BackDoor.Siggen2.3254

Technical Information

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\csrss.exe

Modifies file system

Creates the following files

%TEMP%\7957.tmp
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_pole_null_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_pole_null_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_pole_null_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_pole_null_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\gray_button_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\close_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_mini_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_mini_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_short_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_short_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_short_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_short_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\info_icon_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_mini_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\yellow_button_mini_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\transparent.gif
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_blue_active_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_blue_active_125.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jthfh2ut\160[1]
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\warning_icon_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_caution_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_caution_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_caution_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_caution_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_x_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_x_100.png
%TEMP%\adobe_admlogs\adobe_adm.log
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_x_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_check_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_check_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_check_125.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_check_150.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_darkgray_base_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_darkgray_base_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_blue_active_200.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\progressbar_blue_active_100.png
%LOCALAPPDATA%\adobe\72cde805-af2f-4224-b2fd-120071e893f3\status_icon_x_150.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jthfh2ut\sc[1]
%TEMP%\adobe_admlogs\adobe_gde.log

Substitutes the following files

%ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl

Network activity

TCP

'get.adobe.com':443

UDP

DNS ASK go.microsoft.com
DNS ASK share.microsoft.com
DNS ASK settings-win.data.microsoft.com
DNS ASK maps.windows.com
DNS ASK dl.delivery.mp.microsoft.com
DNS ASK ar#.msn.com
DNS ASK im##########-rt-microsoft-com.akamaized.net
DNS ASK get.adobe.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\7957.tmp' --splash<Full path to file> 876A64930BED9C4D2C74262A1306147394C2A149001B9E36E0D61F85D4BD1E831D4A702633C2F02C62C418365E23C52AF46C31941312B366844DD22FA94E710F
'%TEMP%\7957.tmp' --splash<Full path to file> 876A64930BED9C4D2C74262A1306147394C2A149001B9E36E0D61F85D4BD1E831D4A702633C2F02C62C418365E23C52AF46C31941312B366844DD22FA94E710F' (with hidden window)

Executes the following