Trojan.Siggen32.5001

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

%TEMP%\_mei37562\vcruntime140.dll
%TEMP%\_mei37562\_bz2.pyd
%TEMP%\_mei37562\_ctypes.pyd
%TEMP%\_mei37562\_decimal.pyd
%TEMP%\_mei37562\_hashlib.pyd
%TEMP%\_mei37562\_lzma.pyd
%TEMP%\_mei37562\_socket.pyd
%TEMP%\_mei37562\_ssl.pyd
%TEMP%\_mei37562\_uuid.pyd
%TEMP%\_mei37562\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei37562\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei37562\base_library.zip
%TEMP%\_mei37562\get-pip.py
%TEMP%\_mei37562\libcrypto-1_1.dll
%TEMP%\_mei37562\libffi-7.dll
%TEMP%\_mei37562\libssl-1_1.dll
%TEMP%\_mei37562\lief\_lief.pyd
%TEMP%\_mei37562\psutil\_psutil_windows.pyd
%TEMP%\_mei37562\python3.dll
%TEMP%\_mei37562\python310.dll
%TEMP%\_mei37562\select.pyd
%TEMP%\_mei37562\ucrtbase.dll
%TEMP%\_mei37562\unicodedata.pyd
%TEMP%\_mei37562\wrapper.zip
%TEMP%\p7m1vj2f
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
%TEMP%\_mei37562\wrapper\main.py
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690661e9-1770.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690661f0-1644.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Deletes following files that it created itself

%TEMP%\p7m1vj2f
%TEMP%\_mei37562\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei37562\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei37562\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei37562\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei37562\base_library.zip
%TEMP%\_mei37562\get-pip.py
%TEMP%\_mei37562\libcrypto-1_1.dll
%TEMP%\_mei37562\libffi-7.dll
%TEMP%\_mei37562\libssl-1_1.dll
%TEMP%\_mei37562\lief\_lief.pyd
%TEMP%\_mei37562\psutil\_psutil_windows.pyd
%TEMP%\_mei37562\python3.dll
%TEMP%\_mei37562\python310.dll
%TEMP%\_mei37562\select.pyd
%TEMP%\_mei37562\ucrtbase.dll
%TEMP%\_mei37562\unicodedata.pyd
%TEMP%\_mei37562\vcruntime140.dll
%TEMP%\_mei37562\wrapper\main.py
%TEMP%\_mei37562\wrapper.zip
%TEMP%\_mei37562\_bz2.pyd
%TEMP%\_mei37562\_ctypes.pyd
%TEMP%\_mei37562\_decimal.pyd
%TEMP%\_mei37562\_hashlib.pyd
%TEMP%\_mei37562\_lzma.pyd
%TEMP%\_mei37562\_socket.pyd
%TEMP%\_mei37562\_ssl.pyd
%TEMP%\_mei37562\_uuid.pyd
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690661e9-1770.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690661f0-1644.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

UDP

DNS ASK py##on.org
DNS ASK co####.edge.skype.com
DNS ASK yo##ube.com
DNS ASK google.com
DNS ASK fi#####.###tings.services.mozilla.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Restarts the analyzed sample

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.youtube.com/watch?v=Llximmz38iY
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=Llximmz38iY
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4098510997156304329,4817747396093412823,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=Llximmz38iY' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней