Trojan.Siggen32.60191

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
'<SYSTEM32>\taskkill.exe' /F /T /IM chrome.exe
'<SYSTEM32>\taskkill.exe' /F /T /IM msedge.exe
'<SYSTEM32>\taskkill.exe' /F /T /IM opera.exe
'<SYSTEM32>\taskkill.exe' /F /T /IM firefox.exe
'<SYSTEM32>\taskkill.exe' /F /T /IM librewolf.exe

Launches a large number of processes

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

nul
%TEMP%\yvh8f4uq.ps1
%TEMP%\2og4wgrr\2og4wgrr.0.cs
%TEMP%\2og4wgrr\2og4wgrr.cmdline
%TEMP%\2og4wgrr\2og4wgrr.out
%TEMP%\2og4wgrr\csc852bafd95be24c5a85717d584f281d.tmp
%TEMP%\res32f7.tmp
%TEMP%\2og4wgrr\2og4wgrr.dll
%TEMP%\dehqklne.tmp
%TEMP%\288dzsg7.tmp
%TEMP%\zgmgzkqw.tmp
%TEMP%\p4xtrw4z.tmp
%TEMP%\fe7o3lm7.tmp
%TEMP%\au7v3oqq.tmp
%TEMP%\9zprb4gm.tmp
%TEMP%\jixlcal1.tmp
%TEMP%\jixlcal1.tmp-shm
%TEMP%\vx5bivc3.tmp
%TEMP%\i5zx4f46.tmp

Deletes following files that it created itself

%TEMP%\res32f7.tmp
%TEMP%\2og4wgrr\csc852bafd95be24c5a85717d584f281d.tmp
%TEMP%\2og4wgrr\2og4wgrr.dll
%TEMP%\2og4wgrr\2og4wgrr.0.cs
%TEMP%\2og4wgrr\2og4wgrr.out
%TEMP%\2og4wgrr\2og4wgrr.cmdline
%TEMP%\yvh8f4uq.ps1
%TEMP%\jixlcal1.tmp-shm

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep Bypass -NoProfile -NoLogo -WindowStyle Hidden -File %TEMP%\yvh8f4uq.ps1

Executes the following

'<SYSTEM32>\cmd.exe' /C "net session >nul 2>&1 && echo Y || echo N"
'<SYSTEM32>\net.exe' session
'<SYSTEM32>\net1.exe' session
'<SYSTEM32>\cmd.exe' /C chcp
'<SYSTEM32>\chcp.com'
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2og4wgrr\2og4wgrr.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES32F7.tmp" "%TEMP%\2og4wgrr\CSC852BAFD95BE24C5A85717D584F281D.TMP"
'<SYSTEM32>\cmd.exe' /C systeminfo
'<SYSTEM32>\systeminfo.exe'
'<SYSTEM32>\cmd.exe' /C "fsutil volume diskfree C:"
'<SYSTEM32>\fsutil.exe' volume diskfree C
'<SYSTEM32>\cmd.exe' /C "fsutil volume diskfree D:"
'<SYSTEM32>\fsutil.exe' volume diskfree D
'<SYSTEM32>\cmd.exe' /C "taskkill /F /IM chrome.exe /T >nul 2>&1 & taskkill /F /IM brave.exe /T >nul 2>&1 & taskkill /F /IM msedge.exe /T >nul 2>&1 & taskkill /F /IM vivaldi.exe /T >nul 2>&1 & taskkill /F /IM opera...
'<SYSTEM32>\cmd.exe' /C "tasklist /FI \"IMAGENAME eq chrome.exe\" 2>nul | findstr /I \"chrome.exe\""
'<SYSTEM32>\tasklist.exe' /FI \"IMAGENAME eq chrome.exe\"
'<SYSTEM32>\findstr.exe' /I \"chrome.exe\"
'<SYSTEM32>\cmd.exe' /C "tasklist /FI \"IMAGENAME eq msedge.exe\" 2>nul | findstr /I \"msedge.exe\""
'<SYSTEM32>\tasklist.exe' /FI \"IMAGENAME eq msedge.exe\"
'<SYSTEM32>\findstr.exe' /I \"msedge.exe\"
'<SYSTEM32>\cmd.exe' /C "tasklist /FI \"IMAGENAME eq opera.exe\" 2>nul | findstr /I \"opera.exe\""
'<SYSTEM32>\tasklist.exe' /FI \"IMAGENAME eq opera.exe\"
'<SYSTEM32>\findstr.exe' /I \"opera.exe\"
'<SYSTEM32>\cmd.exe' /C "tasklist /FI \"IMAGENAME eq firefox.exe\" 2>nul | findstr /I \"firefox.exe\""
'<SYSTEM32>\tasklist.exe' /FI \"IMAGENAME eq firefox.exe\"
'<SYSTEM32>\findstr.exe' /I \"firefox.exe\"
'<SYSTEM32>\cmd.exe' /C "tasklist /FI \"IMAGENAME eq librewolf.exe\" 2>nul | findstr /I \"librewolf.exe\""
'<SYSTEM32>\tasklist.exe' /FI \"IMAGENAME eq librewolf.exe\"
'<SYSTEM32>\findstr.exe' /I \"librewolf.exe\"
'<SYSTEM32>\cmd.exe' /C "ipconfig /all"
'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\cmd.exe' /C "ipconfig /displaydns"
'<SYSTEM32>\ipconfig.exe' /displaydns
'<SYSTEM32>\cmd.exe' /C "sc query type= service state= all"
'<SYSTEM32>\sc.exe' query type= service state= all
'<SYSTEM32>\cmd.exe' /c "cmd /c timeout /t 3 /nobreak >nul & del /f /q \"<Full path to file>\""
'<SYSTEM32>\cmd.exe' /c timeout /t 3 /nobreak
'<SYSTEM32>\timeout.exe' /t 3 /nobreak
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2og4wgrr\2og4wgrr.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES32F7.tmp" "%TEMP%\2og4wgrr\CSC852BAFD95BE24C5A85717D584F281D.TMP"' (with hidden window)