Trojan.Siggen34.7373

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\rss\csrss.exe"'

Creates or modifies the following files

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\VBoxWddm] 'ImagePath' = 'VBoxWddm'
[HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF] 'ImagePath' = 'VBoxSF'
[HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse] 'ImagePath' = 'VBoxMouse'
[HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest] 'ImagePath' = 'VBoxGuest'
[HKLM\SYSTEM\CurrentControlSet\Services\VBoxService] 'ImagePath' = 'VBoxService'
[HKLM\SYSTEM\CurrentControlSet\Services\VBoxVideo] 'ImagePath' = 'VBoxVideo'

Creates the following services

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

adds antivirus exclusion with following registry keys:

[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\rss' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\csrss' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\windefender.exe' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'csrss.exe' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'windefender.exe' = '00000000'
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] '<File name>.exe' = '00000000'

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes

Modifies file system

Creates the following files

%WINDIR%\temp\__psscriptpolicytest_cw4aswrj.io0.ps1
%WINDIR%\temp\__psscriptpolicytest_mhfxomne.c3p.psm1
%WINDIR%\temp\__psscriptpolicytest_vzvtsrv1.0se.ps1
%WINDIR%\temp\__psscriptpolicytest_woih0iqy.j2c.psm1
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-interactive
%WINDIR%\temp\__psscriptpolicytest_0vfdsjfy.gvo.ps1
%WINDIR%\temp\__psscriptpolicytest_niqu511g.dr3.psm1
%WINDIR%\temp\__psscriptpolicytest_mxm2jmgm.5vj.ps1
%WINDIR%\temp\__psscriptpolicytest_zrsystug.us2.psm1
%WINDIR%\temp\__psscriptpolicytest_50un54ir.cr0.ps1
%WINDIR%\temp\__psscriptpolicytest_cen2mahw.p21.psm1
%WINDIR%\temp\__psscriptpolicytest_cliilrd5.cwo.ps1
%WINDIR%\temp\__psscriptpolicytest_rdrltce3.v3v.psm1
%WINDIR%\rss\csrss.exe
nul
%WINDIR%\temp\__psscriptpolicytest_kib03g3i.s3h.ps1
%WINDIR%\temp\__psscriptpolicytest_wzejxayk.3t2.psm1
%WINDIR%\temp\__psscriptpolicytest_qaayghbm.yut.ps1
%WINDIR%\temp\__psscriptpolicytest_aellf4dq.go5.psm1
%WINDIR%\temp\__psscriptpolicytest_xdecntpz.tzl.ps1
%WINDIR%\temp\__psscriptpolicytest_v0gffnjj.zht.psm1
%WINDIR%\temp\__psscriptpolicytest_k4v0ctag.zrg.ps1
%WINDIR%\temp\__psscriptpolicytest_bsoavh45.tmk.psm1
%WINDIR%\temp\__psscriptpolicytest_2qtydo4h.gj1.ps1
%WINDIR%\temp\__psscriptpolicytest_v2ygkc2r.54o.psm1
%WINDIR%\temp\__psscriptpolicytest_emy0leli.2ay.ps1
%WINDIR%\temp\__psscriptpolicytest_g5zzzere.1dn.psm1
%TEMP%\csrss\injector\injector.exe
%TEMP%\csrss\injector\ntquerysysteminformationhook.dll

Deletes following files that it created itself

Network activity

Connects to

TCP

Other

UDP

Miscellaneous

Creates and executes the following

'%WINDIR%\rss\csrss.exe'
'%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -noprofile
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -noprofile' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
'%WINDIR%\rss\csrss.exe' ' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
'<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
'%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)