Trojan.Siggen21.9707

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\Magnet\shell\open\command] '' = '"%ProgramFiles(x86)%\uTorrent\uTorrent.exe" "%1"'
[HKLM\Software\Classes\uTorrent\shell\open\command] '' = '"%ProgramFiles(x86)%\uTorrent\uTorrent.exe" "%1"'
[HKLM\Software\Classes\Applications\uTorrent.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\uTorrent\uTorrent.exe" "%1"'
[HKCU\SOFTWARE\Classes\Applications\uTorrent.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\uTorrent\uTorrent.exe" "%1"'
[HKCU\SOFTWARE\Classes\uTorrent\shell\open\command] '' = '"%ProgramFiles(x86)%\uTorrent\uTorrent.exe" "%1"'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Вредоносные функции

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles(x86)%\uTorrent\uTorrent.exe' = '%ProgramFiles(x86)%\uT...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\install.cmd
%TEMP%\7zipsfx.000\utorrent.exe.lang.txt
%TEMP%\7zipsfx.000\utorrent.reg
%TEMP%\7zipsfx.000\appdata\settings.dat
%TEMP%\7zipsfx.000\defaulticon.inf
%TEMP%\7zipsfx.000\utorrent\utorrent.lng
%TEMP%\7zipsfx.000\taskkill.exe
%TEMP%\7zipsfx.000\utorrent\utorrent.exe
%TEMP%\7zipsfx.000\appdata\icon.dll
%ProgramFiles(x86)%\utorrent\utorrent.exe
%ProgramFiles(x86)%\utorrent\utorrent.lng
%HOMEPATH%\application data\utorrent\icon.dll
%HOMEPATH%\application data\utorrent\settings.dat
C:\users\public\desktop\Вµtorrent.lnk

Удаляет следующие файлы

%TEMP%\7zipsfx.000\appdata\icon.dll
%TEMP%\7zipsfx.000\appdata\settings.dat
%TEMP%\7zipsfx.000\defaulticon.inf
%TEMP%\7zipsfx.000\install.cmd
%TEMP%\7zipsfx.000\taskkill.exe
%TEMP%\7zipsfx.000\utorrent\utorrent.exe
%TEMP%\7zipsfx.000\utorrent\utorrent.lng
%TEMP%\7zipsfx.000\utorrent.exe.lang.txt
%TEMP%\7zipsfx.000\utorrent.reg

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Другое

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\taskkill.exe' /f /im uTorrent.exe
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
'%WINDIR%\syswow64\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 128 .\DefaultIcon.inf
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Classes\uTorrent\shell\open\command" /v "" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" \"%1"\" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\SOFTWARE\Classes\uTorrent\DefaultIcon" /v "" /t REG_SZ /d "\"%HOMEPATH%\Application Data\uTorrent\Icon.dll\",-102" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Classes\Applications\uTorrent.exe\shell\open\command" /v "" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" \"%1"\" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\SOFTWARE\Classes\Magnet\DefaultIcon" /v "" /t REG_SZ /d "\"%HOMEPATH%\Application Data\uTorrent\Icon.dll\",-102" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\Applications\uTorrent.exe\shell\open\command" /v "" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" \"%1"\" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\uTorrent\shell\open\command" /v "" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" \"%1"\" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\uTorrent\DefaultIcon" /v "" /t REG_SZ /d "\"%HOMEPATH%\Application Data\uTorrent\Icon.dll\",-102" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\Magnet\shell\open\command" /v "" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" \"%1"\" /f
'%WINDIR%\syswow64\reg.exe' add "HKCR\Magnet\DefaultIcon" /v "" /t REG_SZ /d "\"%HOMEPATH%\Application Data\uTorrent\Icon.dll\",-102" /f
'%WINDIR%\syswow64\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v uTorrent /f
'%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v uTorrent /f
'%WINDIR%\syswow64\regedit.exe' /s uTorrent.reg
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "NoRepair" /t REG_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "NoModify" /t REG_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "InstallLocation" /t REG_SZ /d "%ProgramFiles(x86)%\uTorrent" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "UninstallString" /t REG_SZ /d "\"%ProgramFiles(x86)%\uTorrent\uTorrent.exe\" /UNINSTALL" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "URLUpdateInfo" /t REG_SZ /d "http://www.utorrent.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "URLInfoAbout" /t REG_SZ /d "http://www.utorrent.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "HelpLink" /t REG_SZ /d "http://www.utorrent.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "Publisher" /t REG_SZ /d "BitTorrent, Inc" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "DisplayVersion" /t REG_SZ /d "2.0.4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "DisplayIcon" /t REG_SZ /d "%ProgramFiles(x86)%\uTorrent\uTorrent.exe,0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent" /v "" /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v "%ProgramFiles(x86)%\uTorrent\uTorrent.exe" /t REG_SZ /d "%Pro...
'%WINDIR%\syswow64\runonce.exe' -r
'%WINDIR%\syswow64\grpconv.exe' -o