Trojan.Siggen31.38263

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\services\ThreadDesktopFirewall\Parameters] 'ServiceDll' = '<SYSTEM32>\ThreadDesktopFirewall.dll'
[HKLM\System\CurrentControlSet\Services\ThreadDesktopFirewall] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ThreadDesktopFirewall] 'ImagePath' = '<SYSTEM32>\svchost.exe -k ThreadDesktopFirewall'
[HKLM\SYSTEM\CurrentControlSet\services\KernelMonitorTerminal\Parameters] 'ServiceDll' = '<SYSTEM32>\KernelMonitorTerminal.dll'
[HKLM\System\CurrentControlSet\Services\KernelMonitorTerminal] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\KernelMonitorTerminal] 'ImagePath' = '<SYSTEM32>\svchost.exe -k KernelMonitorTerminal'
[HKLM\SYSTEM\CurrentControlSet\services\RemotePrinterExplorer\Parameters] 'ServiceDll' = '<SYSTEM32>\RemotePrinterExplorer.dll'
[HKLM\System\CurrentControlSet\Services\RemotePrinterExplorer] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\RemotePrinterExplorer] 'ImagePath' = '<SYSTEM32>\svchost.exe -k RemotePrinterExplorer'
[HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '<SYSTEM32>\WinRing0x64.sys'

Creates the following services

'ThreadDesktopFirewall' <SYSTEM32>\svchost.exe -k ThreadDesktopFirewall
'KernelMonitorTerminal' <SYSTEM32>\svchost.exe -k KernelMonitorTerminal
'RemotePrinterExplorer' <SYSTEM32>\svchost.exe -k RemotePrinterExplorer
'WinRing0_1_2_0' <SYSTEM32>\WinRing0x64.sys

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Update

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<SYSTEM32>"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\TEMP\"

Modifies file system

Creates the following files

%TEMP%\io.github.huskydg.magisk.exe
%TEMP%\26.4-kitsune.apk
%TEMP%\0.6.apk
%TEMP%\main\file.bin
%TEMP%\main\killduplicate.cmd
%TEMP%\main\main.bat
%TEMP%\main\7z.dll
%TEMP%\main\7z.exe
%TEMP%\main\extracted\file_2.zip
%TEMP%\main\extracted\antiav.data
%TEMP%\main\extracted\file_1.zip
%TEMP%\main\extracted\installer.exe
<SYSTEM32>\threaddesktopfirewall.dll
%WINDIR%\rrbnxmoju.bin
<SYSTEM32>\kernelmonitorterminal.dll
<SYSTEM32>\remoteprinterexplorer.dll
%WINDIR%\temp\advapi32.dll
<SYSTEM32>\winring0x64.sys

Sets the 'hidden' attribute to the following files

%TEMP%\main\killduplicate.cmd
%TEMP%\main\installer.exe

Deletes the following files

%TEMP%\main\extracted\file_1.zip
%TEMP%\main\extracted\file_2.zip

Moves the following files

from %TEMP%\main\file.bin to %TEMP%\main\file.zip
from %TEMP%\main\extracted\installer.exe to %TEMP%\main\installer.exe

Substitutes the following files

%TEMP%\main\file.bin

Network activity

Connects to

'gr###fy.link':443
'po##.#ashvault.pro':443

TCP

Other

'gr###fy.link':443
'po##.#ashvault.pro':443

UDP

DNS ASK gr###fy.link
DNS ASK po##.#ashvault.pro

Miscellaneous

Creates and executes the following

'%TEMP%\io.github.huskydg.magisk.exe'
'%TEMP%\main\7z.exe' e file.zip -p3054016038410325991212730094 -oextracted
'%TEMP%\main\7z.exe' e extracted/file_2.zip -oextracted
'%TEMP%\main\7z.exe' e extracted/file_1.zip -oextracted
'%TEMP%\main\installer.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"
'<SYSTEM32>\mode.com' 65,10
'<SYSTEM32>\attrib.exe' +H "Installer.exe"
'<SYSTEM32>\svchost.exe' -k ThreadDesktopFirewall
'<SYSTEM32>\cmd.exe' /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<SYSTEM32>"
'<SYSTEM32>\cmd.exe' /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\TEMP\"
'<SYSTEM32>\cmd.exe' /c sc config "WaaSMedicSvc" start= disabled
'<SYSTEM32>\sc.exe' config "WaaSMedicSvc" start= disabled
'<SYSTEM32>\cmd.exe' /c sc config "UsoSvc" start= disabled
'<SYSTEM32>\sc.exe' config "UsoSvc" start= disabled
'<SYSTEM32>\cmd.exe' /c sc config "BITS" start= disabled
'<SYSTEM32>\sc.exe' config "BITS" start= disabled
'<SYSTEM32>\cmd.exe' /c sc config "wuauserv" start= disabled
'<SYSTEM32>\sc.exe' config "wuauserv" start= disabled
'<SYSTEM32>\svchost.exe' -k KernelMonitorTerminal
'<SYSTEM32>\cmd.exe' /c sc config "dosvc" start= disabled
'<SYSTEM32>\sc.exe' config "dosvc" start= disabled
'<SYSTEM32>\cmd.exe' /c sc config "TrustedInstaller" start= disabled
'<SYSTEM32>\sc.exe' config "TrustedInstaller" start= disabled
'<SYSTEM32>\svchost.exe' -k RemotePrinterExplorer
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<SYSTEM32>"' (with hidden window)