Trojan.Siggen31.26918

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'fghfbbc' = '"C:\hcghfce\AutoIt3.exe" C:\hcghfce\fghfbbc.a3x'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe

Modifies file system

Creates the following files

%TEMP%\is-8d3td.tmp\<File name>.tmp
nul
%ALLUSERSPROFILE%\xgakfiqbo.a3x
%APPDATA%\strong\is-l5ddi.tmp
%APPDATA%\strong\is-7npb1.tmp
%APPDATA%\strong\is-cuf6p.tmp
%TEMP%\is-f7n6d.tmp\is-l7thv.tmp
%TEMP%\is-f7n6d.tmp\is-op778.tmp
%TEMP%\is-f7n6d.tmp\is-dngj5.tmp
%TEMP%\is-f7n6d.tmp\is-4oalp.tmp
%TEMP%\is-f7n6d.tmp\is-oj8sp.tmp
%TEMP%\is-f7n6d.tmp\is-og48d.tmp
%TEMP%\is-f7n6d.tmp\is-suvj6.tmp
%TEMP%\is-f7n6d.tmp\_isetup\_setup64.tmp
%TEMP%\is-6e0f9.tmp\<File name>.tmp
%TEMP%\is-61qok.tmp\_isetup\_setup64.tmp
C:\hcghfce\fghfbbc.a3x
C:\hcghfce\autoit3.exe

Deletes the following files

%TEMP%\is-61qok.tmp\_isetup\_setup64.tmp
%TEMP%\is-8d3td.tmp\<File name>.tmp
%TEMP%\is-f7n6d.tmp\microsoft.extensions.dependencyinjection.abstractions.dll
%TEMP%\is-f7n6d.tmp\microsoft.extensions.logging.abstractions.dll
%TEMP%\is-f7n6d.tmp\microsoft.win32.taskscheduler.dll
%TEMP%\is-f7n6d.tmp\nager.country.dll
%TEMP%\is-f7n6d.tmp\netlimiter.dll
%TEMP%\is-f7n6d.tmp\netlimiter.runtime.dll
%TEMP%\is-f7n6d.tmp\netstandard.dll
%TEMP%\is-f7n6d.tmp\_isetup\_setup64.tmp
%TEMP%\is-6e0f9.tmp\<File name>.tmp
%ALLUSERSPROFILE%\xgakfiqbo.a3x

Moves the following files

from %TEMP%\is-f7n6d.tmp\is-suvj6.tmp to %TEMP%\is-f7n6d.tmp\microsoft.extensions.dependencyinjection.abstractions.dll
from %TEMP%\is-f7n6d.tmp\is-og48d.tmp to %TEMP%\is-f7n6d.tmp\microsoft.extensions.logging.abstractions.dll
from %TEMP%\is-f7n6d.tmp\is-oj8sp.tmp to %TEMP%\is-f7n6d.tmp\microsoft.win32.taskscheduler.dll
from %TEMP%\is-f7n6d.tmp\is-4oalp.tmp to %TEMP%\is-f7n6d.tmp\nager.country.dll
from %TEMP%\is-f7n6d.tmp\is-dngj5.tmp to %TEMP%\is-f7n6d.tmp\netlimiter.dll
from %TEMP%\is-f7n6d.tmp\is-op778.tmp to %TEMP%\is-f7n6d.tmp\netlimiter.runtime.dll
from %TEMP%\is-f7n6d.tmp\is-l7thv.tmp to %TEMP%\is-f7n6d.tmp\netstandard.dll
from %APPDATA%\strong\is-cuf6p.tmp to %APPDATA%\strong\electronics.exe
from %APPDATA%\strong\is-7npb1.tmp to %APPDATA%\strong\nonaseptically.eml
from %APPDATA%\strong\is-l5ddi.tmp to %APPDATA%\strong\nonaseptically.sldx

Miscellaneous

Creates and executes the following

'%TEMP%\is-8d3td.tmp\<File name>.tmp' /SL5="$6024C,2844776,845824,<Full path to file>"
'%TEMP%\is-6e0f9.tmp\<File name>.tmp' /SL5="$9016A,2844776,845824,<Full path to file>" /VERYSILENT
'%APPDATA%\strong\electronics.exe' "%APPDATA%\Strong\\nonaseptically.eml"
'%APPDATA%\strong\electronics.exe' %ALLUSERSPROFILE%\\XgAkfIqbO.a3x

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
'<SYSTEM32>\find.exe' /I "nswscsvc.exe"
'<SYSTEM32>\find.exe' /I "avgui.exe"
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
'<SYSTEM32>\find.exe' /I "sophoshealth.exe"
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
'%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && electronics.exe %ALLUSERSPROFILE%\\XgAkfIqbO.a3x && del %ALLUSERSPROFILE%\\XgAkfIqbO.a3x
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
'%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
'<SYSTEM32>\find.exe' /I "avastui.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
'<SYSTEM32>\find.exe' /I "wrsa.exe"
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
'<SYSTEM32>\find.exe' /I "opssvc.exe"
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
'%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && electronics.exe %ALLUSERSPROFILE%\\XgAkfIqbO.a3x && del %ALLUSERSPROFILE%\\XgAkfIqbO.a3x' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"' (with hidden window)