Trojan.Siggen31.529

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%WINDIR%\SchCache\audiodg.exe"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%WINDIR%\SchCache\audiodg.exe"'
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%WINDIR%\SchCache\audiodg.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audiodg.exe"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audiodg.exe"'
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%WINDIR%\SchCache\audiodg.exe", "%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audi...
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"<Current directory>\firefox.exe"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"<Current directory>\firefox.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'msiexec' = '"%WINDIR%\en-US\msiexec.exe"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'msiexec' = '"%WINDIR%\en-US\msiexec.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ProgramFiles(x86)%\Reference Assemblies\csrss.exe"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ProgramFiles(x86)%\Reference Assemblies\csrss.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'

Creates or modifies the following files

<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\msiexecm
<SYSTEM32>\tasks\msiexec
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\<File name>r
<SYSTEM32>\tasks\<File name>

Modifies file system

Creates the following files

<Current directory>\08f577d5d32939
%HOMEPATH%\desktop\ddsgiqbx.log
%HOMEPATH%\desktop\ntxsrtpd.log
%TEMP%\hbpd0afikm.bat
%TEMP%\gjn6f5kgv5
%HOMEPATH%\desktop\oelhrhya.log
%HOMEPATH%\desktop\xitwaani.log
%HOMEPATH%\desktop\flcmktdp.log
%HOMEPATH%\desktop\sldzupxw.log
nul
%TEMP%\pztt4ly5b3.bat
%TEMP%\pk7p7sb7dg
%TEMP%\l5uvf3i5.out
%TEMP%\l5uvf3i5.cmdline
%TEMP%\l5uvf3i5.0.cs
%TEMP%\06a9959ff499e3c27ea4bebfbfd820476c2428f6
%WINDIR%\schcache\42af1c969fbb7b
%WINDIR%\schcache\audiodg.exe
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\42af1c969fbb7b
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\audiodg.exe
<Current directory>\0fc223bdacedc3
<Current directory>\firefox.exe
%WINDIR%\en-us\133006b48fb54b
%WINDIR%\en-us\msiexec.exe
%ProgramFiles(x86)%\reference assemblies\886983d96e3d3e
%ProgramFiles(x86)%\reference assemblies\csrss.exe
%HOMEPATH%\desktop\bswfiyww.log
%HOMEPATH%\desktop\tuyqyowp.log

Deletes the following files

%TEMP%\l5uvf3i5.0.cs
%TEMP%\l5uvf3i5.cmdline
%TEMP%\l5uvf3i5.out
%TEMP%\pk7p7sb7dg
%TEMP%\gjn6f5kgv5

Moves the following files

from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe

Network activity

UDP

DNS ASK 90####cm.nyashk.ru
'localhost':123

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\audiodg.exe'

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'%WINDIR%\SchCache\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'%WINDIR%\en-US\msiexec.exe'" /rl HIGHEST /f
'<SYSTEM32>\cmd.exe' /C "%TEMP%\hBPD0AFikm.bat"
'<SYSTEM32>\ping.exe' -n 10 localhost
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\cmd.exe' /C "%TEMP%\pZTT4ly5B3.bat"
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 6 /tr "'<Full path to file>'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 8 /tr "'<Full path to file>'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Reference Assemblies\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Reference Assemblies\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Reference Assemblies\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'<Current directory>\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\audiodg.exe'" /f
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l5uvf3i5.cmdline"
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'%WINDIR%\SchCache\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%WINDIR%\SchCache\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "msiexecm" /sc MINUTE /mo 11 /tr "'%WINDIR%\en-US\msiexec.exe'" /f
'<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
'<SYSTEM32>\schtasks.exe' /create /tn "msiexecm" /sc MINUTE /mo 10 /tr "'%WINDIR%\en-US\msiexec.exe'" /rl HIGHEST /f
'<SYSTEM32>\cmd.exe' /C "%TEMP%\hBPD0AFikm.bat"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\l5uvf3i5.cmdline"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "%TEMP%\pZTT4ly5B3.bat"' (with hidden window)