Trojan.PWS.Siggen2.3776

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\HDZfile\shell\open\command] '' = '%ProgramFiles%\Hard Disk Sentinel\HDSentinel.exe "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hard Disk Sentinel' = '"%ProgramFiles%\Hard Disk Sentinel\HDSentinel.exe" /AUTORUN'

Вредоносные функции:

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Hard Disk Sentinel\HDsirena.mp3
%ProgramFiles%\Hard Disk Sentinel\detect.dll
%ProgramFiles%\Hard Disk Sentinel\detat.dll
%ProgramFiles%\Hard Disk Sentinel\deta1.dll
%ProgramFiles%\Hard Disk Sentinel\deta.dll
%ProgramFiles%\Hard Disk Sentinel\bc_vbdll.dll
%ProgramFiles%\Hard Disk Sentinel\afaapi.dll
%ProgramFiles%\Hard Disk Sentinel\109commandlib.dll
%ProgramFiles%\Hard Disk Sentinel\HDSentinelTray.exe
%ProgramFiles%\Hard Disk Sentinel\HDSentinel.exe
%ProgramFiles%\Hard Disk Sentinel\HDSCtrl.exe
%ProgramFiles%\Hard Disk Sentinel\HDSAction.exe
%ProgramFiles%\Hard Disk Sentinel\hdsentinel.vsx
%ProgramFiles%\Hard Disk Sentinel\dethp2.dll
%ProgramFiles%\Hard Disk Sentinel\dethp.dll
%ProgramFiles%\Hard Disk Sentinel\uk.lng
%ProgramFiles%\Hard Disk Sentinel\twpro.lng
%ProgramFiles%\Hard Disk Sentinel\tw.lng
%ProgramFiles%\Hard Disk Sentinel\trpro.lng
%ProgramFiles%\Hard Disk Sentinel\tr.lng
%ProgramFiles%\Hard Disk Sentinel\swpro.lng
%ProgramFiles%\Hard Disk Sentinel\sw.lng
%ProgramFiles%\Hard Disk Sentinel\sp.lng
%ProgramFiles%\Hard Disk Sentinel\skpro.lng
%ProgramFiles%\Hard Disk Sentinel\sk.lng
%ProgramFiles%\Hard Disk Sentinel\rupro.lng
%ProgramFiles%\Hard Disk Sentinel\ru.lng
%ProgramFiles%\Hard Disk Sentinel\hdsentinel.vsh
%ProgramFiles%\Hard Disk Sentinel\czpro.lng
%ProgramFiles%\Hard Disk Sentinel\detjm.dll
%ProgramFiles%\Hard Disk Sentinel\DISKDATA_XXware_Xirtual_IDE_Hard_Drive_11000000000000000001_00000001.dat
%TEMP%\180622030613312.71831038.tmp
%ProgramFiles%\Hard Disk Sentinel\log.txt
%ProgramFiles%\Hard Disk Sentinel\HDSentinel.sys
%ProgramFiles%\Hard Disk Sentinel\storelibir.dll
%ProgramFiles%\Hard Disk Sentinel\storelibir-2.dll
%ProgramFiles%\Hard Disk Sentinel\storelib.dll
%ProgramFiles%\Hard Disk Sentinel\storectrl.dll
%ProgramFiles%\Hard Disk Sentinel\storarc.dll
%ProgramFiles%\Hard Disk Sentinel\Storagetest.dll
%ProgramFiles%\Hard Disk Sentinel\ssleay32.dll
%ProgramFiles%\Hard Disk Sentinel\pri2plgnnapa.dll
%ProgramFiles%\Hard Disk Sentinel\prerrlog.dll
%ProgramFiles%\Hard Disk Sentinel\prdecode.dll
%ProgramFiles%\Hard Disk Sentinel\mv_api.dll
%ProgramFiles%\Hard Disk Sentinel\libxml2.dll
%ProgramFiles%\Hard Disk Sentinel\libeay32.dll
%ProgramFiles%\Hard Disk Sentinel\infomgr.dll
%ProgramFiles%\Hard Disk Sentinel\hdsevtmsg.dll
%ProgramFiles%\Hard Disk Sentinel\fnp_act_installer.dll
%ProgramFiles%\Hard Disk Sentinel\detw64.dll
%ProgramFiles%\Hard Disk Sentinel\detw.dll
%ProgramFiles%\Hard Disk Sentinel\detrd64.dll
%ProgramFiles%\Hard Disk Sentinel\detrd.dll
%ProgramFiles%\Hard Disk Sentinel\detrc.dll
%ProgramFiles%\Hard Disk Sentinel\detp.dll
%ProgramFiles%\Hard Disk Sentinel\detmv.dll
%ProgramFiles%\Hard Disk Sentinel\ropro.lng
%ProgramFiles%\Hard Disk Sentinel\ukpro.lng
%ProgramFiles%\Hard Disk Sentinel\ro.lng
%ProgramFiles%\Hard Disk Sentinel\ptbrpro.lng
