Trojan.Siggen32.26769

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'deletere' = 'SCHTASKS /delete /f /tn "resystem"'

Creates or modifies the following files

<SYSTEM32>\tasks\resystem

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM notice_center.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM notice_right.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQGame.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQGameWebServer.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM wps.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM wpscenter.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM Pic_2345Svc.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM 2345Explorer.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM Protect_2345Explorer.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM Pinyin_2345Svc.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM 2345PinyinCloud.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM qmbrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM hardwarecheck.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM HardwarecheckBrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQMusic.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQLive.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQLiveBrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QQLiveService.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM ГЏВІГ‚ГГЂВГ‘Г….exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QyClient.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QyFragment.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QyPlayer.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QyKernel.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM QiyiService.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM WinR.exe /T

Launches a large number of processes

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

Modifies file system

Creates the following files

%TEMP%\nslbbfa.tmp
<Current directory>\close2.exe
<Current directory>\close2_x64.exe
%TEMP%\syspin.exe
%TEMP%\nsvbcd5.tmp\execcmd.dll
nul
%TEMP%\null
%TEMP%\nsvbcd5.tmp\system.dll

Deletes the following system files

%WINDIR%\tasks\sa.dat
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318

Deletes following files that it created itself

<Current directory>\close2.exe

Network activity

UDP

DNS ASK ap#.msn.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'ApplicationFrameWindow' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Creates and executes the following

'<Current directory>\close2_x64.exe'
'%TEMP%\syspin.exe' "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\QQÐâÐÐÐÐÐÂ·.lnk" c:5387

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM /T
'%WINDIR%\syswow64\cmd.exe' /C @ping 127.0.0.1 -n 2 >nul
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM notice_center.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM notice_right.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQGame.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQGameWebServer.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM wps.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM wpscenter.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Pic_2345Svc.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM 2345Explorer.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Protect_2345Explorer.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Pinyin_2345Svc.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM 2345PinyinCloud.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM qmbrowser.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM hardwarecheck.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM HardwarecheckBrowser.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQMusic.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLive.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLiveBrowser.exe /T
'%WINDIR%\syswow64\cmd.exe' /C sc stop QQLiveService >> null
'%WINDIR%\syswow64\sc.exe' stop QQLiveService
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLiveService.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM ÐÐÐÐÐâÐÂÐÐÐÂÐâÐâ¦.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyClient.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyFragment.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyPlayer.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyKernel.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QiyiService.exe /T
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM WinR.exe /T
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl HIGHEST /sc once /tn "resystem" /tr "cmd /c shutdown /r /f /t 0 " /st 02:36:33
'<SYSTEM32>\schtasks.exe' /create /f /rl HIGHEST /sc once /tn "resystem" /tr "cmd /c shutdown /r /f /t 0 " /st 02:36:33
'<SYSTEM32>\cmd.exe' /c gpupdate /force
'<SYSTEM32>\cmd.exe' /c bcdedit /timeout 6
'<SYSTEM32>\gpupdate.exe' /force
'<SYSTEM32>\bcdedit.exe' /timeout 6
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootmenupolicy legacy
'<SYSTEM32>\bcdedit.exe' /set {default} bootmenupolicy legacy
'%WINDIR%\explorer.exe'
'<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Current directory>\close2_x64.exe"
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
'<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C @ping 127.0.0.1 -n 2 >nul' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM notice_center.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM notice_right.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQGame.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQGameWebServer.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM wps.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM wpscenter.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Pic_2345Svc.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM 2345Explorer.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Protect_2345Explorer.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM Pinyin_2345Svc.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM 2345PinyinCloud.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM qmbrowser.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM hardwarecheck.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM HardwarecheckBrowser.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQMusic.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLive.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLiveBrowser.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C sc stop QQLiveService >> null' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QQLiveService.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM ÐÐÐÐÐâÐÂÐÐÐÂÐâÐâ¦.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyClient.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyFragment.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyPlayer.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QyKernel.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM QiyiService.exe /T' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "taskkill" /F /IM WinR.exe /T' (with hidden window)
'<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl HIGHEST /sc once /tn "resystem" /tr "cmd /c shutdown /r /f /t 0 " /st 02:36:33' (with hidden window)
'<SYSTEM32>\cmd.exe' /c gpupdate /force' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /timeout 6' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootmenupolicy legacy' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Current directory>\close2_x64.exe"' (with hidden window)
'%TEMP%\syspin.exe' "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\QQÐâÐÐÐÐÐÂ·.lnk" c:5387' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial