Trojan.Siggen11.62830

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\fxsound.pro-1.1.2.0.exe
%ProgramFiles%\fxsound\drivers\dfx12.inf
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1x64.sys
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1x64.inf
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1ntx86.cat
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1ntamd64.cat
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1.sys
%ProgramFiles%\fxsound\drivers\bootstrap\dfx11_1.inf
%ProgramFiles%\fxsound\apps\dfxsetupdrv.exe
%ProgramFiles%\fxsound\drivers\bootstrap\ptdevcon64.exe
%ProgramFiles%\fxsound\drivers\bootstrap\ptdevcon32.exe
%ProgramFiles%\fxsound\drivers\ptdevcon64.exe
%ProgramFiles%\fxsound\drivers\ptdevcon32.exe
%ALLUSERSPROFILE%\fxsound\fxsound.settings
%ProgramFiles%\fxsound\fxsound.exe
%TEMP%\aifilesback_b1e92d0a_b69a_4dee_9019_78d294cb82f9.bak
%LOCALAPPDATA%\advinstanalytics\5fdaded5d89551738a950c2b\1.1.2.0\{ba5ea924-ae16-41ad-b3fe-a77bb132f77f}.session
%LOCALAPPDATA%\advinstanalytics\5fdaded5d89551738a950c2b\1.1.2.0\{62c75887-6b5e-4dc0-9594-918d7618d662}.session
%LOCALAPPDATA%\advinstanalytics\5fdaded5d89551738a950c2b\1.1.2.0\tracking.ini
%TEMP%\msi21877\installeranalytics.dll
%ProgramFiles%\fxsound\drivers\dfx12.sys
%ProgramFiles%\fxsound\drivers\dfx12ntamd64.cat
%ProgramFiles%\fxsound\drivers\dfx12ntx86.cat
%ProgramFiles%\fxsound\drivers\dfx12x64.inf
%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set7271.tmp
%ProgramFiles%\fxsound\updater.ini
C:\users\public\desktop\fxsound.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fxsound\fxsound.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fxsound\check for fxsound updates.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\fxsound.lnk
%WINDIR%\installer\{b1e92d0a-b69a-4dee-9019-78d294cb82f9}\fxsound.exe
%ProgramFiles%\fxsound\factsoft\8.fac
%ProgramFiles%\fxsound\factsoft\7.fac
%ProgramFiles%\fxsound\factsoft\5.fac
%ProgramFiles%\fxsound\factsoft\6.fac
%ProgramFiles%\fxsound\factsoft\4.fac
%ProgramFiles%\fxsound\factsoft\3.fac
%ProgramFiles%\fxsound\factsoft\2.fac
%ProgramFiles%\fxsound\factsoft\1.fac
%ProgramFiles%\fxsound\apps\dfxinstall.dll
%ProgramFiles%\fxsound\updater.exe
%WINDIR%\syswow64\dfx11.ico
%ProgramFiles%\fxsound\shaferfilechck.dll
%ProgramFiles%\fxsound\drivers\dfx12x64.sys
%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set734c.tmp
%TEMP%\msi21877\embeddeduiproxy.dll
%TEMP%\msifd603.log
%TEMP%\temp\systemfolder\dfx11.ico
%TEMP%\temp\drivers\bootstrap\dfx11_1ntamd64.cat
%TEMP%\temp\drivers\bootstrap\dfx11_1.sys
%TEMP%\temp\drivers\bootstrap\dfx11_1.inf
%TEMP%\temp\drivers\ptdevcon64.exe
%TEMP%\temp\drivers\ptdevcon32.exe
%TEMP%\temp\commonappdatafolder\fxsound\fxsound.settings
%TEMP%\temp\apps\dfxsetupdrv.exe
%TEMP%\temp\apps\dfxinstall.dll
%TEMP%\temp\updater.exe
%TEMP%\temp\packeg.msi
%TEMP%\temp\shaferfilechck.dll
%TEMP%\temp\fxsound.exe
%APPDATA%\fxsound\86\commonappdatafolder\fxsound\fxsound.settings
%APPDATA%\fxsound\64rus — ГЄГ®ГЇГЁГї\commonappdatafolder\fxsound\fxsound.settings
%APPDATA%\fxsound\64rus\commonappdatafolder\fxsound\fxsound.settings
%APPDATA%\fxsound\64\commonappdatafolder\fxsound\fxsound.settings
%APPDATA%\fxsound\fxsound.settings
%TEMP%\nsrcb2d.tmp\system.dll
%TEMP%\nswcafd.tmp
%TEMP%\temp\drivers\bootstrap\dfx11_1ntx86.cat
%TEMP%\temp\drivers\bootstrap\dfx11_1x64.inf
%TEMP%\temp\drivers\bootstrap\dfx11_1x64.sys
%TEMP%\temp\drivers\bootstrap\ptdevcon32.exe
%TEMP%\temp\factsoft\7.fac
%TEMP%\temp\factsoft\6.fac
%TEMP%\temp\factsoft\5.fac
%TEMP%\temp\factsoft\4.fac
%TEMP%\temp\factsoft\3.fac
%TEMP%\temp\factsoft\2.fac
%TEMP%\temp\factsoft\1.fac
%TEMP%\temp\drivers\xp_win7\dfx12x64.sys
%TEMP%\temp\drivers\xp_win7\dfx12x64.inf
%TEMP%\temp\drivers\xp_win7\dfx12ntamd64.cat
%TEMP%\temp\drivers\xp_win7\dfx12ntx86.cat
%TEMP%\temp\drivers\xp_win7\dfx12.sys
%TEMP%\temp\drivers\xp_win7\dfx12.inf
%TEMP%\temp\drivers\win10\dfx12x64.sys
%TEMP%\temp\drivers\win10\dfx12x64.inf
%TEMP%\temp\drivers\win10\dfx12ntx86.cat
%TEMP%\temp\drivers\win10\dfx12ntamd64.cat
%TEMP%\temp\drivers\win10\dfx12.sys
%TEMP%\temp\drivers\win10\dfx12.inf
%TEMP%\temp\drivers\bootstrap\ptdevcon64.exe
%TEMP%\temp\factsoft\8.fac
%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set7418.tmp

Удаляет следующие файлы

%TEMP%\aifilesback_b1e92d0a_b69a_4dee_9019_78d294cb82f9.bak

Перемещает следующие файлы

%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set7271.tmp в %TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\dfx12x64.sys
%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set734c.tmp в %TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\dfx12ntamd64.cat
%TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\set7418.tmp в %TEMP%\{2c0d0f55-c220-4753-bac1-cb2180a81120}\dfx12x64.inf

Сетевая активность

Подключается к

'microsoft.com':80

UDP

DNS ASK microsoft.com

Другое

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\fxsound.pro-1.1.2.0.exe' /S /NCRC
'%ProgramFiles%\fxsound\apps\dfxsetupdrv.exe' check
'%ProgramFiles%\fxsound\drivers\ptdevcon64.exe' install

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\TEMP\packeg.msi" /qb APPDIR="%ProgramFiles%\FxSound"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{38bc73a6-87b9-34e9-4709-fc1f7cc4e914} Global\{1efa3cb9-89f2-3e30-ad03-0c4a7feab812} <DRIVERSTORE>\Temp\{356e9ae1-369c-4a93-3631-3627...