Trojan.Siggen29.12240

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\MVIDCYXA] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\MVIDCYXA] 'ImagePath' = '%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe'
[HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\wokwsuwhtoix.sys'

Creates the following services

'MVIDCYXA' %ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe
'WinRing0_1_2_0' %WINDIR%\TEMP\wokwsuwhtoix.sys

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Injects code into

the following system processes:

<SYSTEM32>\conhost.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\dcr\pb.exe
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\wheel
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\record
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\metadata
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\installer
%TEMP%\_mei15242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%TEMP%\_mei15242\charset_normalizer\md.cp311-win_amd64.pyd
%TEMP%\_mei15242\certifi\cacert.pem
%TEMP%\_mei15242\base_library.zip
%TEMP%\_mei15242\_ssl.pyd
%TEMP%\_mei15242\_sqlite3.pyd
%TEMP%\_mei15242\_socket.pyd
%TEMP%\_mei15242\_queue.pyd
%TEMP%\_mei15242\_overlapped.pyd
%TEMP%\_mei15242\_multiprocessing.pyd
%TEMP%\_mei15242\_lzma.pyd
%TEMP%\_mei15242\_hashlib.pyd
%TEMP%\_mei15242\_decimal.pyd
%TEMP%\_mei15242\_ctypes.pyd
%TEMP%\_mei15242\_cffi_backend.cp311-win_amd64.pyd
%TEMP%\_mei15242\_bz2.pyd
nul
%TEMP%\_mei15242\_asyncio.pyd
%TEMP%\_mei15242\vcruntime140_1.dll
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license.bsd
%WINDIR%\temp\wokwsuwhtoix.sys
%TEMP%\_mei15242\cryptography\hazmat\bindings\_rust.pyd
%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe
%TEMP%\_mei15242\win32com\shell\shell.pyd
%TEMP%\_mei15242\win32\win32trace.pyd
%TEMP%\_mei15242\win32\win32api.pyd
%TEMP%\_mei15242\win32\_win32sysloader.pyd
%TEMP%\_mei15242\unicodedata.pyd
%TEMP%\_mei15242\sqlite3.dll
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\top_level.txt
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\entry_points.txt
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\wheel
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\record
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\metadata
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\license
%TEMP%\_mei15242\setuptools-65.5.0.dist-info\installer
%TEMP%\_mei15242\select.pyd
%TEMP%\_mei15242\pywin32_system32\pywintypes311.dll
%TEMP%\_mei15242\pywin32_system32\pythoncom311.dll
%TEMP%\_mei15242\python311.dll
%TEMP%\_mei15242\python3.dll
%TEMP%\_mei15242\pyexpat.pyd
%TEMP%\_mei15242\libssl-3.dll
%TEMP%\_mei15242\libffi-8.dll
%TEMP%\_mei15242\libcrypto-3.dll
%TEMP%\_mei15242\vcruntime140.dll
%TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license.apache
%TEMP%\_mei15242\pythonwin\win32ui.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_des.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei15242\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei15242\crypto\cipher\_chacha20.pyd
%TEMP%\_mei15242\crypto\cipher\_salsa20.pyd
%TEMP%\_mei15242\crypto\cipher\_arc4.pyd
%ALLUSERSPROFILE%\dcr\defendercompletelyremover.bat
%ALLUSERSPROFILE%\dcr\work\toolsfordk.zip
%ALLUSERSPROFILE%\dcr\work\nsudolc.exe
%ALLUSERSPROFILE%\dcr\work\nircmd.exe
%ALLUSERSPROFILE%\dcr\work\nhmb.exe
%ALLUSERSPROFILE%\dcr\work\lgpo.exe
%ALLUSERSPROFILE%\dcr\work\icon.ico
%ALLUSERSPROFILE%\dcr\work\cecho.exe
%ALLUSERSPROFILE%\dcr\work\7z.exe
%ALLUSERSPROFILE%\dcr\wh.exe
%TEMP%\_mei15242\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei15242\crypto\util\_strxor.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei15242\crypto\util\_cpuid_c.pyd
%TEMP%\_mei15242\crypto\publickey\_x25519.pyd
%TEMP%\_mei15242\crypto\publickey\_ed448.pyd
%TEMP%\_mei15242\crypto\publickey\_ed25519.pyd
%TEMP%\_mei15242\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei15242\crypto\protocol\_scrypt.pyd
%TEMP%\_mei15242\crypto\math\_modexp.pyd
%TEMP%\_mei15242\crypto\hash\_poly1305.pyd
%TEMP%\_mei15242\crypto\hash\_keccak.pyd
%TEMP%\_mei15242\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei15242\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei15242\crypto\hash\_sha512.pyd
%TEMP%\_mei15242\crypto\hash\_sha384.pyd
%TEMP%\_mei15242\crypto\hash\_sha256.pyd
%TEMP%\_mei15242\crypto\hash\_sha224.pyd
%TEMP%\_mei15242\crypto\hash\_sha1.pyd
%TEMP%\_mei15242\crypto\hash\_ripemd160.pyd
%TEMP%\_mei15242\crypto\hash\_md5.pyd
%TEMP%\_mei15242\crypto\hash\_md4.pyd
%TEMP%\_mei15242\crypto\hash\_md2.pyd
%TEMP%\_mei15242\crypto\hash\_blake2s.pyd
%TEMP%\_mei15242\crypto\hash\_blake2b.pyd
%TEMP%\_mei15242\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei15242\pythonwin\mfc140u.dll
%WINDIR%\temp\udda850.tmp

