Trojan.Siggen32.5787

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'system' = '<Full path to file>'
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'system' = '<Full path to file>'

Creates or modifies the following files

<SYSTEM32>\tasks\googlesystem\googleupdater\googleupdatertasksystem143.0.7482.0{0224c612-6733-49a7-a0aa-498acdc96589}

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService143.0.7482.0] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService143.0.7482.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service -...
[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService143.0.7482.0] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService143.0.7482.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service --service...

Creates the following services

'GoogleUpdaterInternalService143.0.7482.0' %ProgramFiles(x86)%\Google\GoogleUpdaterc.0.7482.0�pdater.exe" --system --windows-service --service=update-interna
'GoogleUpdaterService143.0.7482.0' %ProgramFiles(x86)%\Google\GoogleUpdaterc.0.7482.0�pdater.exe" --system --windows-service --service=updat

Modifies file system

Creates the following files

%TEMP%\tmp_2729327178\target.exe
%TEMP%\tmp_2729327178\agent.exe
nul
%ProgramFiles(x86)%\google\googleupdater\updater.log
%TEMP%\google2540_503587556\updater.packed.7z
%TEMP%\google2540_1002236979\updater.7z
%TEMP%\google2540_1002236979\bin\uninstall.cmd
%APPDATA%\svchost.exe
%TEMP%\google2540_1002236979\bin\updater.exe
%TEMP%\system.exe
%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\crashpad\settings.dat
%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\uninstall.cmd
%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe
%ProgramFiles(x86)%\google\googleupdater\53aeee81-deec-4b94-9d63-a6a6195237d5.tmp
%ProgramFiles(x86)%\google\update\googleupdate.exe
%ProgramFiles(x86)%\google\googleupdater\8a4e80b7-ca74-43af-a8f3-1284529c325f.tmp
%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\ccc86397-ad0c-4c87-a252-d27460a1cfd8.tmp
%ProgramFiles(x86)%\google\googleupdater\db3051a6-cdc3-4560-b8cf-e76f66de7490.tmp
%ProgramFiles(x86)%\google\googleupdater\crx_cache\93d672cd-8ab6-42f1-a0e9-a7488cb31d01.tmp
%ProgramFiles(x86)%\google\googleupdater\1c07df21-e056-42ba-85b4-57db3014a934.tmp
%ProgramFiles(x86)%\google\googleupdater\13169dfb-8ef5-4480-9a95-a797e5dcdda1.tmp

Sets the 'hidden' attribute to the following files

Deletes following files that it created itself

Moves the following files

from %ProgramFiles(x86)%\google\googleupdater\53aeee81-deec-4b94-9d63-a6a6195237d5.tmp to %ProgramFiles(x86)%\google\googleupdater\prefs.json
from %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\ccc86397-ad0c-4c87-a252-d27460a1cfd8.tmp to %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\prefs.json
from %ProgramFiles(x86)%\google\googleupdater\crx_cache\93d672cd-8ab6-42f1-a0e9-a7488cb31d01.tmp to %ProgramFiles(x86)%\google\googleupdater\crx_cache\metadata.json

Network activity

UDP

Miscellaneous

Creates and executes the following

'%TEMP%\tmp_2729327178\target.exe'
'%TEMP%\tmp_2729327178\agent.exe' -server http://19#.#68.1.40:8000
'%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --system --windows-service --service=update-internal
'%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --crash-handler --system "--database=%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=143.0...
'%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --system --windows-service --service=update

Executes the following

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v system /t REG_SZ /d <Full path to file> /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v system /t REG_SZ /d <Full path to file> /f
'<SYSTEM32>\attrib.exe' +s +h %APPDATA%\svchost.exe
'<SYSTEM32>\attrib.exe' +s +h %TEMP%\system.exe