Trojan.Siggen11.48338

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNOTIFY.EXE] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UsoClient.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MusNotification.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdateAssistant.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINDOWS10UPGRADERAPP.EXE] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\remsh.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SIHClient.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallAgent.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaaSMedic.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaasMedicAgent.exe] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MUSNOTIFICATIONUX.EXE] 'Debugger' = '*'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UPFC.EXE] 'Debugger' = '*'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'ImagePath' = '%WINDIR%\USPDSATE\SU10Guard.exe'
[<HKLM>\SYSTEM\CurrentControlSet\Services\wuauserv] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\WaasMedicSvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\USOSVC] 'Start' = '00000002'

Создает следующие сервисы

'SU10Guard' %WINDIR%\USPDSATE\SU10Guard.exe

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Обновления системы (Windows Update)

удаляет теневые копии разделов.

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\uspdsate\j1gg33e7.cfg
%WINDIR%\uspdsate\dolbymatenc.dll
%WINDIR%\uspdsate\domgmt.dll
%WINDIR%\uspdsate\dosettings.dll
%WINDIR%\uspdsate\doskey.exe
%WINDIR%\uspdsate\dosvc.dll
%WINDIR%\uspdsate\dot3api.dll
%WINDIR%\uspdsate\dot3cfg.dll
%WINDIR%\uspdsate\dot3conn.dll
%WINDIR%\uspdsate\dot3dlg.dll
%WINDIR%\uspdsate\dot3gpclnt.dll
%WINDIR%\uspdsate\dot3gpui.dll
%WINDIR%\uspdsate\dot3hc.dll
%WINDIR%\uspdsate\dot3mm.dll
%WINDIR%\uspdsate\dot3msm.dll
%WINDIR%\uspdsate\dot3ui.dll
%WINDIR%\uspdsate\su10guard.log
%WINDIR%\uspdsate\dpapi.dll
%WINDIR%\uspdsate\dpapimig.exe
%WINDIR%\uspdsate\dpapiprovider.dll
%WINDIR%\uspdsate\dpapisrv.dll
%WINDIR%\uspdsate\dpiscaling.exe
%WINDIR%\uspdsate\dpnaddr.dll
%WINDIR%\uspdsate\dpnathlp.dll
%WINDIR%\uspdsate\dpnet.dll
%WINDIR%\uspdsate\dpnhpast.dll
%WINDIR%\uspdsate\j1gg33e7.exe
%WINDIR%\uspdsate\su10guard.exe
%WINDIR%\uspdsate\t20hr2bn.exe
%WINDIR%\uspdsate\wu.exe
%WINDIR%\uspdsate\t20hr2bnlog.txt
%WINDIR%\uspdsate\dolbyhrtfenc.dll
%WINDIR%\uspdsate\dot3svc.dll
%WINDIR%\uspdsate\documentperformanceevents.dll
%WINDIR%\uspdsate\lang\japanese_meiryo\stopupdates10.nat
%WINDIR%\uspdsate\lang\arabic\stopupdates10.nat
%WINDIR%\uspdsate\lang\brazilianportuguese\stopupdates10.nat
%WINDIR%\uspdsate\lang\bulgarian\stopupdates10.nat
%WINDIR%\uspdsate\lang\catalan\stopupdates10.nat
%WINDIR%\uspdsate\lang\chinesetraditional\stopupdates10.nat
%WINDIR%\uspdsate\lang\czech\stopupdates10.nat
%WINDIR%\uspdsate\lang\czech2\stopupdates10.nat
%WINDIR%\uspdsate\lang\french\stopupdates10.nat
%WINDIR%\uspdsate\lang\german\stopupdates10.nat
%WINDIR%\uspdsate\lang\greek\stopupdates10.nat
%WINDIR%\uspdsate\lang\greek\wu.nat
%WINDIR%\uspdsate\lang\hungarian\stopupdates10.nat
%WINDIR%\uspdsate\lang\italian\stopupdates10.nat
%WINDIR%\uspdsate\lang\japanese\stopupdates10.nat
%WINDIR%\uspdsate\lang\korean\stopupdates10.nat
%WINDIR%\uspdsate\translate\stopupdates10.nat
%WINDIR%\uspdsate\lang\polish\stopupdates10.nat
%WINDIR%\uspdsate\lang\russian\stopupdates10.nat
%WINDIR%\uspdsate\lang\russian\wu.nat
%WINDIR%\uspdsate\lang\spanish\stopupdates10.nat
%WINDIR%\uspdsate\lang\spanish2\stopupdates10.nat
%WINDIR%\uspdsate\lang\turkish\stopupdates10.nat
%WINDIR%\uspdsate\lang\ukrainian\stopupdates10.nat
%WINDIR%\uspdsate\lang\ukrainian\wu.nat
%WINDIR%\uspdsate\stopupdates10w.ini
%WINDIR%\uspdsate\translate\change-from-234-to-250.upd
%WINDIR%\uspdsate\translate\change-from-250-to-255.upd
%WINDIR%\uspdsate\translate\change-from-255-to-300.upd
%WINDIR%\uspdsate\translate\change-from-300-to-350.upd
%WINDIR%\uspdsate\translate\how_to_translate.txt
%WINDIR%\uspdsate\translate\wu.nat
%TEMP%\7zsfx000.cmd

Удаляет следующие файлы

%WINDIR%\uspdsate\su10guard.log
%TEMP%\7zsfx000.cmd

Подменяет следующие файлы

%WINDIR%\uspdsate\su10guard.log

Самоудаляется.

Другое

Создает и запускает на исполнение

'%WINDIR%\uspdsate\t20hr2bn.exe' /disable
'%WINDIR%\uspdsate\su10guard.exe' -i
'%WINDIR%\uspdsate\su10guard.exe'
'%WINDIR%\uspdsate\j1gg33e7.exe' /Run
'%WINDIR%\uspdsate\su10guard.exe' -i' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /C ping 127.0.0.1 -n 50 && vssadmin.exe delete shadows /all /quiet
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 50
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv