Trojan.Siggen5.13019

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Jirachi' = 'Jirachi.exe'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /F /T /R

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\sunbannA.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tech.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Technical.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Sweets Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Sweets.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Maize.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Network Blitz Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Network Blitz.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Nature.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\MSONSEXT.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\MSOWS409.exe
%CommonProgramFiles%\Microsoft Shared\VC\msdia90.exe
%CommonProgramFiles%\Microsoft Shared\VGX\vgx.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\fp4autl.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\FP4AWEC.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\PUBPLACE.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\FPEXT.exe
%CommonProgramFiles%\Microsoft Shared\VC\msdia80.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\html32.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\msconv97.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\TRIEDIT.exe
%CommonProgramFiles%\Microsoft Shared\VC\msdia100.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\write32.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\DHTMLED.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Ivy.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\DWDCW20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\spcplui.exe
%CommonProgramFiles%\Microsoft Shared\Speech\sapi.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\IEFILES5.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\IEINFO5.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\DWINTL20.exe
<SYSTEM32>\Jirachi.exe
%CommonProgramFiles%\Microsoft Shared\DAO\dao360.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\DWINTL20.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\fieruled.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Citrus Punch.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Citrus Punch Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\anabnr2.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\aswrule.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\aleabanr.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\amaizrul.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Btzhsepa.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\citbannA.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Blank Bkgrd.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Blank.exe