Trojan.Siggen31.37272

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\wsc_proxy] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\wsc_proxy] 'ImagePath' = '"%ProgramFiles%\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserver /wsc_name:"Avast Antivirus'

Creates the following services

'wsc_proxy' %ProgramFiles%\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserver /wsc_name:"Avast Antiviru

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\data.bin
%TEMP%\7zipsfx.000\data1.bin
%TEMP%\7zipsfx.000\data2.bin
%TEMP%\7zipsfx.000\data3.bin
%TEMP%\7zipsfx.000\data4.bin
%TEMP%\7zipsfx.000\setup.cmd
%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\7z
%TEMP%\7zipsfx.000\data2.bin.z
%ProgramFiles%\avast software\avast\powrprof.dll
%ProgramFiles%\avast software\avast\powrprof.exe
%ProgramFiles%\avast software\avast\wsc.dll
%ProgramFiles%\avast software\avast\wsc_proxy.exe
%ProgramFiles%\avast software\avast\ctx.bin
%ALLUSERSPROFILE%\avast software\avast\log\wsc.log.tmp.b36b66df-b37e-44b0-bad2-88bf35e679bb
%ALLUSERSPROFILE%\avast software\avast\log\wsc.log
%TEMP%\7zipsfx.000\data4.bin.z
%TEMP%\7zipsfx.000\task.ps1
%TEMP%\mnmrw0nj.0.cs
%TEMP%\mnmrw0nj.cmdline
%TEMP%\mnmrw0nj.out
%TEMP%\csc8a16.tmp
%TEMP%\res8a36.tmp
%TEMP%\mnmrw0nj.dll
%ALLUSERSPROFILE%\microsoft\network\time.txt

Deletes the following files

Moves the following files

from %TEMP%\7zipsfx.000\data2.bin.z to %TEMP%\7zipsfx.000\data2.bin
from %ALLUSERSPROFILE%\avast software\avast\log\wsc.log.tmp.b36b66df-b37e-44b0-bad2-88bf35e679bb to %ALLUSERSPROFILE%\avast software\avast\log\wsc.log
from %TEMP%\7zipsfx.000\data4.bin.z to %TEMP%\7zipsfx.000\data4.bin

Substitutes the following files

Deletes itself.

Network activity

Connects to

UDP

Miscellaneous

Creates and executes the following

'%TEMP%\7zipsfx.000\7za.exe' x -y -p18874 -o"%ProgramFiles%\Avast Software\Avast" data2.bin
'%ProgramFiles%\avast software\avast\powrprof.exe'
'%ProgramFiles%\avast software\avast\wsc_proxy.exe' /runassvc /rpcserver /wsc_name:"Avast Antivirus
'%TEMP%\7zipsfx.000\7za.exe' x -y -p18874 data4.bin

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\setup.cmd" "
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c iex ([io.file]::ReadAllText($env:0))
'%WINDIR%\syswow64\reg.exe' query HKEY_USERS\S-1-5-19
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo("
'%WINDIR%\syswow64\find.exe' "done"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c "iex (Get-Content -Path .\task.ps1 | Out-String)"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mnmrw0nj.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8A36.tmp" "%TEMP%\CSC8A16.tmp"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\setup.cmd" "' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mnmrw0nj.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8A36.tmp" "%TEMP%\CSC8A16.tmp"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)