Trojan.Siggen9.54647

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\TCube\shell\open\command] '' = '"%WINDIR%\Teruten\TCube\TCubeAgent.exe" %1'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\TCube] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\TCube] 'ImagePath' = '%WINDIR%\Teruten\TCube\TCubeServiceMgr64.exe'

Вредоносные функции

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменяет следующие настройки браузера Windows Internet Explorer

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsn24a2.tmp\checkprocess.dll
%WINDIR%\teruten\tcube\watermark.bmp
%WINDIR%\teruten\tcube\tpwatermark.ini
%WINDIR%\teruten\tcube\tpwatermarkup.dll
%WINDIR%\teruten\tcube\importpfx.exe
%WINDIR%\teruten\tcube\localhost.p12
%WINDIR%\teruten\tcube\localhost_xp.p12
%WINDIR%\teruten\tcube\trclib.dll
%WINDIR%\teruten\tcube\tremote_server.exe
%WINDIR%\teruten\tcube\tcube.log
%WINDIR%\teruten\tcube\tcubeservicemgr64.exe
%WINDIR%\teruten\tcube\tcubeobserver64.exe
%WINDIR%\teruten\tcube\tcubeversion.ver
%WINDIR%\syswow64\tftlib.dll
%PROGRAMDATA%\microsoft\crypto\rsa\s-1-5-18\35466fbdf0510c1707d2aefb4deac459_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%WINDIR%\syswow64\t_prevent.dll
%WINDIR%\syswow64\tdcommonlib.dll
%WINDIR%\syswow64\tftlib64.dll
%WINDIR%\syswow64\t_prevent64.dll
%WINDIR%\syswow64\tdcommonlib64.dll
%WINDIR%\syswow64\rdutil.dll
<SYSTEM32>\rdutil64.dll
%WINDIR%\syswow64\tdepend.exe
%WINDIR%\syswow64\tdepend64.exe
%WINDIR%\syswow64\wmlogo.bmp
%WINDIR%\syswow64\tpwatermark.dll
%WINDIR%\syswow64\tpwatermark64.dll
%WINDIR%\teruten\tcube\tmwatermarkup.dll
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert_override.txt
%WINDIR%\teruten\tcube\tmwup.exe
%WINDIR%\teruten\tcube\tdcommonlib64up.dll
%TEMP%\nsn24a2.tmp\tcube.log
%TEMP%\nsn24a2.tmp\killproc.dll
%TEMP%\nsn24a2.tmp\system.dll
%WINDIR%\teruten\tcube\tcubeservicemgr64b.exe
%WINDIR%\teruten\tcube\tcubeobserver64b.exe
%WINDIR%\teruten\tcube\tcube.ocx
%WINDIR%\teruten\tcube\tcube64.ocx
%WINDIR%\teruten\tcube\tcubeupdater64.exe
%WINDIR%\teruten\tcube\tcubedummy64.exe
%WINDIR%\teruten\tcube\uninstall64.exe
%WINDIR%\teruten\tcube\tmodule64.dll
%WINDIR%\teruten\tcube\t_prevent64up.dll
%WINDIR%\teruten\tcube\tdepend64up.exe
%WINDIR%\teruten\tcube\rdutil.dll
%WINDIR%\teruten\tcube\tftlib64up.dll
%WINDIR%\teruten\tcube\rdutil64.dll
%WINDIR%\teruten\tcube\tmw64up.exe
%WINDIR%\teruten\tcube\tmwatermark64up.dll
%WINDIR%\teruten\tcube\tpwatermark64up.dll
%WINDIR%\teruten\tcube\t_preventup.dll
%WINDIR%\teruten\tcube\tdcommonlibup.dll
%WINDIR%\teruten\tcube\tdependup.exe
%WINDIR%\teruten\tcube\tftlibup.dll
%WINDIR%\teruten\tcube\wmlogo.bmp
%WINDIR%\teruten\tcube\nptcube.dll
%WINDIR%\teruten\tcube\tcubeagent.exe
%WINDIR%\teruten\tcube\tmwatermark.ini
%PROGRAMDATA%\microsoft\crypto\rsa\s-1-5-18\600c9e92833d6758d9691abf6d4a560c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Удаляет следующие файлы

%WINDIR%\teruten\tcube\localhost.p12
%WINDIR%\teruten\tcube\localhost_xp.p12
%WINDIR%\teruten\tcube\importpfx.exe
%TEMP%\nsn24a2.tmp\checkprocess.dll
%TEMP%\nsn24a2.tmp\killproc.dll
%TEMP%\nsn24a2.tmp\system.dll

Другое

Добавляет корневой сертификат

Создает и запускает на исполнение

'%WINDIR%\teruten\tcube\tcubeupdater64.exe' /silent
'%WINDIR%\teruten\tcube\tcubeservicemgr64.exe'
'%WINDIR%\teruten\tcube\importpfx.exe' -f "%WINDIR%\Teruten\TCube\localhost.p12" -p teruten123 -t MACHINE -s root
'%WINDIR%\teruten\tcube\importpfx.exe' -f "%WINDIR%\Teruten\TCube\localhost_xp.p12" -p teruten123 -t MACHINE -s root
'%WINDIR%\teruten\tcube\tcubedummy64.exe' 0
'%WINDIR%\teruten\tcube\tcubeobserver64.exe'
'%WINDIR%\teruten\tcube\importpfx.exe' -f "%WINDIR%\Teruten\TCube\localhost.p12" -p teruten123 -t MACHINE -s root' (со скрытым окном)
'%WINDIR%\teruten\tcube\importpfx.exe' -f "%WINDIR%\Teruten\TCube\localhost_xp.p12" -p teruten123 -t MACHINE -s root' (со скрытым окном)

Запускает на исполнение