%ProgramFiles%\Hard Disk Sentinel\ptbr.lng
%ProgramFiles%\Hard Disk Sentinel\Statusn.icd
%ProgramFiles%\Hard Disk Sentinel\bgpro.lng
%ProgramFiles%\Hard Disk Sentinel\bg.lng
%ProgramFiles%\Hard Disk Sentinel\bepro.lng
%ProgramFiles%\Hard Disk Sentinel\be.lng
%ProgramFiles%\Hard Disk Sentinel\arpro.lng
%ProgramFiles%\Hard Disk Sentinel\ar.lng
%ProgramFiles%\Hard Disk Sentinel\Vista_Statusw.icd
%ProgramFiles%\Hard Disk Sentinel\Vista_Statusn.icd
%ProgramFiles%\Hard Disk Sentinel\Vista_Statusg.icd
%ProgramFiles%\Hard Disk Sentinel\Vista_Statusb.icd
%ProgramFiles%\Hard Disk Sentinel\Vista_Status.icd
%ProgramFiles%\Hard Disk Sentinel\Statusw.icd
%ProgramFiles%\Hard Disk Sentinel\Statusg.icd
%ProgramFiles%\Hard Disk Sentinel\cnpro.lng
%ProgramFiles%\Hard Disk Sentinel\Statusb.icd
%ProgramFiles%\Hard Disk Sentinel\Status.icd
%ProgramFiles%\Hard Disk Sentinel\winspool.drv
%ProgramFiles%\Hard Disk Sentinel\storelib2.dlz
%ProgramFiles%\Hard Disk Sentinel\detpex.dlz
%ProgramFiles%\Hard Disk Sentinel\detect.dat
%ProgramFiles%\Hard Disk Sentinel\HDSentinel.ini
%ProgramFiles%\Hard Disk Sentinel\hdsversion.txt
%ProgramFiles%\Hard Disk Sentinel\removehds7.vbs
%ProgramFiles%\Hard Disk Sentinel\Hdsentinel.key
%ProgramFiles%\Hard Disk Sentinel\hdd.jpg
%ProgramFiles%\Hard Disk Sentinel\HDnotify.wav
%ProgramFiles%\Hard Disk Sentinel\DISKDATA_XXware_Xirtual_IDE_Hard_Drive_11000000000000000001_00000001.hdi
%ProgramFiles%\Hard Disk Sentinel\detjm2.dll
%ProgramFiles%\Hard Disk Sentinel\cz.lng
%ProgramFiles%\Hard Disk Sentinel\dapro.lng
%ProgramFiles%\Hard Disk Sentinel\cn.lng
%ProgramFiles%\Hard Disk Sentinel\plpro.lng
%ProgramFiles%\Hard Disk Sentinel\pl.lng
%ProgramFiles%\Hard Disk Sentinel\mkpro.lng
%ProgramFiles%\Hard Disk Sentinel\mk.lng
%ProgramFiles%\Hard Disk Sentinel\kopro.lng
%ProgramFiles%\Hard Disk Sentinel\ko.lng
%ProgramFiles%\Hard Disk Sentinel\jppro.lng
%ProgramFiles%\Hard Disk Sentinel\jp.lng
%ProgramFiles%\Hard Disk Sentinel\itpro.lng
%ProgramFiles%\Hard Disk Sentinel\it.lng
%ProgramFiles%\Hard Disk Sentinel\idpro.lng
%ProgramFiles%\Hard Disk Sentinel\id.lng
%ProgramFiles%\Hard Disk Sentinel\hupro.lng
%ProgramFiles%\Hard Disk Sentinel\hu.lng
%ProgramFiles%\Hard Disk Sentinel\grpro.lng
%ProgramFiles%\Hard Disk Sentinel\gr.lng
%ProgramFiles%\Hard Disk Sentinel\frpro.lng
%ProgramFiles%\Hard Disk Sentinel\fr.lng
%ProgramFiles%\Hard Disk Sentinel\fipro.lng
%ProgramFiles%\Hard Disk Sentinel\fi.lng
%ProgramFiles%\Hard Disk Sentinel\enpro.lng
%ProgramFiles%\Hard Disk Sentinel\en.lng
%ProgramFiles%\Hard Disk Sentinel\dupro.lng
%ProgramFiles%\Hard Disk Sentinel\du.lng
%ProgramFiles%\Hard Disk Sentinel\depro.lng
%ProgramFiles%\Hard Disk Sentinel\de.lng
%ProgramFiles%\Hard Disk Sentinel\da.lng
%ProgramFiles%\Hard Disk Sentinel\DriveAddRemoveLog.txt

Удаляет следующие файлы:

%TEMP%\180622030613312.71831038.tmp

Другое:

Ищет следующие окна:

ClassName: 'Progman' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''

Создает и запускает на исполнение:

'%ProgramFiles%\Hard Disk Sentinel\HDSentinel.exe'
'%ProgramFiles%\Hard Disk Sentinel\detect.dll' *WMIC2* . "%TEMP%\180622030613312.71831038.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDrive