Trojan.Siggen19.33677

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop RpcSs
'%WINDIR%\syswow64\net.exe' stop wmiApSrv
'%WINDIR%\syswow64\net.exe' stop RpcLocator
'%WINDIR%\syswow64\net.exe' stop DcomLaunch

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsmc12d.tmp
%WINDIR%\logs\sysinfo\tools\devcon.exe
%WINDIR%\logs\sysinfo\tools\fix_dll.cmd
%WINDIR%\logs\sysinfo\tools\hidec.exe
%WINDIR%\logs\sysinfo\tools\mondevs.txt
%WINDIR%\logs\sysinfo\tools\pcidevs.txt
%WINDIR%\logs\sysinfo\tools\pcmdevs.txt
%WINDIR%\logs\sysinfo\tools\pnpdevs.txt
%WINDIR%\logs\sysinfo\tools\usbdevs.txt
%WINDIR%\logs\sysinfo\tools\wput.exe
%WINDIR%\logs\sysinfo\tools\www.samlab.ws.url
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\actions.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\process.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\devices.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\crashes.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\!bsod!.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\execute.htm
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\startup.htm
%WINDIR%\logs\sysinfo\tools\logs\2023_01_27__21_23_42__bywdeqfl_log.txt
%WINDIR%\logs\sysinfo\tools\logs\2023_01_27__21_23_54__bywdeqfl_state.snp
%WINDIR%\logs\sysinfo\tools\bywdeqfl.html
%WINDIR%\logs\sysinfo\tools\hwids.txt
%WINDIR%\logs\sysinfo\tools\winaudit.exe
%WINDIR%\logs\sysinfo\logs\bywdeqfl\system\dxdiag.txt
%WINDIR%\logs\sysinfo\tools\whatinstartup.exe
%WINDIR%\logs\sysinfo\tools\sivx64.sys
%TEMP%\nscc13e.tmp\system.dll
%TEMP%\nscc13e.tmp\modern-header.bmp
%TEMP%\nscc13e.tmp\nsprocess.dll
%WINDIR%\logs\sysinfo\tools\7za.exe
%WINDIR%\logs\sysinfo\tools\appcrashview.exe
%WINDIR%\logs\sysinfo\tools\audio.cmd
%WINDIR%\logs\sysinfo\tools\bluescreenview.exe
%WINDIR%\logs\sysinfo\tools\boxcutter.exe
%WINDIR%\logs\sysinfo\tools\cprocess.exe
%WINDIR%\logs\sysinfo\tools\devmanview.exe
%WINDIR%\logs\sysinfo\tools\driverview.exe
%WINDIR%\logs\sysinfo\tools\driverview64.exe
%WINDIR%\logs\sysinfo\tools\executedprogramslist.exe
%WINDIR%\logs\sysinfo\tools\hwids.cmd
%WINDIR%\logs\sysinfo\tools\installeddriverslist.exe
%WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe
%WINDIR%\logs\sysinfo\tools\lastactivityview.exe
%WINDIR%\logs\sysinfo\tools\sdi-drv.exe
%WINDIR%\logs\sysinfo\tools\siv32x.exe
%WINDIR%\logs\sysinfo\tools\siv64x.exe
%WINDIR%\logs\sysinfo\tools\sivx32.sys
%WINDIR%\logs\sysinfo\tools\sysinf.bat
%WINDIR%\logs\sysinfo\logs\bywdeqfl\sysinfo\drivers.htm

Сетевая активность

Подключается к

'microsoft.com':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

UDP

DNS ASK microsoft.com

Другое

Ищет следующие окна

ClassName: 'MPWClass' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\logs\sysinfo\tools\lastactivityview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Actions.htm
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find pci*
'%WINDIR%\logs\sysinfo\tools\driverview64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Drivers.htm
'%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
'%WINDIR%\logs\sysinfo\tools\devcon.exe' status *
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find acpi*
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find usb*
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find hid*
'%WINDIR%\logs\sysinfo\tools\devcon.exe' hwids *CC_01* *Raid*
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find hdaudio*
'%WINDIR%\logs\sysinfo\tools\devcon.exe' find =net
'%WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Drivers.html
'%WINDIR%\logs\sysinfo\tools\winaudit.exe' /r=gz /o=HTML
'%WINDIR%\logs\sysinfo\tools\whatinstartup.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Startup.htm
'%WINDIR%\logs\sysinfo\tools\executedprogramslist.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Execute.htm
'%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /scomma %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\!BSOD!.txt
'%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\!BSOD!.htm
'%WINDIR%\logs\sysinfo\tools\appcrashview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Crashes.htm
'%WINDIR%\logs\sysinfo\tools\devmanview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Devices.htm
'%WINDIR%\logs\sysinfo\tools\sdi-drv.exe' -nogui -autoclose
'%WINDIR%\logs\sysinfo\tools\cprocess.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\SysInfo\Process.htm
'%WINDIR%\logs\sysinfo\tools\siv64x.exe' -SAVE[devices][device-ids][dimms][driver-vsn][environment][hw-status][interfaces][my-ip-address][overview][pnp-dev][processes][startup][software][system][uaa-dev]
'%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\System\DxDiag.txt
'<SYSTEM32>\locator.exe'
'%WINDIR%\syswow64\net1.exe' start RpcLocator
'%WINDIR%\syswow64\net.exe' start RpcLocator
'%WINDIR%\syswow64\net1.exe' start wmiApSrv
'%WINDIR%\syswow64\net.exe' start wmiApSrv
'%WINDIR%\syswow64\net1.exe' start RpcSs
'%WINDIR%\syswow64\net.exe' start RpcSs
'%WINDIR%\syswow64\sc.exe' config DcomLaunch start=auto
'%WINDIR%\syswow64\sc.exe' config RpcLocator start=auto
'%WINDIR%\syswow64\sc.exe' config wmiApSrv start=auto
'%WINDIR%\syswow64\sc.exe' config RpcSs start=auto
'%WINDIR%\syswow64\net1.exe' stop DcomLaunch
'%WINDIR%\syswow64\net1.exe' stop RpcLocator
'%WINDIR%\syswow64\net1.exe' stop wmiApSrv
'%WINDIR%\syswow64\net1.exe' stop RpcSs
'%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css" /v "Content Type" /t reg_sz /d text/css /f
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
'%WINDIR%\syswow64\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\bywdeqfl\System\DxDiag.txt
'%WINDIR%\syswow64\net.exe' start DcomLaunch
'%WINDIR%\syswow64\net1.exe' start DcomLaunch