable media>:\ohymyny.hljknskoq
<Drive name for removable media>:\8ycnzp3.hljknskoq
<Drive name for removable media>:\ty3ee6i.hljknskoq
<Drive name for removable media>:\adotgmg.hljknskoq
<Drive name for removable media>:\q03jgdq.hljknskoq
<Drive name for removable media>:\jvyyx78.hljknskoq
D:\shsf0rd.hljknskoq
%HOMEPATH%\favorites\msn websites\mq8elzx.hljknskoq
%HOMEPATH%\favorites\msn websites\vuihftf.hljknskoq

Modifies multiple files.

Substitutes the following files

%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\MSS.log

Miscellaneous

Executes the following

'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\searchfilterhost.exe' 0 508 512 520 65536 516