Trojan.Siggen31.33087

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\comfile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Modifies file system

Creates the following files

C:\327882r2fwjfw\bootsect
C:\327882r2fwjfw\system_ini.dat
C:\327882r2fwjfw\svchost.vista.dat
C:\327882r2fwjfw\svchost.dat
C:\327882r2fwjfw\svc_wht.dat
C:\327882r2fwjfw\safeboot.def.vista.dat
C:\327882r2fwjfw\safeboot.def.dat
C:\327882r2fwjfw\safeboot.dat
C:\327882r2fwjfw\rogues.dat
C:\327882r2fwjfw\region.dat
C:\327882r2fwjfw\whitedirb.dat
C:\327882r2fwjfw\purity.dat
C:\327882r2fwjfw\networkservice.dat
C:\327882r2fwjfw\netsvc.xp.dat
C:\327882r2fwjfw\netsvc.vista.dat
C:\327882r2fwjfw\netsvc.dat
C:\327882r2fwjfw\netsvc.bad.dat
C:\327882r2fwjfw\ndis_combofix.dat
C:\327882r2fwjfw\localsystemnetworkrestricted.dat
C:\327882r2fwjfw\localservicenetworkrestricted.dat
C:\327882r2fwjfw\localservice.dat
C:\327882r2fwjfw\policies.dat
C:\327882r2fwjfw\whitelegacy.dat
C:\327882r2fwjfw\zdomain.dat
C:\327882r2fwjfw\zhsvc.dat
C:\327882r2fwjfw\mwindows.dat
C:\327882r2fwjfw\dirname00
C:\327882r2fwjfw\filename
%WINDIR%\syswow64\cf6216.exe
C:\327882r2fwjfw\attrib.cfexe
C:\327882r2fwjfw\findstr.cfexe
C:\bug.txt
C:\327882r2fwjfw\svcdrv.vbs
C:\327882r2fwjfw\restore_pt.vbs
C:\327882r2fwjfw\osid.vbs
C:\327882r2fwjfw\localdrive.vbs
C:\327882r2fwjfw\lnkread.vbs
C:\327882r2fwjfw\lfn.vbs
C:\327882r2fwjfw\fprops.vbs
C:\327882r2fwjfw\combo-fix.sys
C:\327882r2fwjfw\exe.reg
C:\327882r2fwjfw\erunt.loc
C:\327882r2fwjfw\erdntwin.loc
C:\327882r2fwjfw\erdntdos.loc
C:\327882r2fwjfw\nircmd.inf
C:\327882r2fwjfw\erdnt.e_e
C:\327882r2fwjfw\fin.dat
C:\start_.cmd
C:\327882r2fwjfw\executables.dat
C:\327882r2fwjfw\clsid.dat
C:\327882r2fwjfw\dumphive.cfexe
C:\327882r2fwjfw\dd.cfexe
C:\327882r2fwjfw\catchme.cfexe
C:\327882r2fwjfw\setenvmt.bat
C:\327882r2fwjfw\safebootrepair.bat
C:\327882r2fwjfw\restoreo4.bat
C:\327882r2fwjfw\qoo.bat
C:\327882r2fwjfw\nd_.bat
C:\327882r2fwjfw\moveit.bat
C:\327882r2fwjfw\erunt.cfexe
C:\327882r2fwjfw\list-c.bat
C:\327882r2fwjfw\history.bat
C:\327882r2fwjfw\fixlsp.bat
C:\327882r2fwjfw\find3m.bat
C:\327882r2fwjfw\disclaimer.bat
C:\327882r2fwjfw\delclsid.bat
C:\327882r2fwjfw\comspec.bat
C:\327882r2fwjfw\combobatch.bat
C:\327882r2fwjfw\c.bat
C:\327882r2fwjfw\boot.bat
C:\327882r2fwjfw\lang.bat
C:\327882r2fwjfw\extract.cfexe
C:\327882r2fwjfw\fdsv.cfexe
C:\327882r2fwjfw\grep.cfexe
C:\327882r2fwjfw\023v.dat
C:\327882r2fwjfw\023.dat
C:\327882r2fwjfw\nircmd.com
C:\327882r2fwjfw\prep.cmd
C:\327882r2fwjfw\zip.cfexe
C:\327882r2fwjfw\vfind.cfexe
C:\327882r2fwjfw\swxcacls.cfexe
C:\327882r2fwjfw\swsc.cfexe
C:\327882r2fwjfw\swreg.cfexe
C:\327882r2fwjfw\sf.cfexe
C:\327882r2fwjfw\setpath.cfexe
C:\327882r2fwjfw\sed.cfexe
C:\327882r2fwjfw\pv.cfexe
C:\327882r2fwjfw\psexec.cfexe
C:\327882r2fwjfw\nircmdc.cfexe
C:\327882r2fwjfw\nircmd.cfexe
C:\327882r2fwjfw\mtee.cfexe
C:\327882r2fwjfw\moveex.cfexe
C:\327882r2fwjfw\md5deep.cfexe
C:\327882r2fwjfw\handle.cfexe
C:\327882r2fwjfw\gsar.cfexe
C:\327882r2fwjfw\creg.dat
C:\<File name>\osver00

