Trojan.Siggen18.28380

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\process lasso management console (gui)
<SYSTEM32>\tasks\session agent for process lasso

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\ProcessGovernor] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ProcessGovernor] 'ImagePath' = '"%ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitev...

Создает следующие сервисы

'ProcessGovernor' "%ProgramFiles%\Process Lasso\srvstub.exe" "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /t /im "ProcessLasso.exe"
'%WINDIR%\syswow64\taskkill.exe' /f /t /im "ProcessGovernor.exe"
'%WINDIR%\syswow64\taskkill.exe' /f /t /im "bitsumsessionagent.exe"

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\32.reg
%ProgramFiles%\process lasso\threadracer.exe
%ProgramFiles%\process lasso\pl_rsrc_finnish.dll
%ProgramFiles%\process lasso\pl_rsrc_chinese.dll
%ProgramFiles%\process lasso\pl_rsrc_chinese_traditional.dll
%ProgramFiles%\process lasso\pl_rsrc_ptbr.dll
%ProgramFiles%\process lasso\pl_rsrc_german.dll
%ProgramFiles%\process lasso\pl_rsrc_italian.dll
%ProgramFiles%\process lasso\pl_rsrc_french.dll
%ProgramFiles%\process lasso\pl_rsrc_polish.dll
%ProgramFiles%\process lasso\pl_rsrc_slovenian.dll
%TEMP%\nsw7899.tmp
%ProgramFiles%\process lasso\pl_rsrc_spanish.dll
%ProgramFiles%\process lasso\pl_rsrc_bulgarian.dll
%ProgramFiles%\process lasso\pl_rsrc_russian.dll
%ProgramFiles%\process lasso\start-governor.bat
%ProgramFiles%\process lasso\stop-governor.bat
%ProgramFiles%\process lasso\pl.cmd
%ProgramFiles%\process lasso\pl-update.cmd
%ProgramFiles%\process lasso\plactivate.exe
%ProgramFiles%\process lasso\licenses
%ProgramFiles%\process lasso\uninstall.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\process lasso\process lasso.lnk
%ProgramFiles%\process lasso\logviewer.exe
%ProgramFiles%\process lasso\insights.exe
%ProgramFiles%\process lasso\testlasso.exe
%ProgramFiles%\process lasso\cpueater.exe
%ProgramFiles%\process lasso\quickupgrade.exe
%TEMP%\7zipsfx.000\processlasso1.cmd
%TEMP%\7zipsfx.000\lasso32\insights.exe
%TEMP%\7zipsfx.000\lasso32\installhelper.exe
%TEMP%\7zipsfx.000\lasso32\processgovernor.exe
%TEMP%\7zipsfx.000\lasso32\processlasso.exe
%TEMP%\7zipsfx.000\lasso64\insights.exe
%TEMP%\7zipsfx.000\lasso64\installhelper.exe
%TEMP%\7zipsfx.000\lasso64\processgovernor.exe
%TEMP%\7zipsfx.000\lasso64\processlasso.exe
%TEMP%\7zipsfx.000\processlassosetup32.exe
C:\users\public\desktop\process lasso.lnk
%ProgramFiles%\process lasso\pl_rsrc_japanese.dll
%TEMP%\7zipsfx.000\processlassosetup64.exe
%ProgramFiles%\process lasso\installhelper.exe
%ProgramFiles%\process lasso\pl_rsrc_english.dll
%ProgramFiles%\process lasso\srvstub.exe
%ProgramFiles%\process lasso\bitsumms.exe
%ProgramFiles%\process lasso\processlasso.exe
%ProgramFiles%\process lasso\processgovernor.exe
%ProgramFiles%\process lasso\bitsumsessionagent.exe
%ProgramFiles%\process lasso\tweakscheduler.exe
%ProgramFiles%\process lasso\vistammsc.exe
%ProgramFiles%\process lasso\processlassolauncher.exe
%TEMP%\7zipsfx.000\64.reg
%TEMP%\nsr78c9.tmp\system.dll
%ALLUSERSPROFILE%\processlasso\logs\processlasso.log

Удаляет следующие файлы

<SYSTEM32>\tasks\session agent for process lasso
%TEMP%\nsr78c9.tmp\system.dll
%TEMP%\7zipsfx.000\32.reg
%TEMP%\7zipsfx.000\64.reg
%TEMP%\7zipsfx.000\lasso32\insights.exe
%TEMP%\7zipsfx.000\lasso32\installhelper.exe
%TEMP%\7zipsfx.000\lasso32\processgovernor.exe
%TEMP%\7zipsfx.000\lasso32\processlasso.exe
%TEMP%\7zipsfx.000\lasso64\insights.exe
%TEMP%\7zipsfx.000\lasso64\installhelper.exe
%TEMP%\7zipsfx.000\lasso64\processgovernor.exe
%TEMP%\7zipsfx.000\lasso64\processlasso.exe
%TEMP%\7zipsfx.000\processlasso1.cmd
%TEMP%\7zipsfx.000\processlassosetup32.exe
%TEMP%\7zipsfx.000\processlassosetup64.exe

Другое

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: 'ProcessLasso_Notification_Class' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessGovernor /remove
'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessLassoGovernor /remove
'%ProgramFiles%\process lasso\installhelper.exe' /enable_update_check
'%ProgramFiles%\process lasso\installhelper.exe' /env_path_install
'%ProgramFiles%\process lasso\processgovernor.exe'
'%ProgramFiles%\process lasso\srvstub.exe' "%ProgramFiles%\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
'%ProgramFiles%\process lasso\bitsumms.exe' "%ProgramFiles%\Process Lasso\processgovernor.exe" /name:ProcessGovernor "/displayname:Process Lasso Core (Process Governor)" /exitevent:Global\ProcessGovernorExitEvent
'%ProgramFiles%\process lasso\bitsumsessionagent.exe' ----------------------------------------------------------------
'%ProgramFiles%\process lasso\installhelper.exe' /S
'%ProgramFiles%\process lasso\installhelper.exe' /powerinstall
'%ProgramFiles%\process lasso\installhelper.exe' /migrate
'%ProgramFiles%\process lasso\installhelper.exe' /firstinstall
'%ProgramFiles%\process lasso\installhelper.exe' /terminate
'%TEMP%\7zipsfx.000\processlassosetup64.exe' /S
'%ProgramFiles%\process lasso\bitsumms.exe' /name:ProcessGovernor /stop
'%ProgramFiles%\process lasso\processlasso.exe' /install /nodelay
'%ProgramFiles%\process lasso\installhelper.exe' /install
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Processlasso1.cmd" "' (со скрытым окном)
'%ProgramFiles%\process lasso\bitsumsessionagent.exe' ----------------------------------------------------------------' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Processlasso1.cmd" "
'<SYSTEM32>\taskeng.exe' {52E8C09F-0C5E-4D8E-9AAF-233C33BD6603} S-1-5-21-1960123792-2022915161-3775307078-1001:kaavyyitph\user:Interactive:[1]
'%WINDIR%\syswow64\sc.exe' stop ProcessGovernor
'%WINDIR%\syswow64\sc.exe' stop "ProcessGovernor.exe"
'%WINDIR%\syswow64\sc.exe' stop ProcessGovernor.exe
'%WINDIR%\syswow64\sc.exe' queryex ProcessGovernor.exe
'%WINDIR%\syswow64\xcopy.exe' /s /e /i /y /h /r /k "lasso64" "%ProgramFiles%\Process Lasso\"
'%WINDIR%\syswow64\regedit.exe' /S 64.reg