Trojan.Siggen32.5539

Technical Information

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\openwith.exe

Searches for registry branches where third party applications store passwords

[HKCU\SOFTWARE\FTPWare\CoreFTP\Sites]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[HKCU\Software\SimonTatham\PuTTY\Sessions]
[HKCU\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[HKCU\Software\RIT\The Bat!]
[HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%TEMP%\pkg-lpasru\d837ae88e91e889e531afc9152c7c542934e964b70ef28d08ed4e9a4f0a972f4
%HOMEPATH%\.cache\pkg\b569a41cdacffe1ceb5c92b1e2e058a0c4fa11af4348a5446377bc40e33b8711\cc.node
%TEMP%\chr602d.tmp\crashpad\settings.dat
%TEMP%\chr602d.tmp\crashpad\throttle_store.dat
%TEMP%\chr602d.tmp\crashpadmetrics-active.pma
%TEMP%\chr602d.tmp\browsermetrics\browsermetrics-690a61d4-f8c.pma
%TEMP%\chr602d.tmp\last version
%TEMP%\chr602d.tmp\ba90f6bf-b924-4c3e-bef0-bfcdd7f92ad4.tmp
%TEMP%\chr602d.tmp\ab043948-dedf-4515-b14a-b9cfdc863cbc.tmp
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690a61d8-828.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3

Deletes following files that it created itself

%TEMP%\chr602d.tmp\browsermetrics\browsermetrics-690a61d4-f8c.pma
%TEMP%\chr602d.tmp\crashpad\settings.dat
%TEMP%\chr602d.tmp\crashpad\throttle_store.dat
%TEMP%\chr602d.tmp\crashpadmetrics-active.pma
%TEMP%\chr602d.tmp\last version
%TEMP%\chr602d.tmp\local state
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690a61d8-828.pma

Moves the following files

from %TEMP%\chr602d.tmp\ba90f6bf-b924-4c3e-bef0-bfcdd7f92ad4.tmp to %TEMP%\chr602d.tmp\local state
from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Network activity

Connects to

'su#####uitymagazine.com':443
'23.##5.2.132':80
'x1.#.lencr.org':80
'e8.#.lencr.org':80
'15#.#25.64.164':443
'co####.edge.skype.com':443
'localhost':8000

TCP

HTTP GET requests

http://e8.#.lencr.org/121.crl

Other

'15#.#01.193.91':443
'su#####uitymagazine.com':443
'15#.#25.64.164':443
'co####.edge.skype.com':443

UDP

DNS ASK su#####uitymagazine.com
DNS ASK x1.#.lencr.org
DNS ASK e8.#.lencr.org
DNS ASK nt#.time.nl
DNS ASK time.google.com
DNS ASK nt##.hetzner.de
DNS ASK ti##.#acebook.com
DNS ASK gb##.ntp.se
DNS ASK nt#.#ime.in.ua
DNS ASK ti##.#loudflare.com
DNS ASK co####.edge.skype.com
'gb##.ntp.se':123
'ti##.#loudflare.com':123
'time.windows.com':123
'nt#.#ime.in.ua':123
'time.google.com':123
'nt##.hetzner.de':123
'ti##.#acebook.com':123
'nt#.time.nl':123

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\chr602D.tmp'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: '#32770' WindowName: 'TeamViewer'

Executes the following

'<SYSTEM32>\openwith.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\chr602D.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/0a956883/1feb9d65"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --explicitly-allowed-ports=8000 --disable-gpu --new-window --flag-switches-begin --flag-switches-end --do-not-de-elevate http://127.0.0.1:8000/0a956883/1feb9d65
'%ProgramFiles%\windows media player\wmpshare.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,8966039674498272451,2557884680076290115,131072 --lang=en-US --service-sandbox-type=none --explic...
'<SYSTEM32>\dllhost.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\chr602D.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/0a956883/1feb9d65"' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --explicitly-allowed-ports=8000 --disable-gpu --new-window --flag-switches-begin --flag-switches-end --do-not-de-elevate http://127.0.0.1:8000/0a956883/1feb9d65' (with hidden window)