Trojan.Siggen33.34755

Technical Information

Triggers a user-defined sigma rule:

02d1d718-dd13-41af-989d-ea85c7fab93f
4281cb20-2994-4580-aa63-c8b86d019934
81bcb81b-5b1f-474b-b373-52c871aaa7b1
05b2aa93-1210-42c8-8d9a-2fcc13b284f5
17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8
85ff530b-261d-48c6-a441-facaa2e81e48
1d61f71d-59d2-479e-9562-4ff5f4ead16b
970007b7-ce32-49d0-a4a4-fbef016950bd

To ensure autorun and distribution

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\iuRK" && start "" "C:\Drivers\iuRK\r0bqPSc6.exe"'

Creates the following services

'PuljuAGteGuPLjiAJjSAfJrb' cmd /c cd /d "C:\Drivers\iuRK" && start "" "C:\Drivers\iuRK\r0bqPSc6.exe"

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM r0bqPSc6.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T

Modifies file system

Creates the following files

%TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp
C:\drivers\iurk\is-psuv3i5agj.tmp
C:\drivers\iurk\is-if5xwyuk0b.tmp
C:\drivers\iurk\is-h4gyokj0wm.tmp
C:\drivers\iurk\is-5clu0cgmu2.tmp
C:\drivers\iurk\is-6163fphst7.tmp
C:\drivers\iurk\is-rcyvurrjej.tmp
C:\drivers\74nvoebe\is-kqnzsz3ju6.tmp
C:\drivers\74nvoebe\is-h3fxlx1bef.tmp
C:\drivers\74nvoebe\is-88fiax5vkp.tmp
C:\drivers\74nvoebe\is-qgszfemgqq.tmp
C:\drivers\74nvoebe\is-7h6x4vecnz.tmp
C:\drivers\74nvoebe\is-lqqp2zme2a.tmp
C:\drivers\74nvoebe\is-xxyxqb0w68.tmp
C:\drivers\74nvoebe\is-4e30u9n454.tmp
C:\drivers\vxp12u\is-wb7cl76zc1.tmp
%HOMEPATH%\desktop\闪连vpn.lnk
C:\drivers\drivers.dat.0
C:\drivers\drivers.dat
\device\namedpipe\ntsvcs

Sets the 'hidden' attribute to the following files

C:\drivers\74nvoebe\installer.exe
C:\drivers\74nvoebe\od0djry.ico
C:\drivers\74nvoebe\展示视频_01.mp4
C:\drivers\74nvoebe\展示视频_02.mp4
C:\drivers\74nvoebe\素材图片_01.png
C:\drivers\74nvoebe\素材图片_02.png
C:\drivers\74nvoebe\背景音频_01.mp3
C:\drivers\74nvoebe\背景音频_02.mp3
C:\drivers\iurk\b5i.etx
C:\drivers\iurk\conference_new.dll
C:\drivers\iurk\msvcp140.dll
C:\drivers\iurk\r0bqpsc6.exe
C:\drivers\iurk\vcruntime140.dll
C:\drivers\iurk\vcruntime140_1.dll
C:\drivers\vxp12u\7ud4pbcflih.xfdz
C:\drivers\drivers.dat
C:\drivers\drivers.dat.0

Deletes following files that it created itself

%TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp

Moves the following files

from C:\drivers\iurk\is-psuv3i5agj.tmp to C:\drivers\iurk\b5i.etx
from C:\drivers\iurk\is-if5xwyuk0b.tmp to C:\drivers\iurk\conference_new.dll
from C:\drivers\iurk\is-h4gyokj0wm.tmp to C:\drivers\iurk\msvcp140.dll
from C:\drivers\iurk\is-5clu0cgmu2.tmp to C:\drivers\iurk\r0bqpsc6.exe
from C:\drivers\iurk\is-6163fphst7.tmp to C:\drivers\iurk\vcruntime140.dll
from C:\drivers\iurk\is-rcyvurrjej.tmp to C:\drivers\iurk\vcruntime140_1.dll
from C:\drivers\74nvoebe\is-kqnzsz3ju6.tmp to C:\drivers\74nvoebe\installer.exe
from C:\drivers\74nvoebe\is-h3fxlx1bef.tmp to C:\drivers\74nvoebe\od0djry.ico
from C:\drivers\74nvoebe\is-88fiax5vkp.tmp to C:\drivers\74nvoebe\展示视频_01.mp4
from C:\drivers\74nvoebe\is-qgszfemgqq.tmp to C:\drivers\74nvoebe\展示视频_02.mp4
from C:\drivers\74nvoebe\is-7h6x4vecnz.tmp to C:\drivers\74nvoebe\素材图片_01.png
from C:\drivers\74nvoebe\is-lqqp2zme2a.tmp to C:\drivers\74nvoebe\素材图片_02.png
from C:\drivers\74nvoebe\is-xxyxqb0w68.tmp to C:\drivers\74nvoebe\背景音频_01.mp3
from C:\drivers\74nvoebe\is-4e30u9n454.tmp to C:\drivers\74nvoebe\背景音频_02.mp3
from C:\drivers\vxp12u\is-wb7cl76zc1.tmp to C:\drivers\vxp12u\7ud4pbcflih.xfdz

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp' /SL5="$A02D2,119463895,969728,<Full path to file>"
'C:\drivers\iurk\r0bqpsc6.exe'

Executes the following

'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"
'<SYSTEM32>\icacls.exe' \"C:\Drivers\" /deny Users:(D)
'<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
'<SYSTEM32>\icacls.exe' \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
'<SYSTEM32>\attrib.exe' C:\Drivers +s +h
'<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D
'<SYSTEM32>\cmd.exe' /c sc stop PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\sc.exe' stop PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\cmd.exe' /c sc delete PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\sc.exe' delete PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb /f
'<SYSTEM32>\cmd.exe' /c sc create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto
'<SYSTEM32>\sc.exe' create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto
'<SYSTEM32>\sc.exe' qc PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb
'<SYSTEM32>\cmd.exe' /c sc failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000
'<SYSTEM32>\sc.exe' failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000
'<SYSTEM32>\sc.exe' start MicrosoftEdgeElevationService
'<SYSTEM32>\sc.exe' start VSS
'%WINDIR%\syswow64\taskkill.exe' /F /IM r0bqPSc6.exe /T' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"' (with hidden window)
'<SYSTEM32>\attrib.exe' C:\Drivers +s +h' (with hidden window)
'<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc stop PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc delete PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
'<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto' (with hidden window)
'<SYSTEM32>\sc.exe' qc PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
'<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000' (with hidden window)
'<SYSTEM32>\sc.exe' start MicrosoftEdgeElevationService' (with hidden window)
'<SYSTEM32>\sc.exe' start VSS' (with hidden window)