Trojan.Siggen25.12985

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\wudfhostw
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\idlei
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\lsassl
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\wudfhost

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles%\microsoft sql server compact edition\winlogon.exe
%TEMP%\mg29kxrxx4
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\cc11b995f2a76d
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winlogon.exe
%WINDIR%\l2schemas\480b7989c529f6
%WINDIR%\l2schemas\wudfhost.exe
%WINDIR%\apppatch\custom\6203df4a6bafc7
%WINDIR%\apppatch\custom\lsass.exe
%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\0fc223bdacedc3
%TEMP%\cb7v2ryef2.bat
%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\firefox.exe
%ProgramFiles(x86)%\windows media player\network sharing\idle.exe
C:\msocache\all users\42af1c969fbb7b
C:\msocache\all users\audiodg.exe
%ProgramFiles(x86)%\windows photo viewer\en-us\0fc223bdacedc3
%ProgramFiles(x86)%\windows photo viewer\en-us\firefox.exe
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\0fc223bdacedc3
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\firefox.exe
%ProgramFiles%\microsoft sql server compact edition\cc11b995f2a76d
%ProgramFiles(x86)%\windows media player\network sharing\6ccacd8608530f
nul

Удаляет следующие файлы

%TEMP%\mg29kxrxx4

Сетевая активность

Подключается к

'cm###26.tw1.ru':80

TCP

Запросы HTTP GET

http://cm###26.tw1.ru/_Defaultwindows.php?mk#####################################################################################################################################################...
http://cm###26.tw1.ru/_Defaultwindows.php?2H#####################################################################################################################################################...

UDP

DNS ASK cm###26.tw1.ru
'localhost':123

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\windows photo viewer\en-us\firefox.exe'
'<SYSTEM32>\cmd.exe' /C "%TEMP%\Cb7V2ryEf2.bat"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'%WINDIR%\L2Schemas\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%WINDIR%\L2Schemas\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'%WINDIR%\L2Schemas\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'%WINDIR%\AppPatch\Custom\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\AppPatch\Custom\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'%WINDIR%\AppPatch\Custom\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\firefox.exe'" /f
'<SYSTEM32>\cmd.exe' /C "%TEMP%\Cb7V2ryEf2.bat"
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Windows Media Player\Network Sharing\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Windows Media Player\Network Sharing\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Media Player\Network Sharing\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2