Trojan.Siggen32.5749

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kxetray' = '%APPDATA%\kxetray.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\windows defender scheduled scan 149.8.1396.58 {856.7.7814.57 s-1-5-21-1000-1fd547f7}
%APPDATA%\microsoft\windows\start menu\programs\startup\kxetray.exe
<SYSTEM32>\tasks\kxetray

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kis.dll
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kxetray.exe
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\microsoft.vc80.crt.manifest
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\mpupdate.dll
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\mpuxagent.dll
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcm80.dll
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcp80.dll
%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcr80.dll

Deletes following files that it created itself

Moves the following files

from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-1rmfa.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kis.dll
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-i1do2.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kxetray.exe
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-7lbpv.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\microsoft.vc80.crt.manifest
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-fbqip.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\mpupdate.dll
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-rh6r4.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\mpuxagent.dll
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-79o21.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcm80.dll
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-htpms.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcp80.dll
from %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\is-nr3q9.tmp to %ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\msvcr80.dll

Network activity

Connects to

Miscellaneous

Creates and executes the following

'%TEMP%\is-egv1p.tmp\<File name>.tmp' /SL5="$F01AC,3214724,851456,<Full path to file>"
'%TEMP%\is-ak40g.tmp\<File name>.tmp' /SL5="$5002E,3214724,851456,<Full path to file>" /VERYSILENT /PASSWORD=49246c99-601b-4f5f-8bc7-24c589ed9721
'%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kxetray.exe' -ScanType

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /f /sc minute /mo 1 /tn "kxetray" /tr "%APPDATA%\kxetray.exe"
'<Full path to file>' /VERYSILENT /PASSWORD=49246c99-601b-4f5f-8bc7-24c589ed9721' (with hidden window)
'%ALLUSERSPROFILE%\ad895112-96e0-41a0-8054-d7c4d1538832\kxetray.exe' -ScanType' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /f /sc minute /mo 1 /tn "kxetray" /tr "%APPDATA%\kxetray.exe"' (with hidden window)