Trojan.Siggen31.26216

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Java(TM) Platform SE Auto Updater' = '"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\jusched.exe"...
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AccessManager' = '"%APPDATA%\Mozilla\SystemExtensionsDev\AccessMgr.exe"'
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'IntelAPMClient' = '"%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ESEN\amclient.exe"'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'COMODO' = '"%CommonProgramFiles%\Microsoft Shared\ink\nb-NO\CLPSLA.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\java(tm) platform se auto updater
<SYSTEM32>\tasks\accessmanager
<SYSTEM32>\tasks\intelapmclient
<SYSTEM32>\tasks\comodo
<SYSTEM32>\tasks\d-link wireless g wua-1340

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~mbqtjfd.tmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\jusched.exe
%APPDATA%\mozilla\systemextensionsdev\~aahjoxm.tmp
%APPDATA%\mozilla\systemextensionsdev\accessmgr.exe
%CommonProgramFiles%\microsoft shared\translat\esen\~hfdmywu.tmp
%CommonProgramFiles%\microsoft shared\translat\esen\amclient.exe
%CommonProgramFiles%\microsoft shared\ink\nb-no\~ificjmx.tmp
%CommonProgramFiles%\microsoft shared\ink\nb-no\clpsla.exe
%ProgramFiles%\windows media player\~fubelga.tmp
%ProgramFiles%\windows media player\airgcfg.exe
%ProgramFiles%\mozilla firefox\defaults\pref\~qcajwyl.tmp
%ProgramFiles%\mozilla firefox\defaults\pref\ccupdmgr.exe

Deletes the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~mbqtjfd.tmp
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\jusched.exe
%APPDATA%\mozilla\systemextensionsdev\~aahjoxm.tmp
%APPDATA%\mozilla\systemextensionsdev\accessmgr.exe
%CommonProgramFiles%\microsoft shared\translat\esen\~hfdmywu.tmp
%CommonProgramFiles%\microsoft shared\translat\esen\amclient.exe
%CommonProgramFiles%\microsoft shared\ink\nb-no\~ificjmx.tmp
%CommonProgramFiles%\microsoft shared\ink\nb-no\clpsla.exe
%ProgramFiles%\windows media player\~fubelga.tmp
%ProgramFiles%\windows media player\airgcfg.exe
%ProgramFiles%\mozilla firefox\defaults\pref\~qcajwyl.tmp
%ProgramFiles%\mozilla firefox\defaults\pref\ccupdmgr.exe

Substitutes the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\jusched.exe
%APPDATA%\mozilla\systemextensionsdev\accessmgr.exe
%CommonProgramFiles%\microsoft shared\translat\esen\amclient.exe
%CommonProgramFiles%\microsoft shared\ink\nb-no\clpsla.exe
%ProgramFiles%\windows media player\airgcfg.exe
%ProgramFiles%\mozilla firefox\defaults\pref\ccupdmgr.exe
%CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\~mbqtjfd.tmp
%APPDATA%\mozilla\systemextensionsdev\~aahjoxm.tmp
%CommonProgramFiles%\microsoft shared\translat\esen\~hfdmywu.tmp
%CommonProgramFiles%\microsoft shared\ink\nb-no\~ificjmx.tmp
%ProgramFiles%\windows media player\~fubelga.tmp
%ProgramFiles%\mozilla firefox\defaults\pref\~qcajwyl.tmp

Network activity

UDP

'localhost':59804

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 8 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\jusched.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 10 /TN "AccessManager" /TR "\"%APPDATA%\Mozilla\SystemExtensionsDev\AccessMgr.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 27 /TN "IntelAPMClient" /TR "\"%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ESEN\amclient.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 12 /TN "COMODO" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\nb-NO\CLPSLA.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "D-Link Wireless G WUA-1340" /TR "\"%ProgramFiles%\Windows Media Player\AirGCFG.exe\""
'<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 8 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\jusched.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 10 /TN "AccessManager" /TR "\"%APPDATA%\Mozilla\SystemExtensionsDev\AccessMgr.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 27 /TN "IntelAPMClient" /TR "\"%CommonProgramFiles%\Microsoft Shared\TRANSLAT\ESEN\amclient.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 12 /TN "COMODO" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\nb-NO\CLPSLA.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "D-Link Wireless G WUA-1340" /TR "\"%ProgramFiles%\Windows Media Player\AirGCFG.exe\""' (with hidden window)
'<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE' (with hidden window)