Trojan.Siggen9.54293

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = ''
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'X:\windows\system32\userinit.exe,'

Вредоносные функции

Внедряет код в

следующие системные процессы:

<SYSTEM32>\smss.exe

следующие пользовательские процессы:

vds.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\926e.tmp\926f.tmp\9270.bat
x:\windows\security\database\edb.log
x:\windows\security\database\tmp.edb
x:\windows\security\database\edb.chk
x:\windows\security\logs\backup.log
x:\windows\security\database\secedit.sdb
x:\windows\debug\netsetup.log
x:\windows\inf\setupapi.app.log
%BOOT_VOL%\boot\bcd.log
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
%BOOT_VOL%\boot\bcd
x:\windows\temp\bootfailure.txt
x:\windows\temp\bootstat.dat
x:\windows\temp\bcdinfo.txt
x:\windows\temp\diskcmd.txt
x:\windows\temp\disklayout.txt
x:\windows\system32\wbem\repository\objects.data
x:\windows\system32\wbem\repository\index.btr
x:\windows\system32\wbem\repository\mapping2.map
x:\windows\security\database\edbres00001.jrs
x:\windows\security\database\edbres00002.jrs
x:\windows\security\database\edbtmp.log
x:\windows\system32\winpeshl.log
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\system32\logfiles\scm\scm.evm
x:\windows\system32\microsoft\protect\s-1-5-18\user\8b0f13ee-4344-4d88-84fc-ca286ae1ebaa
x:\windows\system32\microsoft\protect\s-1-5-18\user\preferred
x:\windows\system32\logfiles\wmi\rtbackup\etwrtubpm.etl
x:\windows\serviceprofiles\networkservice\ntuser.dat
x:\windows\serviceprofiles\networkservice\ntuser.dat.log1
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\system32\wbem\repository\mapping3.map
x:\windows\temp\startuprepair.etl
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat
x:\windows\serviceprofiles\localservice\ntuser.dat.log1
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
nul
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\system32\wbem\repository\mapping1.map

Присваивает атрибут 'скрытый' для следующих файлов

x:\windows\serviceprofiles\networkservice\ntuser.dat
x:\windows\serviceprofiles\networkservice\ntuser.dat.log1
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\serviceprofiles\networkservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\serviceprofiles\networkservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat
x:\windows\serviceprofiles\localservice\ntuser.dat.log1
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat{90349790-f4a9-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tm.blf
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000001.regtrans-ms
x:\windows\serviceprofiles\localservice\ntuser.dat{b00d76f8-f4be-11df-b9a4-00237dcff0a4}.tmcontainer00000000000000000002.regtrans-ms

Удаляет следующие файлы

<DRIVERS>\1394bus.sys
<DRIVERS>\scsiport.sys
<DRIVERS>\scfilter.sys
<DRIVERS>\sbp2port.sys
<DRIVERS>\rspndr.sys
<DRIVERS>\rootmdm.sys
<DRIVERS>\rndismp.sys
<DRIVERS>\rdbss.sys
<DRIVERS>\rmcast.sys
<DRIVERS>\rdpwd.sys
<DRIVERS>\rdpvideominiport.sys
<DRIVERS>\rdprefmp.sys
<DRIVERS>\rdpencdd.sys
<DRIVERS>\rdpdr.sys
<DRIVERS>\rdpcdd.sys
<DRIVERS>\rdyboost.sys
<DRIVERS>\rdpbus.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\sisraid4.sys
<DRIVERS>\srvnet.sys
<DRIVERS>\srv2.sys
<DRIVERS>\srv.sys
<DRIVERS>\spsys.sys
<DRIVERS>\spldr.sys
<DRIVERS>\smclib.sys
<DRIVERS>\serial.sys
<DRIVERS>\serenum.sys
<DRIVERS>\sisraid2.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\sffp_mmc.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\sermouse.sys
<DRIVERS>\smb.sys
<DRIVERS>\storport.sys
<DRIVERS>\stexstor.sys
<DRIVERS>\raspppoe.sys
<DRIVERS>\npfs.sys
<DRIVERS>\nvstor.sys
<DRIVERS>\nvraid.sys
<DRIVERS>\null.sys
<DRIVERS>\ntfs.sys
<DRIVERS>\nsiproxy.sys
<DRIVERS>\nv_agp.sys
<DRIVERS>\nwifi.sys
<DRIVERS>\raspptp.sys
<DRIVERS>\netbt.sys
<DRIVERS>\netbios.sys
<DRIVERS>\ndproxy.sys
<DRIVERS>\ndiswan.sys
<DRIVERS>\ndisuio.sys
<DRIVERS>\netio.sys
<DRIVERS>\rassstp.sys
<DRIVERS>\ohci1394.sys
<DRIVERS>\peauth.sys
<DRIVERS>\portcls.sys
<DRIVERS>\rasacd.sys
<DRIVERS>\qwavedrv.sys
<DRIVERS>\ql40xx.sys
<DRIVERS>\ql2300.sys
<DRIVERS>\processr.sys
<DRIVERS>\rasl2tp.sys
<DRIVERS>\pacer.sys
<DRIVERS>\parport.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\pciidex.sys
<DRIVERS>\pciide.sys
<DRIVERS>\pci.sys
<DRIVERS>\partmgr.sys
<DRIVERS>\pcw.sys
<DRIVERS>\fltmgr.sys
<DRIVERS>\storvsc.sys
<DRIVERS>\vwifimp.sys
<DRIVERS>\volmgr.sys
<DRIVERS>\vwififlt.sys
<DRIVERS>\vwifibus.sys
<DRIVERS>\vsmraid.sys
<DRIVERS>\volsnap.sys
<DRIVERS>\volmgrx.sys
<DRIVERS>\wanarp.sys
<DRIVERS>\wacompen.sys
<DRIVERS>\vgapnp.sys
<DRIVERS>\vmbushid.sys
<DRIVERS>\vmbus.sys
<DRIVERS>\videoprt.sys
<DRIVERS>\viaide.sys
<DRIVERS>\vhdmp.sys
<DRIVERS>\vms3cap.sys
<DRIVERS>\vmstorfl.sys
<DRIVERS>\wd.sys
<DRIVERS>\vga.sys
<DRIVERS>\etc\networks
<DRIVERS>\etc\lmhosts.sam
<DRIVERS>\etc\hosts
<DRIVERS>\wudfrd.sys
<DRIVERS>\wudfpf.sys
<DRIVERS>\watchdog.sys
<DRIVERS>\etc\protocol
<DRIVERS>\ws2ifsl.sys
<DRIVERS>\winhv.sys
<DRIVERS>\wimmount.sys
<DRIVERS>\wfplwf.sys
<DRIVERS>\wdfldr.sys
<DRIVERS>\wdf01000.sys
<DRIVERS>\wmilib.sys
<DRIVERS>\wmiacpi.sys
<DRIVERS>\vdrvroot.sys
<DRIVERS>\usbuhci.sys
<DRIVERS>\tsusbgd.sys
<DRIVERS>\tssecsrv.sys
<DRIVERS>\terminpt.sys
<DRIVERS>\termdd.sys
<DRIVERS>\tdx.sys
<DRIVERS>\tsusbhub.sys
<DRIVERS>\tdtcp.sys
<DRIVERS>\tdi.sys
<DRIVERS>\tcpipreg.sys
<DRIVERS>\tcpip.sys
<DRIVERS>\tape.sys
<DRIVERS>\synth3dvsc.sys
<DRIVERS>\swenum.sys
<DRIVERS>\tdpipe.sys
<DRIVERS>\tunnel.sys
<DRIVERS>\uagp35.sys
<DRIVERS>\tsusbflt.sys
<DRIVERS>\udfs.sys
<DRIVERS>\usbrpm.sys
<DRIVERS>\usbcir.sys
<DRIVERS>\usbprint.sys
<DRIVERS>\usbport.sys
<DRIVERS>\usbohci.sys
<DRIVERS>\usbhub.sys
<DRIVERS>\usbehci.sys
<DRIVERS>\usbd.sys
<DRIVERS>\usbccgp.sys
<DRIVERS>\usbstor.sys
<DRIVERS>\usbcamd2.sys
<DRIVERS>\usb8023.sys
<DRIVERS>\umpass.sys
<DRIVERS>\umbus.sys
<DRIVERS>\uliagpkx.sys
<DRIVERS>\ndistapi.sys
<DRIVERS>\nfrd960.sys
<DRIVERS>\ndiscap.sys
<DRIVERS>\ndis.sys
<DRIVERS>\mup.sys
<DRIVERS>\compositebus.sys
<DRIVERS>\discache.sys
<DRIVERS>\dfsc.sys
<DRIVERS>\csc.sys
<DRIVERS>\crcdisk.sys
<DRIVERS>\crashdmp.sys
<DRIVERS>\bthmodem.sys
<DRIVERS>\diskdump.sys
<DRIVERS>\cdfs.sys
<DRIVERS>\cmdide.sys
<DRIVERS>\cmbatt.sys
<DRIVERS>\classpnp.sys
<DRIVERS>\circlass.sys
<DRIVERS>\cdrom.sys
<DRIVERS>\cng.sys
<DRIVERS>\compbatt.sys
<DRIVERS>\dmvsc.sys
<DRIVERS>\e1g6032e.sys
<DRIVERS>\elxstor.sys
<DRIVERS>\fdc.sys
<DRIVERS>\fastfat.sys
<DRIVERS>\exfat.sys
<DRIVERS>\evbda.sys
<DRIVERS>\errdev.sys
<DRIVERS>\fileinfo.sys
<DRIVERS>\drmk.sys
<DRIVERS>\drmkaud.sys
<DRIVERS>\dxgkrnl.sys
<DRIVERS>\dxg.sys
<DRIVERS>\dxapi.sys
<DRIVERS>\dumpfve.sys
<DRIVERS>\dumpata.sys
<DRIVERS>\dxgmms1.sys
<DRIVERS>\bxvbda.sys
<DRIVERS>\brusbser.sys
<DRIVERS>\filetrace.sys
<DRIVERS>\amdppm.sys
<DRIVERS>\amdk8.sys
<DRIVERS>\amdide.sys
<DRIVERS>\aliide.sys
<DRIVERS>\agp440.sys
<DRIVERS>\amdsbs.sys
<DRIVERS>\agilevpn.sys
<DRIVERS>\adpu320.sys
<DRIVERS>\adpahci.sys
<DRIVERS>\adp94xx.sys
<DRIVERS>\acpipmi.sys
<DRIVERS>\acpi.sys
<DRIVERS>\1394ohci.sys
<DRIVERS>\afd.sys
<DRIVERS>\amdxata.sys
<DRIVERS>\amdsata.sys
<DRIVERS>\appid.sys
<DRIVERS>\brusbmdm.sys
<DRIVERS>\blbdrive.sys
<DRIVERS>\brserwdm.sys
<DRIVERS>\brserid.sys
<DRIVERS>\bridge.sys
<DRIVERS>\brfiltup.sys
<DRIVERS>\brfiltlo.sys
<DRIVERS>\bowser.sys
<DRIVERS>\beep.sys
<DRIVERS>\arc.sys
<DRIVERS>\battc.sys
<DRIVERS>\b57nd60a.sys
<DRIVERS>\ataport.sys
<DRIVERS>\atapi.sys
<DRIVERS>\asyncmac.sys
<DRIVERS>\arcsas.sys
<DRIVERS>\etc\services
<DRIVERS>\stream.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\hcw85cir.sys
<DRIVERS>\lsi_fc.sys
<DRIVERS>\mrxdav.sys
<DRIVERS>\mpsdrv.sys
<DRIVERS>\mpio.sys
<DRIVERS>\mountmgr.sys
<DRIVERS>\mouhid.sys
<DRIVERS>\mrxsmb.sys
<DRIVERS>\mouclass.sys
<DRIVERS>\modem.sys
<DRIVERS>\megasr.sys
<DRIVERS>\megasas.sys
<DRIVERS>\mcd.sys
<DRIVERS>\luafv.sys
<DRIVERS>\lsi_scsi.sys
<DRIVERS>\monitor.sys
<DRIVERS>\lsi_sas2.sys
<DRIVERS>\mrxsmb20.sys
<DRIVERS>\msahci.sys
<DRIVERS>\disk.sys
<DRIVERS>\mtconfig.sys
<DRIVERS>\mstee.sys
<DRIVERS>\mssmbios.sys
<DRIVERS>\msrpc.sys
<DRIVERS>\mspqm.sys
<DRIVERS>\msiscsi.sys
<DRIVERS>\mspclock.sys
<DRIVERS>\mskssrv.sys
<DRIVERS>\msisadrv.sys
<DRIVERS>\mshidkmdf.sys
<DRIVERS>\msftwdf_kernel_01009_inbox_critical.wdf
<DRIVERS>\msfs.sys
<DRIVERS>\msdsm.sys
<DRIVERS>\mrxsmb10.sys
<DRIVERS>\lsi_sas.sys
<DRIVERS>\lltdio.sys
<DRIVERS>\ksthunk.sys
<DRIVERS>\hdaudbus.sys
<DRIVERS>\hidir.sys
<DRIVERS>\hidclass.sys
<DRIVERS>\hidbth.sys
<DRIVERS>\hidbatt.sys
<DRIVERS>\hdaudio.sys
<DRIVERS>\hidparse.sys
<DRIVERS>\hidusb.sys
<DRIVERS>\hpsamd.sys
<DRIVERS>\gm.dls
<DRIVERS>\gagp30kx.sys
<DRIVERS>\fwpkclnt.sys
<DRIVERS>\fvevol.sys
<DRIVERS>\fs_rec.sys
<DRIVERS>\gmreadme.txt
<DRIVERS>\http.sys
<DRIVERS>\ksecdd.sys
<DRIVERS>\i8042prt.sys
<DRIVERS>\ksecpkg.sys
<DRIVERS>\ipnat.sys
<DRIVERS>\ks.sys
<DRIVERS>\kbdhid.sys
<DRIVERS>\kbdclass.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\irenum.sys
<DRIVERS>\irda.sys
<DRIVERS>\ipmidrv.sys
<DRIVERS>\hwpolicy.sys
<DRIVERS>\ipfltdrv.sys
<DRIVERS>\intelppm.sys
<DRIVERS>\intelide.sys
<DRIVERS>\iirsp.sys
<DRIVERS>\iastorv.sys
<DRIVERS>\fsdepends.sys
x:\windows\temp\diskcmd.txt

Перемещает следующие файлы

x:\windows\security\database\edbtmp.log в x:\windows\security\database\edb.log

Подменяет следующие файлы

x:\windows\security\database\edbtmp.log

Другое

Ищет следующие окна

ClassName: 'CicLoaderWndClass' WindowName: ''

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\926E.tmp\926F.tmp\9270.bat <Полный путь к файлу>"' (со скрытым окном)
'x:\windows\system32\cmd.exe' /c bcdedit.exe -enum all > X:\windows\TEMP\bcdinfo.txt' (со скрытым окном)
'x:\windows\system32\cmd.exe' /c DiskPart.exe /s X:\windows\TEMP\diskcmd.txt > X:\windows\TEMP\disklayout.txt' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\926E.tmp\926F.tmp\9270.bat <Полный путь к файлу>"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\taskmgr.exe /p user:N
'<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
'<SYSTEM32>\cacls.exe' <SYSTEM32>\taskmgr.exe /p user:N
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\aclui.exe /p user:N
'<SYSTEM32>\cacls.exe' <SYSTEM32>\aclui.exe /p user:N
'<SYSTEM32>\takeown.exe' /f <DRIVERS> /r /d y
'<SYSTEM32>\cacls.exe' <DRIVERS> /g user:F
'<SYSTEM32>\cacls.exe' <SYSTEM32> /p user:N
'<SYSTEM32>\ping.exe' -n 5 localhost
'<SYSTEM32>\shutdown.exe' /p

Пытается завершить работу операционной системы Windows.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней