Trojan.Siggen32.5301

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\INF\.NETFramework\CORPerfMonSymbols.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\launch adobe ccxprocess
<SYSTEM32>\tasks\xccprocess
<SYSTEM32>\tasks\microsoft\windows\windows update listner
<SYSTEM32>\tasks\microsoft\microsoft launcher

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'ImagePath' = '%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe'
[HKLM\SYSTEM\CurrentControlSet\Services\aswArPot.sys] 'ImagePath' = '%WINDIR%\temp\aswArPot.bin'

Creates the following services

'System Diagnostics Host' %WINDIR%\SysWOW64\SystemDiagnosticsHost.exe
'aswArPot.sys' %WINDIR%\temp\aswArPot.bin

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes

Launches a large number of processes

Modifies file system

Creates the following files

%TEMP%\tmp8c23.tmp.exe
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
%WINDIR%\media\mppr.exe
%WINDIR%\inputmethod\shared\rc_connectedaccount.exe
%TEMP%\ihps3guh\ihps3guh.0.cs
%TEMP%\ihps3guh\ihps3guh.cmdline
%TEMP%\ihps3guh\ihps3guh.out
%TEMP%\csc337b50c600c43288cc513ee9e7c18f8.tmp
%TEMP%\resc8bf.tmp
%TEMP%\tmpc3be.tmp
%WINDIR%\inf\.netframework\corperfmonsymbols.exe
%TEMP%\ftlpso1h\ftlpso1h.0.cs
%TEMP%\ftlpso1h\ftlpso1h.cmdline
%TEMP%\ftlpso1h\ftlpso1h.out
%TEMP%\csc47ef5f71cf4944839654b90ff35a5c1.tmp
%TEMP%\resceab.tmp
%TEMP%\tmpca95.tmp
%WINDIR%\inf\usbhub\usbperfsym.exe
%WINDIR%\syswow64\systemdiagnosticshost.exe
%WINDIR%\media\msldriver.dll
%WINDIR%\temp\aswarpot.bin
C:\recovery\oem\resetconfig.xml
C:\recovery\oem\73147bc4-ce14-4ad2-8b72-0e1c4bebfc2b.bat
C:\recovery\oem\f803d4a3-3193-40b6-b362-4df0a0d5f18d.exe
%TEMP%\wmlkr2jl.jnl.bat
nul
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\tmp8c23.tmp.exe.log

Sets the 'hidden' attribute to the following files

%WINDIR%\media\mppr.exe
%WINDIR%\inputmethod\shared\rc_connectedaccount.exe
%WINDIR%\inf\.netframework\corperfmonsymbols.exe
%WINDIR%\inf\usbhub\usbperfsym.exe
%WINDIR%\syswow64\systemdiagnosticshost.exe
%WINDIR%\media\msldriver.dll

Deletes following files that it created itself

%TEMP%\resc8bf.tmp
%TEMP%\csc337b50c600c43288cc513ee9e7c18f8.tmp
%TEMP%\ihps3guh\ihps3guh.cmdline
%TEMP%\ihps3guh\ihps3guh.out
%TEMP%\ihps3guh\ihps3guh.0.cs
%TEMP%\tmpc3be.tmp
%TEMP%\resceab.tmp
%TEMP%\csc47ef5f71cf4944839654b90ff35a5c1.tmp
%TEMP%\ftlpso1h\ftlpso1h.0.cs
%TEMP%\ftlpso1h\ftlpso1h.cmdline
%TEMP%\ftlpso1h\ftlpso1h.out
%TEMP%\tmpca95.tmp

Miscellaneous

Searches for the following windows

ClassName: 'MouseZ' WindowName: 'Magellan MSWHEEL'

Creates and executes the following

'%TEMP%\tmp8c23.tmp.exe'
'%WINDIR%\syswow64\systemdiagnosticshost.exe'
'%WINDIR%\media\mppr.exe'

Executes the following

'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ihps3guh\ihps3guh.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8BF.tmp" "%TEMP%\CSC337B50C600C43288CC513EE9E7C18F8.TMP"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ftlpso1h\ftlpso1h.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCEAB.tmp" "%TEMP%\CSC47EF5F71CF4944839654B90FF35A5C1.TMP"
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon & exit
'<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
'<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "XCCProcess" /tr "%WINDIR%\INF\usbhub\usbperfsym.exe" /sc onlogon
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit
'<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe"
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
'<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe"
'<SYSTEM32>\cmd.exe' /c sc query "System Diagnostics Host" & exit
'<SYSTEM32>\sc.exe' query "System Diagnostics Host"
'<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
'<SYSTEM32>\sc.exe' create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
'<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
'<SYSTEM32>\sc.exe' description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
'<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit
'<SYSTEM32>\sc.exe' start "System Diagnostics Host"
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name="XCCProcess" & exit
'<SYSTEM32>\netsh.exe' advfirewall firewall show rule name="XCCProcess"
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit
'<SYSTEM32>\cmd.exe' /c sc.exe create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel & exit
'<SYSTEM32>\sc.exe' create aswArPot.sys binPath= %WINDIR%\temp\aswArPot.bin type= kernel
'<SYSTEM32>\cmd.exe' /c sc.exe start aswArPot.sys & exit
'<SYSTEM32>\sc.exe' start aswArPot.sys
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\wmlkr2jl.jnl.bat""
'<SYSTEM32>\timeout.exe' 8
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ihps3guh\ihps3guh.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8BF.tmp" "%TEMP%\CSC337B50C600C43288CC513EE9E7C18F8.TMP"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ftlpso1h\ftlpso1h.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCEAB.tmp" "%TEMP%\CSC47EF5F71CF4944839654B90FF35A5C1.TMP"' (with hidden window)