Trojan.Siggen31.55614

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\ssmypics.scr'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)
Windows Security Center

modifies the following system settings:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'

Modifies settings of Windows Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\aut6b87.tmp
%WINDIR%\temp\kbnumlock.exe
%TEMP%\aut6b97.tmp
%WINDIR%\temp\deldrivers.exe
%TEMP%\aut6bd7.tmp
%WINDIR%\temp\regopt.reg
%TEMP%\aut6bf7.tmp
%WINDIR%\temp\run2.bat
%WINDIR%\inf\dc1-controller.pnf
%WINDIR%\inf\remoteposdrv.pnf
%WINDIR%\inf\digitalmediadevice.pnf
%WINDIR%\inf\c_sslaccel.pnf
%WINDIR%\inf\c_magneticstripereader.pnf
%WINDIR%\inf\c_fssystemrecovery.pnf
%WINDIR%\inf\c_fscontentscreener.pnf
%WINDIR%\inf\c_mcx.pnf
%WINDIR%\inf\c_fsreplication.pnf
%WINDIR%\inf\c_diskdrive.pnf
%WINDIR%\inf\c_display.pnf
%WINDIR%\inf\c_media.pnf
%WINDIR%\inf\c_monitor.pnf
%WINDIR%\inf\c_linedisplay.pnf
%WINDIR%\inf\c_processor.pnf
%WINDIR%\inf\c_smrdisk.pnf
%WINDIR%\inf\c_scmdisk.pnf
%WINDIR%\inf\c_smrvolume.pnf
%WINDIR%\inf\c_scmvolume.pnf
%WINDIR%\inf\c_proximity.pnf
%WINDIR%\inf\c_apo.pnf
%WINDIR%\inf\oposdrv.pnf
%WINDIR%\inf\c_swcomponent.pnf
%WINDIR%\inf\c_fssystem.pnf
%WINDIR%\inf\perceptionsimulationsixdof.pnf
%WINDIR%\inf\c_fsphysicalquotamgmt.pnf
%WINDIR%\inf\c_volume.pnf
%WINDIR%\inf\c_fscontinuousbackup.pnf
%WINDIR%\inf\c_cashdrawer.pnf
%WINDIR%\inf\c_fsquotamgmt.pnf
%WINDIR%\inf\c_netdriver.pnf
%WINDIR%\inf\ts_generic.pnf
%WINDIR%\inf\c_fscopyprotection.pnf
%WINDIR%\inf\rawsilo.pnf
%WINDIR%\inf\c_fsencryption.pnf
%WINDIR%\inf\c_fsantivirus.pnf
%WINDIR%\inf\rdcameradriver.pnf
%WINDIR%\inf\c_fsactivitymonitor.pnf
%WINDIR%\inf\audioendpoint.pnf
%WINDIR%\inf\c_barcodescanner.pnf
%WINDIR%\inf\wsdprint.pnf
%WINDIR%\inf\c_receiptprinter.pnf
%WINDIR%\inf\c_camera.pnf
%WINDIR%\inf\c_fscfsmetadataserver.pnf
%WINDIR%\inf\c_fssecurityenhancer.pnf
%WINDIR%\inf\miradisp.pnf
%WINDIR%\inf\c_fshsm.pnf
%WINDIR%\inf\c_holographic.pnf
%WINDIR%\inf\xusb22.pnf
%WINDIR%\inf\c_extension.pnf
%WINDIR%\inf\c_fsinfrastructure.pnf
%WINDIR%\inf\c_ucm.pnf
%WINDIR%\inf\c_computeaccelerator.pnf
%WINDIR%\inf\c_firmware.pnf
%WINDIR%\inf\c_fscompression.pnf
%WINDIR%\inf\c_fsvirtualization.pnf
%WINDIR%\inf\c_fsopenfilebackup.pnf
%WINDIR%\inf\c_fsundelete.pnf
%WINDIR%\inf\display.pnf

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%WINDIR%\temp\kbnumlock.exe'

Executes the following

'%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\Temp\RegOpt.reg
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Temp\run2.bat
'%WINDIR%\syswow64\regsvr32.exe' /u /s igfxpph.dll
'%WINDIR%\syswow64\regsvr32.exe' /S <SYSTEM32>\Quartz.dll
'%WINDIR%\syswow64\regsvr32.exe' /S <SYSTEM32>\Proppage.dll
'%WINDIR%\syswow64\regsvr32.exe' /S <SYSTEM32>\directSpy.dll
'%WINDIR%\syswow64\regsvr32.exe' /S <SYSTEM32>\hidserv.dll
'%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f
'%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f
'%WINDIR%\syswow64\net.exe' user /delete HelpAssistant
'%WINDIR%\syswow64\net1.exe' user /delete HelpAssistant
'%WINDIR%\syswow64\net.exe' share c$ /delete
'%WINDIR%\syswow64\net1.exe' share c$ /delete
'%WINDIR%\syswow64\net.exe' share d$ /delete
'%WINDIR%\syswow64\net1.exe' share d$ /delete
'%WINDIR%\syswow64\net.exe' share e$ /delete
'%WINDIR%\syswow64\net1.exe' share e$ /delete
'%WINDIR%\syswow64\net.exe' share f$ /delete
'%WINDIR%\syswow64\net1.exe' share f$ /delete
'%WINDIR%\syswow64\net.exe' share g$ /delete
'%WINDIR%\syswow64\net1.exe' share g$ /delete
'%WINDIR%\syswow64\net.exe' share h$ /delete
'%WINDIR%\syswow64\net1.exe' share h$ /delete
'%WINDIR%\syswow64\net.exe' share i$ /delete
'%WINDIR%\syswow64\net1.exe' share i$ /delete
'%WINDIR%\syswow64\net.exe' share j$ /delete
'%WINDIR%\syswow64\net1.exe' share j$ /delete
'%WINDIR%\syswow64\net.exe' share ipc$ /delete
'%WINDIR%\syswow64\net1.exe' share ipc$ /delete
'%WINDIR%\syswow64\net.exe' share admin$ /dele
'%WINDIR%\syswow64\net1.exe' share admin$ /dele
'%WINDIR%\syswow64\net.exe' share <SYSTEM32>\spool\drivers /del
'%WINDIR%\syswow64\net1.exe' share <SYSTEM32>\spool\drivers /del
'%WINDIR%\syswow64\mmc.exe' "<SYSTEM32>\devmgmt.msc"
'<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Temp\run2.bat' (with hidden window)