Deletes the following files

C:\327882r2fwjfw\nircmd.inf
C:\327882r2fwjfw\filename
C:\327882r2fwjfw\dirname00
C:\327882r2fwjfw\prep.cmd

Moves the following files

from C:\327882r2fwjfw\023.dat to C:\<File name>\023.dat
from C:\327882r2fwjfw\region.dat to C:\<File name>\region.dat
from C:\327882r2fwjfw\qoo.bat to C:\<File name>\qoo.bat
from C:\327882r2fwjfw\pv.cfexe to C:\<File name>\pv.cfexe
from C:\327882r2fwjfw\purity.dat to C:\<File name>\purity.dat
from C:\327882r2fwjfw\psexec.cfexe to C:\<File name>\psexec.cfexe
from C:\327882r2fwjfw\policies.dat to C:\<File name>\policies.dat
from C:\327882r2fwjfw\osid.vbs to C:\<File name>\osid.vbs
from C:\327882r2fwjfw\nircmdc.cfexe to C:\<File name>\nircmdc.cfexe
from C:\327882r2fwjfw\restoreo4.bat to C:\<File name>\restoreo4.bat
from C:\327882r2fwjfw\nircmd.com to C:\<File name>\nircmd.com
from C:\327882r2fwjfw\networkservice.dat to C:\<File name>\networkservice.dat
from C:\327882r2fwjfw\netsvc.xp.dat to C:\<File name>\netsvc.xp.dat
from C:\327882r2fwjfw\netsvc.vista.dat to C:\<File name>\netsvc.vista.dat
from C:\327882r2fwjfw\netsvc.dat to C:\<File name>\netsvc.dat
from C:\327882r2fwjfw\netsvc.bad.dat to C:\<File name>\netsvc.bad.dat
from C:\327882r2fwjfw\nd_.bat to C:\<File name>\nd_.bat
from C:\327882r2fwjfw\ndis_combofix.dat to C:\<File name>\ndis_combofix.dat
from C:\327882r2fwjfw\mwindows.dat to C:\<File name>\mwindows.dat
from C:\327882r2fwjfw\nircmd.cfexe to C:\<File name>\nircmd.cfexe
from C:\327882r2fwjfw\restore_pt.vbs to C:\<File name>\restore_pt.vbs
from C:\327882r2fwjfw\rogues.dat to C:\<File name>\rogues.dat
from C:\327882r2fwjfw\safeboot.dat to C:\<File name>\safeboot.dat
from C:\327882r2fwjfw\zdomain.dat to C:\<File name>\zdomain.dat
from C:\327882r2fwjfw\whitelegacy.dat to C:\<File name>\whitelegacy.dat
from C:\327882r2fwjfw\whitedirb.dat to C:\<File name>\whitedirb.dat
from C:\327882r2fwjfw\vfind.cfexe to C:\<File name>\vfind.cfexe
from C:\327882r2fwjfw\system_ini.dat to C:\<File name>\system_ini.dat
from C:\327882r2fwjfw\swxcacls.cfexe to C:\<File name>\swxcacls.cfexe
from C:\327882r2fwjfw\swsc.cfexe to C:\<File name>\swsc.cfexe
from C:\327882r2fwjfw\swreg.cfexe to C:\<File name>\swreg.cfexe
from C:\327882r2fwjfw\svc_wht.dat to C:\<File name>\svc_wht.dat
from C:\327882r2fwjfw\svchost.vista.dat to C:\<File name>\svchost.vista.dat
from C:\327882r2fwjfw\svchost.dat to C:\<File name>\svchost.dat
from C:\327882r2fwjfw\svcdrv.vbs to C:\<File name>\svcdrv.vbs
from C:\327882r2fwjfw\sf.cfexe to C:\<File name>\sf.cfexe
from C:\327882r2fwjfw\setpath.cfexe to C:\<File name>\setpath.cfexe
from C:\327882r2fwjfw\setenvmt.bat to C:\<File name>\setenvmt.bat
from C:\327882r2fwjfw\sed.cfexe to C:\<File name>\sed.cfexe
from C:\327882r2fwjfw\safebootrepair.bat to C:\<File name>\safebootrepair.bat
from C:\327882r2fwjfw\safeboot.def.vista.dat to C:\<File name>\safeboot.def.vista.dat
from C:\327882r2fwjfw\safeboot.def.dat to C:\<File name>\safeboot.def.dat
from C:\327882r2fwjfw\mtee.cfexe to C:\<File name>\mtee.cfexe
from C:\327882r2fwjfw\zhsvc.dat to C:\<File name>\zhsvc.dat
from C:\327882r2fwjfw\moveit.bat to C:\<File name>\moveit.bat
from C:\327882r2fwjfw\md5deep.cfexe to C:\<File name>\md5deep.cfexe
from C:\327882r2fwjfw\erdntwin.loc to C:\<File name>\erdntwin.loc
from C:\327882r2fwjfw\erdntdos.loc to C:\<File name>\erdntdos.loc
from C:\327882r2fwjfw\erdnt.e_e to C:\<File name>\erdnt.e_e
from C:\327882r2fwjfw\dumphive.cfexe to C:\<File name>\dumphive.cfexe
from C:\327882r2fwjfw\disclaimer.bat to C:\<File name>\disclaimer.bat
from C:\327882r2fwjfw\delclsid.bat to C:\<File name>\delclsid.bat
from C:\327882r2fwjfw\dd.cfexe to C:\<File name>\dd.cfexe
from C:\327882r2fwjfw\creg.dat to C:\<File name>\creg.dat
from C:\327882r2fwjfw\erunt.cfexe to C:\<File name>\erunt.cfexe
from C:\327882r2fwjfw\comspec.bat to C:\<File name>\comspec.bat
from C:\327882r2fwjfw\combo-fix.sys to C:\<File name>\combo-fix.sys
from C:\327882r2fwjfw\clsid.dat to C:\<File name>\clsid.dat
from C:\327882r2fwjfw\catchme.cfexe to C:\<File name>\catchme.cfexe
from C:\327882r2fwjfw\c.bat to C:\<File name>\c.bat
from C:\327882r2fwjfw\bootsect to C:\<File name>\bootsect
from C:\327882r2fwjfw\boot.bat to C:\<File name>\boot.bat
from C:\327882r2fwjfw\attrib.cfexe to C:\<File name>\attrib.cfexe
from C:\327882r2fwjfw\023v.dat to C:\<File name>\023v.dat
from C:\327882r2fwjfw\combobatch.bat to C:\<File name>\combobatch.bat
from C:\327882r2fwjfw\erunt.loc to C:\<File name>\erunt.loc
from C:\327882r2fwjfw\exe.reg to C:\<File name>\exe.reg
from C:\327882r2fwjfw\executables.dat to C:\<File name>\executables.dat
from C:\327882r2fwjfw\localsystemnetworkrestricted.dat to C:\<File name>\localsystemnetworkrestricted.dat
from C:\327882r2fwjfw\localservicenetworkrestricted.dat to C:\<File name>\localservicenetworkrestricted.dat
from C:\327882r2fwjfw\localservice.dat to C:\<File name>\localservice.dat
from C:\327882r2fwjfw\localdrive.vbs to C:\<File name>\localdrive.vbs
from C:\327882r2fwjfw\lnkread.vbs to C:\<File name>\lnkread.vbs
from C:\327882r2fwjfw\list-c.bat to C:\<File name>\list-c.bat
from C:\327882r2fwjfw\lfn.vbs to C:\<File name>\lfn.vbs
from C:\327882r2fwjfw\lang.bat to C:\<File name>\lang.bat
from C:\327882r2fwjfw\history.bat to C:\<File name>\history.bat
from C:\327882r2fwjfw\handle.cfexe to C:\<File name>\handle.cfexe
from C:\327882r2fwjfw\gsar.cfexe to C:\<File name>\gsar.cfexe
from C:\327882r2fwjfw\grep.cfexe to C:\<File name>\grep.cfexe
from C:\327882r2fwjfw\fprops.vbs to C:\<File name>\fprops.vbs
from C:\327882r2fwjfw\fixlsp.bat to C:\<File name>\fixlsp.bat
from C:\327882r2fwjfw\findstr.cfexe to C:\<File name>\findstr.cfexe
from C:\327882r2fwjfw\find3m.bat to C:\<File name>\find3m.bat
from C:\327882r2fwjfw\fin.dat to C:\<File name>\fin.dat
from C:\327882r2fwjfw\fdsv.cfexe to C:\<File name>\fdsv.cfexe
from C:\327882r2fwjfw\extract.cfexe to C:\<File name>\extract.cfexe
from C:\327882r2fwjfw\moveex.cfexe to C:\<File name>\moveex.cfexe
from C:\327882r2fwjfw\zip.cfexe to C:\<File name>\zip.cfexe

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'C:\327882r2fwjfw\nircmd.com' shexec install 327882R2FWJFW\nircmd.inf
'C:\<File name>\grep.cfexe' -Fisq "Microsoft Windows XP"
'C:\<File name>\grep.cfexe' -Fisq "Microsoft Windows [Version 5.2.3790]"
'C:\<File name>\grep.cfexe' -sq "currentversion.* 6.0" osVer00
'C:\<File name>\swreg.cfexe' query "hklm\software\microsoft\windows nt\currentversion" /v currentversion
'%WINDIR%\syswow64\cf6216.exe' /k c.bat
'C:\327882r2fwjfw\nircmd.cfexe' execmd del "\327882R2FWJFW\prep.cmd"
'%WINDIR%\syswow64\cf6216.exe' /f:off /d /c call Start_.cmd
'C:\327882r2fwjfw\nircmd.cfexe' exec hide "<SYSTEM32>\CF6216.exe" /f:off /d /c call Start_.cmd
'C:\327882r2fwjfw\swreg.cfexe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q
'C:\327882r2fwjfw\swreg.cfexe' query "hklm\software\microsoft\windows nt\currentversion\windows"
'C:\327882r2fwjfw\findstr.cfexe' -ic:"[Version 6.0"
'%WINDIR%\syswow64\cf6216.exe' /S /D /c" VER "
'C:\<File name>\grep.cfexe' -Fisq "Microsoft Windows 2000"
'C:\327882r2fwjfw\findstr.cfexe' -LIXC:"<File name>" dirname00
'%WINDIR%\syswow64\cf6216.exe' /S /D /c" DIR /AD/B C:\* "
'C:\327882r2fwjfw\grep.cfexe' -Gisqx "FileName=[-[:alnum:]@.]*" FileName
'C:\327882r2fwjfw\swxcacls.cfexe' "<SYSTEM32>\cmd.exe" /p /ga:f /gs:f /gp:x /gu:x /q
'C:\327882r2fwjfw\swxcacls.cfexe' "<SYSTEM32>\cmd.exe" /oa /Q
'C:\327882r2fwjfw\attrib.cfexe' +r "C:\327882R2FWJFW\*.com"
'C:\327882r2fwjfw\attrib.cfexe' +r "C:\327882R2FWJFW\*.cfexe"
'C:\327882r2fwjfw\swreg.cfexe' add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Full path to file>"
'C:\327882r2fwjfw\nircmd.cfexe' win close ititle "ComboFix"
'C:\327882r2fwjfw\nircmd.cfexe' win close class "#32770"
'C:\327882r2fwjfw\sed.cfexe' "/\t.*\\nircmd\.inf$/I!d; s///; s/./@pv -kfi &/"
'C:\327882r2fwjfw\pv.cfexe' -o"%i\t%l"
'C:\327882r2fwjfw\nircmd.com' exec hide 327882R2FWJFW\prep.cmd >Bug.txt
'C:\327882r2fwjfw\findstr.cfexe' -IVX ComboFix
'C:\<File name>\nircmd.com' infobox "Incompatible OS. ComboFix only works for Windows 2000 and XP~n~nOS incompatible. ComboFix ne fonctionne que pour Windows 2000 et XP~n~nOS niet compatibel. ComboFix kan enkel gebruikt w...

Executes the following

'%WINDIR%\syswow64\regedit.exe' /s 327882R2FWJFW\EXE.reg
'%WINDIR%\syswow64\cmd.exe' /c 327882R2FWJFW\prep.cmd >Bug.txt
'%WINDIR%\syswow64\infdefaultinstall.exe' "C:\327882R2FWJFW\NirCmd.inf"
'%WINDIR%\syswow64\runonce.exe' -r
'%WINDIR%\syswow64\grpconv.exe' -o
'%WINDIR%\syswow64\cmd.exe' /c del "\327882R2FWJFW\prep.cmd"
'%WINDIR%\syswow64\cmd.exe' /c 327882R2FWJFW\prep.cmd >Bug.txt' (with hidden window)
'%WINDIR%\syswow64\cf6216.exe' /f:off /d /c call Start_.cmd' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del "\327882R2FWJFW\prep.cmd"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial