Trojan.Siggen32.3171

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\WindowsAppCertificationLC] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\WindowsAppCertificationLC] 'ImagePath' = '%ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe'
[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\WinRing0x64.sys'

Creates the following services

'WindowsAppCertificationLC' %ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe
'WinRing0_1_2_0' %WINDIR%\TEMP\WinRing0x64.sys

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Event Logging

adds antivirus exclusion with following registry keys:

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%' = '00000001'

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\conhost.exe
%WINDIR%\explorer.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\app.exe
%ALLUSERSPROFILE%\windows app certification kit\certification\appcertui.exe
%WINDIR%\temp\__psscriptpolicytest_3bcrnj21.veg.ps1
%WINDIR%\temp\__psscriptpolicytest_xoqwekub.k3q.psm1
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-44-945.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-349.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-418.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-565.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-587.dump
%WINDIR%\temp\__psscriptpolicytest_ayzyzcpg.fjz.ps1
%WINDIR%\temp\__psscriptpolicytest_hdirupim.uw1.psm1
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-734.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-45-750.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-46-554.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-46-833.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-46-955.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-134.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-231.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-263.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-368.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-388.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-409.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-438.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-458.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-47-996.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-046.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-062.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-078.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-100.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-602.dump
%WINDIR%\temp\content\1572-1760-powershell.exe-16-53-48-664.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\pimpudzsjdmc.sys

Deletes following files that it created itself

%WINDIR%\temp\__psscriptpolicytest_3bcrnj21.veg.ps1
%WINDIR%\temp\__psscriptpolicytest_xoqwekub.k3q.psm1
%WINDIR%\temp\__psscriptpolicytest_ayzyzcpg.fjz.ps1
%WINDIR%\temp\__psscriptpolicytest_hdirupim.uw1.psm1

Network activity

Connects to

'po##.#ashvault.pro':443
'po####n.therpc.io':443
'po####n.drpc.org':443
'pa###bin.com':443
'45.##0.34.73':80

TCP

Other

'po##.#ashvault.pro':443
'po####n.therpc.io':443
'po####n.drpc.org':443
'pa###bin.com':443

UDP

DNS ASK po##.#ashvault.pro
DNS ASK po####n.therpc.io
DNS ASK po####n.drpc.org
DNS ASK pa###bin.com

Miscellaneous

Creates and executes the following

'%ALLUSERSPROFILE%\app.exe'
'%ALLUSERSPROFILE%\windows app certification kit\certification\appcertui.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' delete "WindowsAppCertificationLC"
'<SYSTEM32>\sc.exe' create "WindowsAppCertificationLC" binpath= "%ALLUSERSPROFILE%\Windows App Certification Kit\certification\appcertui.exe" start= "auto"
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "WindowsAppCertificationLC"
'<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "%ALLUSERSPROFILE%\app.exe"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
'%WINDIR%\explorer.exe'