Trojan.Siggen36.63989

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorers' = '%WINDIR%\explorer.exe /root <SYSTEM32>\rundll32.exe ..\windows\system32\user32.dll.ShellExecute(%s), D:\System_VoIume_lnforma...
[HKCU\Software\Classes\exefiles\shell\open\command] '' = '"D:\System_VoIume_lnformation\Jnt\ryxuf\explorers.exe" rts "%1"'

Creates the following files on removable media

<Drive name for removable media>:\unhide files.bat
<Drive name for removable media>:\fiies .exe
<Drive name for removable media>:\system volume information\system volume information ...
<Drive name for removable media>:\system volume information\unhide files.bat

Modifies file system

Creates the following files

C:\files .exe
C:\show hidden files.bat
D:\files .exe
D:\show hidden files.bat
D:\sefera\jnt\xobemuqi\svcnost.exe
D:\sefera\jnt\xobemuqi\svcnosts.exe
D:\sefera\jnt\xobemuqi\gotera.bmp
D:\system_voiume_lnformation\jnt\ryxuf\explorers.exe
D:\system_voiume_lnformation\jnt\ryxuf\gotera.bmp
D:\system_voiume_lnformation\jnt\ryxuf\bmz\explorer.exeВќ
D:\sefera\desktop.ini
D:\sefera\jnt\xobemuqi\desktop.ini
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
%HOMEPATH%\scf\scf.exe

Sets the 'hidden' attribute to the following files

D:\sefera\desktop.ini
D:\sefera\jnt\xobemuqi\desktop.ini

Network activity

Connects to

'cl######rch.firebaseapp.com':443

TCP

Other

'cl######rch.firebaseapp.com':443

UDP

DNS ASK cl######rch.firebaseapp.com

Miscellaneous

Creates and executes the following

'D:\sefera\jnt\xobemuqi\svcnosts.exe' fdrg
'D:\sefera\jnt\xobemuqi\svcnost.exe' nm
'%HOMEPATH%\scf\scf.exe' znmda

Executes the following

'%WINDIR%\explorer.exe' <Full path to file>\..
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /g everyone:f /e /t
'<SYSTEM32>\cacls.exe' n:\sefera\Jnt\null\..\.. /g everyone:f /e /t
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /r administrators /e /t
'<SYSTEM32>\cacls.exe' n:\sefera\Jnt\null\..\.. /r administrators /e /t
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /r user /e /t
'<SYSTEM32>\cacls.exe' n:\sefera\Jnt\null\..\.. /r user /e /t
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /g everyone:f /e /t
'<SYSTEM32>\cacls.exe' n:\System_VoIume_lnformation\Jnt\null\..\.. /g everyone:f /e /t
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /r administrators /e /t
'<SYSTEM32>\cacls.exe' n:\System_VoIume_lnformation\Jnt\null\..\.. /r administrators /e /t
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /r user /e /t
'<SYSTEM32>\cacls.exe' n:\System_VoIume_lnformation\Jnt\null\..\.. /r user /e /t
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\..\.. +r +s +h
'<SYSTEM32>\attrib.exe' D:\sefera\Jnt\xobemuqi\..\.. +r +s +h
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\..\..\desktop.ini +s +h
'<SYSTEM32>\attrib.exe' D:\sefera\Jnt\xobemuqi\..\..\desktop.ini +s +h
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi +r +s +h
'<SYSTEM32>\attrib.exe' D:\sefera\Jnt\xobemuqi +r +s +h
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\desktop.ini +s +h
'<SYSTEM32>\attrib.exe' D:\sefera\Jnt\xobemuqi\desktop.ini +s +h
'<SYSTEM32>\cmd.exe' /c attrib D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. +r +s +h
'<SYSTEM32>\attrib.exe' D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. +r +s +h
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d administrators /e
'<SYSTEM32>\cacls.exe' D:\sefera\Jnt\xobemuqi\..\.. /d administrators /e
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d everyone /e
'<SYSTEM32>\cacls.exe' D:\sefera\Jnt\xobemuqi\..\.. /d everyone /e
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d user /e
'<SYSTEM32>\cacls.exe' D:\sefera\Jnt\xobemuqi\..\.. /d user /e
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d administrators /e
'<SYSTEM32>\cacls.exe' D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d administrators /e
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d everyone /e
'<SYSTEM32>\cacls.exe' D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d everyone /e
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d user /e
'<SYSTEM32>\cacls.exe' D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d user /e
'<SYSTEM32>\cmd.exe' /c net localgroup administrators
'<SYSTEM32>\net.exe' localgroup administrators
'<SYSTEM32>\net1.exe' localgroup administrators
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /g everyone:f /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /r administrators /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls n:\sefera\Jnt\null\..\.. /r user /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /g everyone:f /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /r administrators /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls n:\System_VoIume_lnformation\Jnt\null\..\.. /r user /e /t' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\..\.. +r +s +h' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\..\..\desktop.ini +s +h' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi +r +s +h' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib D:\sefera\Jnt\xobemuqi\desktop.ini +s +h' (with hidden window)
'<SYSTEM32>\cmd.exe' /c attrib D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. +r +s +h' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d administrators /e' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d everyone /e' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\sefera\Jnt\xobemuqi\..\.. /d user /e' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d administrators /e' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d everyone /e' (with hidden window)
'<SYSTEM32>\cmd.exe' /c cacls D:\System_VoIume_lnformation\Jnt\ryxuf\..\.. /d user /e' (with hidden window)