Trojan.Siggen13.521

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\tvratings\conhost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\cryptui\dwm.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\cryptui\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\ws2_32\services.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\ws2_32\services.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\d3dx9_31\csrss.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\d3dx9_31\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\tvratings\conhost.exe", "%ProgramFiles%\B2\explorer.exe", "C:\totalcmd\LANGUAGE\audiodg.exe",...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\totalcmd\LANGUAGE\audiodg.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\totalcmd\LANGUAGE\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\tvratings\conhost.exe", "%ProgramFiles%\B2\explorer.exe", "C:\totalcmd\LANGUAGE\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%ProgramFiles%\B2\explorer.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%ProgramFiles%\B2\explorer.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<SYSTEM32>\tvratings\conhost.exe", "%ProgramFiles%\B2\explorer.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"<SYSTEM32>\tvratings\conhost.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"<SYSTEM32>\tvratings\conhost.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"C:\sessionhostmonitor\WmiPrvSE.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"C:\sessionhostmonitor\WmiPrvSE.exe"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\conhost
<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\wmiprvse

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\donate_caper2021.exe
<SYSTEM32>\cryptui\6cb0b6c459d5d3455a3da700e713f2e2529862ff
<SYSTEM32>\cryptui\dwm.exe
<SYSTEM32>\ws2_32\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
<SYSTEM32>\ws2_32\services.exe
<SYSTEM32>\d3dx9_31\886983d96e3d3e31032c679b2d4ea91b6c05afef
<SYSTEM32>\d3dx9_31\csrss.exe
C:\totalcmd\language\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
C:\totalcmd\language\audiodg.exe
%ProgramFiles%\b2\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
%ProgramFiles%\b2\explorer.exe
<SYSTEM32>\tvratings\088424020bedd6b28ac7fd22ee35dcd7322895ce
<SYSTEM32>\tvratings\conhost.exe
C:\sessionhostmonitor\rfinn2wh.vbe
C:\sessionhostmonitor\sessionhostmonitorsavesruntimenet.exe
C:\sessionhostmonitor\1blszlijyv82rdjzrd2y.bat
C:\sessionhostmonitor\wmiprvse.exe
C:\sessionhostmonitor\24dbde2999530ef5fd907494bc374d663924116c

Сетевая активность

Подключается к

'cw####2.tmweb.ru':80
'ip##fo.io':443

TCP

Запросы HTTP GET

http://cw####2.tmweb.ru/pythonlowupdateprotectdefault.php?YR#####################################################################################################################################...

'ip##fo.io':443

UDP

DNS ASK cw####2.tmweb.ru
DNS ASK ip##fo.io

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%APPDATA%\donate_caper2021.exe'
'%WINDIR%\syswow64\wscript.exe' "C:\sessionhostmonitor\RfInN2Wh.vbe"
'C:\sessionhostmonitor\sessionhostmonitorsavesruntimenet.exe'
'C:\sessionhostmonitor\wmiprvse.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""C:\sessionhostmonitor\1blSZLIJyv82rdJZrD2y.bat" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""C:\sessionhostmonitor\1blSZLIJyv82rdJZrD2y.bat" "
'<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'<SYSTEM32>\tvratings\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%ProgramFiles%\B2\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\d3dx9_31\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<SYSTEM32>\ws2_32\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\cryptui\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\sessionhostmonitor\WmiPrvSE.exe'" /rl HIGHEST /f