Trojan.Siggen31.37841

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\y0vut6] 'Start' = '00000001'
[HKLM\System\CurrentControlSet\Services\y0vut6] 'ImagePath' = '<DRIVERS>\y0vut6.sys'
[HKLM\SYSTEM\CurrentControlSet\services\y0vut6] 'ImagePath' = 'SYSTEM32\DRIVERS\Y0VUT6.SYS'

Creates the following services

'y0vut6' <DRIVERS>\y0vut6.sys

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Executes the following

'<SYSTEM32>\netsh.exe' firewall add allowedprogram name="永中Office" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram name="OpenJDK Platform binary_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram name="OpenJDK Platform binary" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram name="永中Office_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\idgsoce5k\cleanup.exe
<DRIVERS>\y0vut6.sys
%APPDATA%\sogouexplorer.zip
%APPDATA%\sogouexplorer\favorite3.dat
%LOCALAPPDATA%\google.zip
%LOCALAPPDATA%\google\chrome\user data\default\bookmarks
%LOCALAPPDATA%\360chrome\chrome\user data\default\bookmarks
%LOCALAPPDATA%\2345explorer\user data\default\bookmarksv2
%APPDATA%\baidu\baidubrowser.zip
%APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db
%APPDATA%\baidu\baidubrowser\user_data\default\settings\settings.db
%APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
%APPDATA%\mozilla.zip
%APPDATA%\mozilla\firefox\crash reports\installtime20190211233335
%APPDATA%\mozilla\firefox\crash reports\installtime20190225143501
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addons.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addonstartup.json.lz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\blocklist.xml
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\broadcast-listeners.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cert9.db
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\compatibility.ini
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\containers.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\content-prefs.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cookies.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\crashes\store.json.mozlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176053914.5498e1db-ec83-4398-aabb-b1d74c46f34f.event.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054084.f5a3d023-6b36-427f-bc5c-bd49e0c96f27.new-profile.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054155.2c95b9b6-7cc4-4276-9e1b-ac1f479f8290.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054159.0b2c25df-0121-4515-a72e-939763fa69f3.first-shutdown.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074239.244ad4e5-4553-4c93-8a73-f0b58f447521.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074280.5d271550-2d96-4bfa-8bb8-20a394e876cc.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074306.3d6e140b-0686-4f27-9f81-c4f16cf75495.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491907.974d8be3-0c22-430b-8358-1037dcc4fc17.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491958.016da8e6-a809-4924-a57d-7f1d626b4b0a.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057492363.a896da6c-7cc7-4347-b363-ecbcd243186b.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057859077.ee4531e2-b7ad-40c1-90ba-2fa0ca72ff2a.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057910953.ee1065d6-4494-45af-bc11-52c515b5fc5f.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200569992.47f1c95a-8f91-43fb-896e-6a290faab258.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200813338.f6202e8d-499e-4a5a-928a-67794e6d5eb0.modules.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200848746.e426a42e-682c-4b51-9c8d-39245af55444.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\session-state.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\state.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\extensions.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\handlers.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\key4.db
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\permissions.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pkcs11.txt
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\places.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pluginreg.dat
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\prefs.js
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\search.json.mozlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessioncheckpoints.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\previous.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190211233335
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190225143501
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\shield-preference-experiments.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sitesecurityservicestate.txt
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata-v2
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\times.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\failed\tabs.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\tofetch\tabs.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\webappsstore.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\xulstore.json
%APPDATA%\mozilla\firefox\profiles\profiles.log
%APPDATA%\360se6\user data\default\bookmarks
%LOCALAPPDATA%\tencent\qqbrowser.zip
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\bookmarks
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\bookmarks_01
%WINDIR%\setup\state\tmpstate.7z
%TEMP%\cyqo2l27m\7za.exe
%WINDIR%\setup\state\ssl\certum trusted network ca 2.cer
%APPDATA%\360safe\360softmgrlite\taskbarbtn.ini
%HOMEPATH%\desktop\装机后必读(双击打开).docx
%ProgramFiles(x86)%\360\360safe\deepscan\speedmem2.hg
%ProgramFiles(x86)%\360\360safe\safemon\nhplib.dat
%TEMP%\i73e9lm8i\tmp.dll
%ALLUSERSPROFILE%\microsoft\playtools\d74204922518dc4db621e098ad4bfeda

Deletes the following files

%TEMP%\idgsoce5k\cleanup.exe
%WINDIR%\panther\unattend.xml
%APPDATA%\sogouexplorer.zip
%LOCALAPPDATA%\google.zip
%APPDATA%\baidu\baidubrowser.zip
%APPDATA%\mozilla.zip
%LOCALAPPDATA%\tencent\qqbrowser.zip
%WINDIR%\setup\state\state.ini
%TEMP%\cyqo2l27m\7za.exe
%WINDIR%\setup\state\tmpstate.7z
%TEMP%\i73e9lm8i\tmp.dll

Substitutes the following files

%LOCALAPPDATA%\Google\Chrome\User Data\Default\Preferences
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Secure Preferences
%APPDATA%\Mozilla\Firefox\profiles.ini

Network activity

Connects to

'ba##u.com':80
'tw#.#aifti.com':88
'11#.#14.114.114':53
'12#.56.8.7':8080
'12#.56.8.7':8081

TCP

HTTP GET requests

http://47.##.74.149:88/pc/new/?m=################################################################
http://47.##.74.149:88/pc/new/?m=########################################################################################
http://47.##.74.149:88/config/cont-3.0.0.67.txt
http://47.##.74.149:88/config/config-3.0.0.67.txt
http://12#.#6.8.7:8080/67/6/addFun via 12#.56.8.7
http://47.##.74.149:88/configexe/conf-3.0.0.67.txt

UDP

DNS ASK ba##u.com
DNS ASK tw#.#aifti.com

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'ГЏВµГЌВіГ‰ГЁГ–ГѓВёГјВёГ„'
ClassName: '' WindowName: 'Windows Г—ГЉГ”ВґВ№ГњГЂГГ†Г·'
ClassName: '' WindowName: 'ГЌГёГ–В·ВґГіГ€В« - Г‹Г‘В№В·ВёГџГ‹Г™Г¤ВЇГЂГЂГ†Г·'
ClassName: '' WindowName: 'Windows В°ВІГ€В«Г–ГђГђГ„ВѕВЇВ±ВЁ'
ClassName: '' WindowName: 'Windows В°ВІГ€В«ВѕВЇВ±ВЁ'
ClassName: '' WindowName: 'playtip'

Creates and executes the following

'%TEMP%\idgsoce5k\cleanup.exe'
'%TEMP%\cyqo2l27m\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv

Executes the following

'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="永中Office" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="OpenJDK Platform binary" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="永中Office_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="OpenJDK Platform binary_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"
'%TEMP%\idgsoce5k\cleanup.exe' ' (with hidden window)
'%TEMP%\cyqo2l27m\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="永中Office" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="OpenJDK Platform binary" mode=enable program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="永中Office_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Yozo.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram name="OpenJDK Platform binary_all" mode=enable profile=all program="%ProgramFiles(x86)%\Yozosoft\Yozo_Office\Jre\bin\java.exe"' (with hidden window)

Attempts to shut down the Windows operating system.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial