Trojan.Siggen33.48910

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft\windows\eventbus\scheduledeventrunner

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\SystemEventsBus] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\SystemEventsBus] 'ImagePath' = '%WINDIR%\INF\EventBus\EventScheduler.exe'

Creates the following services

'SystemEventsBus' %WINDIR%\INF\EventBus\EventScheduler.exe

Modifies file system

Creates the following files

<Current directory>\cat.jpg
%WINDIR%\inf\eventbus\rootca.crt
%WINDIR%\inf\eventbus\eventscheduler.exe
%WINDIR%\inf\eventbus\eventhandler.exe
%WINDIR%\inf\eventbus\bus\busdaemon.exe
%WINDIR%\inf\eventbus\bus\reinitialize.cmd
%WINDIR%\inf\eventbus\bus\conf\bus.conf.base
%WINDIR%\inf\eventbus\bus\conf\cert.key
%WINDIR%\inf\eventbus\bus\conf\cert.pem
%WINDIR%\inf\eventbus\bus\conf\mime.types
%WINDIR%\temp\__psscriptpolicytest_ol3s2exx.w1i.ps1
%WINDIR%\temp\__psscriptpolicytest_sryhpjza.ne2.psm1
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-32-738.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-33-535.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-33-868.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-35-190.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-35-642.dump
%WINDIR%\temp\__psscriptpolicytest_0lwznml4.sby.ps1
%WINDIR%\temp\__psscriptpolicytest_dxbuxa4x.d3f.psm1
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-37-998.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-38-350.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-39-188.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-40-115.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-41-514.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-43-310.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-43-539.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-43-682.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-43-808.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-44-086.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-44-249.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-44-440.dump
%WINDIR%\temp\content\1708-848-powershell.exe-21-12-45-075.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\__psscriptpolicytest_emyl5s1y.pjf.ps1
%WINDIR%\temp\__psscriptpolicytest_uu5raejo.bgo.psm1
%WINDIR%\temp\content\4368-768-powershell.exe-21-12-47-875.dump
%WINDIR%\temp\content\4368-768-powershell.exe-21-12-48-169.dump
%WINDIR%\temp\content\4368-768-powershell.exe-21-12-48-338.dump
%WINDIR%\temp\content\4368-768-powershell.exe-21-12-48-615.dump
%WINDIR%\inf\eventbus\bus\conf\nginx.conf
%WINDIR%\temp\content\4368-768-powershell.exe-21-12-48-882.dump
%WINDIR%\inf\eventbus\bus\logs\nginx.pid

Deletes following files that it created itself

%WINDIR%\inf\eventbus\rootca.crt
%WINDIR%\temp\__psscriptpolicytest_ol3s2exx.w1i.ps1
%WINDIR%\temp\__psscriptpolicytest_sryhpjza.ne2.psm1
%WINDIR%\temp\__psscriptpolicytest_0lwznml4.sby.ps1
%WINDIR%\temp\__psscriptpolicytest_dxbuxa4x.d3f.psm1
%WINDIR%\temp\__psscriptpolicytest_emyl5s1y.pjf.ps1
%WINDIR%\temp\__psscriptpolicytest_uu5raejo.bgo.psm1

Modifies the HOSTS file.

Deletes itself.

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: 'NarratorUIClass' WindowName: ''

Creates and executes the following

'%WINDIR%\inf\eventbus\eventscheduler.exe'
'%WINDIR%\inf\eventbus\bus\busdaemon.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c start /max <Current directory>\cat.jpg
'<SYSTEM32>\certutil.exe' -addstore -f Root %WINDIR%\INF\EventBus\rootCA.crt
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\schtasks.exe' /Create /TN \Microsoft\Windows\EventBus\ScheduledEventRunner /TR %WINDIR%\INF\EventBus\EventHandler.exe /SC MINUTE /MO 30 /F
'<SYSTEM32>\sc.exe' create SystemEventsBus binPath= %WINDIR%\INF\EventBus\EventScheduler.exe start= auto DisplayName= "System Events Bus"
'<SYSTEM32>\sc.exe' description SystemEventsBus "Tunnels execution requests for background work scheduled by WinRT application. If this service is stopped or disabled, then system components may not function corre...
'<SYSTEM32>\sc.exe' start SystemEventsBus
'<SYSTEM32>\cmd.exe' /e:ON /v:OFF /d /c ""%WINDIR%\INF\EventBus\bus\reinitialize.cmd""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep -Milliseconds 500; while (Get-Process -Id 4560 -ErrorAction SilentlyContinue) { Start-Sleep -Milliseconds 100 }; Remove-Item...
'<SYSTEM32>\cmd.exe' /c powershell -NoProfile -Command "(Resolve-DnsName www.google.com -Type A -Server 1.#.1.1).IPAddress | Select-Object -First 1"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Resolve-DnsName www.google.com -Type A -Server 1.#.1.1).IPAddress | Select-Object -First 1"
'<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-Content 'conf\bus.conf.base' -Raw).Replace('[IP]', '127.0.0.1') | Set-Content 'conf\nginx.conf'"