Trojan.Siggen21.40407

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QQВ°ВІГ€В«Г–ГђГђГ„' = 'C:\Users\Public\dess.exe'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1304495] 'ImagePath' = 'cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQ°²È«ÖÐÐÄ /t REG_SZ /d "C:\Users\Public\des...
[HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1306711] 'ImagePath' = 'cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f'
[HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1308442] 'ImagePath' = 'cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBeha...

Создает следующие сервисы

'CreateSvcRpc_1304495' cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQВ°ВІГ€В«Г–ГђГђГ„ /t REG_SZ /d "C:\Users\Public\dess.exe" /f
'CreateSvcRpc_1306711' cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'CreateSvcRpc_1308442' cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Создает и запускает на исполнение

'' (загружен из сети Интернет)

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе

Создает следующие файлы

C:\users\public\pro.exe
C:\users\public\1.dat
C:\users\public\dwwmm.txt
C:\users\public\dess.exe

Сетевая активность

Подключается к

'16#.#55.214.235':80
'yk######.##s-cn-beijing.aliyuncs.com':443
'47.##1.23.242':80

TCP

Запросы HTTP GET

http://16#.#55.214.235/a47.111.23.242.txt
http://16#.#55.214.235/ipcode.dat
http://47.##1.23.242/mm.txt

Другие

'yk######.##s-cn-beijing.aliyuncs.com':443

UDP

DNS ASK yk######.##s-cn-beijing.aliyuncs.com

Другое

Создает и запускает на исполнение

'C:\users\public\pro.exe'
'C:\users\public\dess.exe'

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' wmic process where "name='360tray.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='QQPCRTP.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='QQPCRTP.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='QQPCLeakScan.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='QQPCLeakScan.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='QMDL.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='QMDL.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='HipsDaemon.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='360safe.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='360safe.exe'" get ExecutablePath
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQВ°ВІГ€В«Г–ГђГђГ„ /t REG_SZ /d "C:\Users\Public\dess.exe" /f
'<SYSTEM32>\cmd.exe' /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='zhudongfangyu.exe'" get ExecutablePath
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='QQPCTray.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='QQPCTray.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='kxetray.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='kxetray.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='kxescore.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='360sd.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='360sd.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='MsMpEng.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='MsMpEng.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='HipsTray.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='HipsTray.exe'" get ExecutablePath
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQВ°ВІГ€В«Г–ГђГђГ„ /t REG_SZ /d "C:\Users\Public\dess.exe" /f
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='HipsDaemon.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='kislive.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='kwsprotect64.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='kwsprotect64.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='kxecenter.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='kxecenter.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='kxescore.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='360tray.exe'" get ExecutablePath
'%WINDIR%\syswow64\cmd.exe' wmic process where "name='kislive.exe'" get ExecutablePath
'%WINDIR%\syswow64\wbem\wmic.exe' process where "name='zhudongfangyu.exe'" get ExecutablePath