Deletes the following files

%WINDIR%\temp\udda850.tmp

Network activity

UDP

DNS ASK po##.#ashvault.pro
DNS ASK pa###bin.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%ALLUSERSPROFILE%\dcr\pb.exe'
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SHealthSer{#} {08}[Служба Центр безопасности Защитника Windows]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdNisDrv{#} {08}[Драйвер WD Network Inspection Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdBoot{#} {08}[Драйвер WD Antivirus Boot Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdFilter{#}{08} [Драйвер WD Antivirus Mini-Filter Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmAgent{#}{08} [Драйвер System Guard Runtime Monitor Agent Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}wtd{#}{08} [Драйвер WTD Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecWfp{#}{08} [Драйвер Microsoft Security WFP Callout Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0c}wscsvc{#} {08}[Служба Центр обеспечения безопасности]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmBroker{#} {08}[Служба Брокер мониторинга среды выполнения System Guard]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecFlt{#}{08} [Драйвер Security Events Component Minifilter]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Cache Maintenance{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Scheduled Scan{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Verification{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Cleanup{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SmartScreenSpecific{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}1{#} - {0c}Удалить Защитник Windows{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}2{#} - {0f}Проверить состояние папок и файлов Защитника{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecCore{#}{08} [Драйвер Microsoft Security Core Boot Driver]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние заданий в планировщике:{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Sense{#} {08} [Служба Advanced Threat Protection]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdNisSvc{#} {08} [Служба проверки сети Windows Defender Antivirus]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0c}WinDefend{#} {08} [Служба Антивирусная программа Защитника Windows]{\n #}
'%ALLUSERSPROFILE%\dcr\work\nsudolc.exe' -U:T -P:E -UseCurrentConsole "%ALLUSERSPROFILE%\DCR\DefenderCompletelyRemover.bat"
'%ALLUSERSPROFILE%\dcr\work\nircmd.exe' win center process cmd.exe
'%ALLUSERSPROFILE%\dcr\work\nircmd.exe' win settext foreground "DCR"
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние процессов защитника:{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SmartScreen{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsMpEng{#} {08} [Antimalware Service Executable]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmBroker{#} {08}[Брокер среды выполнения System Guard]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}uhssvc{#} {08} [Microsoft Update Health Service]{\n #}
'%ALLUSERSPROFILE%\dcr\wh.exe'
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}NisSrv{#} {08} [Network Realtime Inspection]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MPSigStub{#}{08} [Malware Protection Signature Update Stub]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SHealthUI{#}{08} [Безопасность Windows]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthTray{#}{08} [SecurityHealthSystray иконка в трее]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthServ{#}{08} [SecurityHealthService]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthHost{#}{08} [SecurityHealthHost]{\n #}{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние служб и драйверов защитника:{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}webthreat{#} {08}[Служба защиты от Веб-угроз - webthreatdefsvc]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}webthreatu{#} {08}[Служба защиты пользоват. от Веб-угроз - webthreatdefusersvc]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MpCmdRun{#} {08} [Microsoft malware protection]{\n #}
'%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}3{#} - {0e}Восстановление защитника и др.{\n #}
'%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\DCR\DefenderCompletelyRemover.bat" "
'%WINDIR%\syswow64\sc.exe' query "WdNisDrv"
'%WINDIR%\syswow64\sc.exe' query "WdBoot"
'%WINDIR%\syswow64\sc.exe' query "WdFilter"
'%WINDIR%\syswow64\sc.exe' query "SgrmAgent"
'%WINDIR%\syswow64\sc.exe' query "wtd"
'%WINDIR%\syswow64\sc.exe' query "MsSecWfp"
'%WINDIR%\syswow64\sc.exe' query "MsSecFlt"
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\sc.exe' delete "MVIDCYXA"
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' create "MVIDCYXA" binpath= "%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe" start= "auto"
'%WINDIR%\syswow64\sc.exe' query "webthreatdefusersvc"
'%WINDIR%\syswow64\sc.exe' query "MsSecCore"
'%WINDIR%\syswow64\sc.exe' query "webthreatdefsvc"
'%WINDIR%\syswow64\reg.exe' query "HKLM\System\CurrentControlSet\Services" /f "webthreatdefusersvc*" /k
'%WINDIR%\syswow64\chcp.com' 866
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo "%ALLUSERSPROFILE%\DCR\" "
'%WINDIR%\syswow64\findstr.exe' /c:"(" /c:")"
'%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19"
'%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID" 2>nul
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID"
'%WINDIR%\syswow64\cmd.exe' /c 2>nul reg query "HKLM\System\CurrentControlSet\Services" /f "webthreatdefusersvc*" /k|findstr H
'%WINDIR%\syswow64\findstr.exe' H
'%WINDIR%\syswow64\sc.exe' query "SgrmBroker"
'%WINDIR%\syswow64\mode.com' 78,45
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
'%WINDIR%\syswow64\find.exe' /i "0x0"
'%WINDIR%\syswow64\sc.exe' query "WinDefend"
'%WINDIR%\syswow64\sc.exe' query "WdNisSvc"
'%WINDIR%\syswow64\sc.exe' query "Sense"
'%WINDIR%\syswow64\sc.exe' query "wscsvc"
'%WINDIR%\syswow64\sc.exe' query "SecurityHealthService"
'<SYSTEM32>\sc.exe' start "MVIDCYXA"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial