Trojan.Siggen31.55607

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe

Malicious functions

Launches a large number of processes

Modifies file system

Creates the following files

%TEMP%\_mei40482\vcruntime140.dll
%TEMP%\_mei40482\_brotli.cp312-win_amd64.pyd
%TEMP%\_mei40482\_bz2.pyd
%TEMP%\_mei40482\_cffi_backend.cp312-win_amd64.pyd
%TEMP%\_mei40482\_decimal.pyd
%TEMP%\_mei40482\_hashlib.pyd
%TEMP%\_mei40482\_lzma.pyd
%TEMP%\_mei40482\_queue.pyd
%TEMP%\_mei40482\_socket.pyd
%TEMP%\_mei40482\_ssl.pyd
%TEMP%\_mei40482\base_library.zip
%TEMP%\_mei40482\bcrypt\_bcrypt.pyd
%TEMP%\_mei40482\certifi\cacert.pem
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\installer
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\metadata
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\record
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\wheel
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\license_files\license
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\license_files\license.apache
%TEMP%\_mei40482\cryptography-43.0.0.dist-info\license_files\license.bsd
%TEMP%\_mei40482\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei40482\libcrypto-3.dll
%TEMP%\_mei40482\libssl-3.dll
%TEMP%\_mei40482\python3.dll
%TEMP%\_mei40482\python312.dll
%TEMP%\_mei40482\select.pyd
%TEMP%\_mei40482\unicodedata.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff88-e70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff88-e94.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff88-3c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff8a-dd4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff8d-220.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff92-e90.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ff94-cf0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ffc7-f48.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ffcc-d88.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ffd4-10a4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ffd7-be4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68c2ffd7-12ac.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version

Network activity

Connects to

'di##ord.com':443

TCP

Other

'di##ord.com':443

UDP

DNS ASK di##ord.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: 'WordPadClass' WindowName: ''

Restarts the analyzed sample

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
'<SYSTEM32>\cmd.exe' /c "control"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.windows93.net/
'<SYSTEM32>\cmd.exe' /c "write"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://en.wikipedia.org/wiki/Special:Random
'<SYSTEM32>\cmd.exe' /c "dxdiag"
'<SYSTEM32>\control.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://zoomquilt.org/
'<SYSTEM32>\cmd.exe' /c "mspaint"
'<SYSTEM32>\cmd.exe' /c "cmd"
'<SYSTEM32>\cmd.exe' /c "notepad"
'<SYSTEM32>\write.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://heeeeeeeey.com/
'<SYSTEM32>\dxdiag.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://pointerpointer.com/
'<SYSTEM32>\mspaint.exe'
'%ProgramFiles%\windows nt\accessories\wordpad.exe'
'<SYSTEM32>\notepad.exe'
'<SYSTEM32>\cmd.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.windows93.net/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://cat-bounce.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://heeeeeeeey.com/
'<SYSTEM32>\cmd.exe' /c "taskmgr"
'<SYSTEM32>\taskmgr.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://corndog.io/
'<SYSTEM32>\cmd.exe' /c "explorer"
'<SYSTEM32>\cmd.exe' /c "regedit"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://thispersondoesnotexist.com/
'<SYSTEM32>\cmd.exe' /c "control"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "write"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "dxdiag"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "mspaint"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "cmd"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "notepad"' (with hidden window)
'%ProgramFiles%\windows nt\accessories\wordpad.exe' ' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.windows93.net/' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://heeeeeeeey.com/' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "taskmgr"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "explorer"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "regedit"' (with hidden window)