Trojan.Siggen9.18115

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\08Y10U01R1X11T11P1V1] 'ImagePath' = '%TEMP%\08Y10U01R1X11T11P1V1.dat'
[<HKLM>\System\CurrentControlSet\Services\UxSms] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Themes] 'Start' = '00000002'

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop uxsms

Ищет следующие окна с целью

обнаружения различных программ и игр:

ClassName: 'TXGuiFoundation', WindowName: 'ГЊГљГ‘В¶ГЉГ–Г“ГЋГ–ГєГЉГ–ВЎВѕВјВ«Г‹Г™В°ГЃГ’ГЅГ‡Г¦ВЎВї'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\08y10u01r1x11t11p1v1.dat
C:\wp.ini
C:\lj2.bat
C:\aero.bat
nul
%WINDIR%\fonts\msyhbd.ttc
<Текущая директория>\cjzc.dll
<Текущая директория>\mydx11.dll

Удаляет следующие файлы

%TEMP%\08y10u01r1x11t11p1v1.dat
%WINDIR%\logs\dpx\setuperr.log
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen.log
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen_service.log
%WINDIR%\panther\cbs.log
%WINDIR%\panther\ddaclsys.log
%WINDIR%\panther\setupact.log
%WINDIR%\panther\setuperr.log
%WINDIR%\panther\unattendgc\setupact.log
%WINDIR%\panther\unattendgc\setuperr.log
%WINDIR%\performance\winsat\winsat.log
%WINDIR%\security\logs\scesetup.log
%WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\windowsupdate.log
%WINDIR%\serviceprofiles\localservice\appdata\roaming\peernetworking\b8887980aee093664ab3bb254ee38ade63e8b7ff.homegroupclassifier\83511c0838e48947d895ba33d3c45b29\grouping\edb.log
%WINDIR%\softwaredistribution\reportingevents.log
%WINDIR%\softwaredistribution\datastore\logs\edb.log
%WINDIR%\softwaredistribution\datastore\logs\edb00001.log
<SYSTEM32>\catroot2\edb00562.log
%WINDIR%\logs\dpx\setupact.log
%WINDIR%\syswow64\macromed\flash\flashinstall.log
%WINDIR%\logs\cbs\cbs.log
%WINDIR%\inf\setupapi.offline.log
%WINDIR%\temp\dmi8538.tmp
%WINDIR%\temp\ts_267a.tmp
%WINDIR%\temp\ts_2b0f.tmp
%WINDIR%\temp\ts_2bfb.tmp
%WINDIR%\temp\ts_316a.tmp
%WINDIR%\temp\ts_361e.tmp
%WINDIR%\temp\ts_3852.tmp
%WINDIR%\temp\ts_39ba.tmp
%WINDIR%\temp\ts_4f66.tmp
%WINDIR%\temp\ts_5080.tmp
%WINDIR%\temp\ts_77d1.tmp
%WINDIR%\temp\ts_8e67.tmp
%WINDIR%\directx.log
%WINDIR%\dtcinstall.log
%WINDIR%\pfro.log
%WINDIR%\setupact.log
%WINDIR%\setuperr.log
%WINDIR%\tssysprep.log
%WINDIR%\windowsupdate.log
%WINDIR%\debug\sammui.log
%WINDIR%\debug\wia\wiatrace.log
%WINDIR%\inf\setupapi.app.log
%WINDIR%\inf\setupapi.dev.log
%WINDIR%\logs\directx.log
%WINDIR%\temp\adobearm.log

Другое

Ищет следующие окна

ClassName: 'LDPlayerMainFrame' WindowName: 'ГЂГ—ВµГ§Г„ВЈГ„ГўГ†Г·'
ClassName: 'AEngineRenderWindowClass' WindowName: ''
ClassName: 'Qt5QWindowIcon' WindowName: 'ГҐГђГ’ВЈГ„ВЈГ„ГўГ†Г·'
ClassName: 'Qt5QWindowIcon' WindowName: 'ВѕГёВµГГ‡ГіГ‰Гє ВґГЊВјВ¤Г•ВЅВіВЎ - MuMuГ„ВЈГ„ГўГ†Г·'
ClassName: 'Qt5QWindowIcon' WindowName: 'PUBG MOBILE - MuMuГ„ВЈГ„ГўГ†Г·'
ClassName: 'BS2CHINAUI' WindowName: 'BlueStacks App Player'
ClassName: 'Qt5QWindowIcon' WindowName: 'Г’В№Г‰Г±Г„ВЈГ„ГўГ†Г·'
ClassName: 'Qt5QWindowIcon' WindowName: 'ГЉГ–В»Гє1'

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""C:\lj2.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c net start "Desktop Window Manager Session Manager"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""C:\lj2.bat" "
'%WINDIR%\syswow64\cmd.exe' /c net start "Desktop Window Manager Session Manager"
'%WINDIR%\syswow64\net.exe' start "Desktop Window Manager Session Manager"
'%WINDIR%\syswow64\net1.exe' start "Desktop Window Manager Session Manager"
'%WINDIR%\syswow64\cmd.exe' /c ""C:\aero.bat" "
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
'%WINDIR%\syswow64\sc.exe' config UxSms start= auto
'%WINDIR%\syswow64\sc.exe' config Themes start= auto
'%WINDIR%\syswow64\net.exe' start Themes
'%WINDIR%\syswow64\net1.exe' start Themes
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\DWM" /v Composition /t reg_dword /d 00000001 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\DWM" /v CompositionPolicy /t reg_dword /d 00000002 /f
'%WINDIR%\syswow64\net1.exe' stop uxsms
'%WINDIR%\syswow64\net.exe' start uxsms
'%WINDIR%\syswow64\net1.exe' start uxsms