Trojan.Siggen18.10203

Technical Information

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe

the following user processes:

qualityagent64.exe

Modifies file system

Creates the following files

<Current directory>\vuescan x64\registry.rw.tvr.lck.ioydmewjhen.ffffffff.130
<Current directory>\vuescan x64\%local appdata%\temp\vuec5ad.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec4e1.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vuebdde.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vuebc67.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vueb88f.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue9eb7.tmp
<Current directory>\vuescan x64\%WINDIR%\debug\wia\wiatrace.log
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vuescan.log
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue8750.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue8694.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue8368.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue8347.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue8337.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue82b9.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue82a8.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vue8298.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue821a.tmp
<Current directory>\vuescan x64\registry.tlog
<Current directory>\vuescan x64\%local appdata%\microsoft\windows\history\history.ie5\index.dat
<Current directory>\vuescan x64\%appdata%\microsoft\windows\cookies\index.dat
<Current directory>\vuescan x64\%local appdata%\microsoft\windows\<INETFILES>\content.ie5\index.dat
<Current directory>\vuescan x64\skel\nimmgtiipqrphsotmtkgkinvuqouuulikttrtinh.tls-864-1756.tls
<Current directory>\vuescan x64\skel\d4973348a30ec3a79cf0b6e688fae4b342988cd8\qualityagent64.exe.6dc.360
<Current directory>\vuescan x64\dummytls\-304.1636.tmp
<Current directory>\vuescan x64\registry.tlog.cache
<Current directory>\vuescan x64\registry.rw.tvr.transact
<Current directory>\vuescan x64\registry.rw.tvr
<Current directory>\vuescan x64\%local appdata%\temp\vuec8f8.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec966.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\vuescan x64\%local appdata%\microsoft\windows\<INETFILES>\content.ie5\index.dat
<Current directory>\vuescan x64\%appdata%\microsoft\windows\cookies\index.dat
<Current directory>\vuescan x64\%local appdata%\microsoft\windows\history\history.ie5\index.dat

Deletes the following files

<Current directory>\vuescan x64\%local appdata%\temp\vue821a.tmp
<Current directory>\vuescan x64\%profile%\pictures\vuescan\vuescan.ini
<Current directory>\vuescan x64\%local appdata%\temp\vue8347.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue8368.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vue9eb7.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec4e1.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec5ad.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec8f8.tmp
<Current directory>\vuescan x64\%local appdata%\temp\vuec966.tmp

Moves the following files

from <Current directory>\vuescan x64\registry.rw.tvr.lck.ioydmewjhen.ffffffff.130 to <Current directory>\vuescan x64\registry.rw.tvr.lck
from <Current directory>\vuescan x64\dummytls\-304.1636.tmp to <Current directory>\vuescan x64\dummytls\dummytls.dll
from <Current directory>\vuescan x64\skel\d4973348a30ec3a79cf0b6e688fae4b342988cd8\qualityagent64.exe.6dc.360 to <Current directory>\vuescan x64\skel\d4973348a30ec3a79cf0b6e688fae4b342988cd8\qualityagent64.exe
from <Current directory>\vuescan x64\skel\nimmgtiipqrphsotmtkgkinvuqouuulikttrtinh.tls-864-1756.tls to <Current directory>\vuescan x64\skel\nimmgtiipqrphsotmtkgkinvuqouuulikttrtinh.tls
from <Current directory>\vuescan x64\%profile%\pictures\vuescan\vue8298.tmp to <Current directory>\vuescan x64\%profile%\pictures\vuescan\vuescan.ini

Substitutes the following files