Trojan.Siggen28.40076

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\cclaunch\shell\open\command] '' = '"%ProgramFiles%\CCleaner\ccleaner.exe" /%1'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\ccleanerskipuac

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\chrome.reg
%ProgramFiles%\ccleaner\lang\lang-1065.dll
%ProgramFiles%\ccleaner\lang\lang-1061.dll
%ProgramFiles%\ccleaner\lang\lang-1058.dll
%ProgramFiles%\ccleaner\lang\lang-1066.dll
%ProgramFiles%\ccleaner\lang\lang-1050.dll
%ProgramFiles%\ccleaner\lang\lang-1026.dll
%ProgramFiles%\ccleaner\lang\lang-5146.dll
%ProgramFiles%\ccleaner\lang\lang-1071.dll
%ProgramFiles%\ccleaner\lang\lang-1051.dll
%ProgramFiles%\ccleaner\lang\lang-2074.dll
%ProgramFiles%\ccleaner\lang\lang-3098.dll
%ProgramFiles%\ccleaner\lang\lang-1052.dll
%ProgramFiles%\ccleaner\lang\lang-1063.dll
%ProgramFiles%\ccleaner\lang\lang-1110.dll
%ProgramFiles%\ccleaner\lang\lang-1048.dll
%ProgramFiles%\ccleaner\lang\lang-1067.dll
%ProgramFiles%\ccleaner\lang\lang-1079.dll
%ProgramFiles%\ccleaner\lang\lang-9999.dll
%ProgramFiles%\ccleaner\lang\lang-1068.dll
%ProgramFiles%\ccleaner\ccleaner.ini
%ProgramFiles%\ccleaner\uninst.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ccleaner\ccleaner homepage.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ccleaner\ccleaner.lnk
C:\users\public\desktop\ccleaner.lnk
%ProgramFiles%\ccleaner\lang\lang-1104.dll
%ProgramFiles%\ccleaner\lang\lang-1081.dll
%ProgramFiles%\ccleaner\lang\lang-1109.dll
%ProgramFiles%\ccleaner\lang\lang-1054.dll
%ProgramFiles%\ccleaner\lang\lang-1092.dll
%ProgramFiles%\ccleaner\lang\lang-1057.dll
%ProgramFiles%\ccleaner\lang\lang-1102.dll
%ProgramFiles%\ccleaner\lang\lang-1062.dll
%ProgramFiles%\ccleaner\lang\lang-1087.dll
%ProgramFiles%\ccleaner\lang\lang-1059.dll
%ProgramFiles%\ccleaner\lang\lang-1060.dll
%ProgramFiles%\ccleaner\winapp2.ini
%ProgramFiles%\ccleaner\lang\lang-1025.dll
%ProgramFiles%\ccleaner\lang\lang-1055.dll
%ProgramFiles%\ccleaner\lang\lang-1032.dll
%ProgramFiles%\ccleaner\branding.dll
%ProgramFiles%\ccleaner\ccleaner64.exe
%ProgramFiles%\ccleaner\ccleaner.exe
%TEMP%\nsmbdd4.tmp\inetc.dll
%TEMP%\nsmbdd4.tmp\nsprocess.dll
%TEMP%\nsmbdd4.tmp\g\gcapi_dll.dll
%TEMP%\nsmbdd4.tmp\g\gtapi_signed.dll
%TEMP%\nsmbdd4.tmp\userinfo.dll
%TEMP%\nsmbdd4.tmp\system.dll
%TEMP%\nshbdb4.tmp
%TEMP%\7zipsfx.000\branding.dll
%TEMP%\7zipsfx.000\ccsetup501pro.exe
%TEMP%\7zipsfx.000\ccleaner.dat
%TEMP%\7zipsfx.000\winapp2.ini
%TEMP%\7zipsfx.000\ccleaner.ini
%ProgramFiles%\ccleaner\lang\lang-1031.dll
%ProgramFiles%\ccleaner\lang\lang-1041.dll
%ProgramFiles%\ccleaner\lang\lang-1049.dll
%ProgramFiles%\ccleaner\lang\lang-1053.dll
%ProgramFiles%\ccleaner\lang\lang-1027.dll
%ProgramFiles%\ccleaner\lang\lang-2052.dll
%ProgramFiles%\ccleaner\lang\lang-1029.dll
%ProgramFiles%\ccleaner\lang\lang-1038.dll
%ProgramFiles%\ccleaner\lang\lang-1046.dll
%ProgramFiles%\ccleaner\lang\lang-1035.dll
%ProgramFiles%\ccleaner\lang\lang-1030.dll
%ProgramFiles%\ccleaner\lang\lang-1045.dll
%ProgramFiles%\ccleaner\lang\lang-1028.dll
%ProgramFiles%\ccleaner\lang\lang-1034.dll
%ProgramFiles%\ccleaner\lang\lang-1036.dll
%ProgramFiles%\ccleaner\lang\lang-1043.dll
%ProgramFiles%\ccleaner\lang\lang-2070.dll
%ProgramFiles%\ccleaner\lang\lang-1040.dll
%ProgramFiles%\ccleaner\lang\lang-1044.dll
%ProgramFiles%\ccleaner\lang\lang-1042.dll
%ProgramFiles%\ccleaner\lang\lang-1037.dll
%ProgramFiles%\ccleaner\ccleaner.dat

Удаляет следующие файлы

%TEMP%\nsmbdd4.tmp\g\gcapi_dll.dll
%TEMP%\nsmbdd4.tmp\g\gtapi_signed.dll
%TEMP%\nsmbdd4.tmp\inetc.dll
%TEMP%\nsmbdd4.tmp\nsprocess.dll
%TEMP%\nsmbdd4.tmp\system.dll
%TEMP%\nsmbdd4.tmp\userinfo.dll
%TEMP%\7zipsfx.000\branding.dll
%TEMP%\7zipsfx.000\ccleaner.dat
%TEMP%\7zipsfx.000\ccleaner.ini
%TEMP%\7zipsfx.000\ccsetup501pro.exe
%TEMP%\7zipsfx.000\chrome.reg
%TEMP%\7zipsfx.000\winapp2.ini

Сетевая активность

Подключается к

'se#####.piriform.com':80
'li#####.piriform.com':443

TCP

Запросы HTTP GET

http://se#####.piriform.com/installcheck.aspx?p=################################################

Другие

'se#####.piriform.com':443

UDP

DNS ASK se#####.piriform.com
DNS ASK li#####.piriform.com

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'PiriformRegistration' WindowName: ''
ClassName: '#32770' WindowName: 'Piriform CCleaner'
ClassName: 'ThunderRT6FormDC' WindowName: 'CCleaner'
ClassName: 'PiriformCCleaner' WindowName: ''
ClassName: '#32770' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\ccsetup501pro.exe' /S
'%ProgramFiles%\ccleaner\ccleaner64.exe' /createSkipUAC
'%WINDIR%\syswow64\cmd.exe' /c xcopy branding.dll "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c xcopy ccleaner.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c xcopy winapp2.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c xcopy CCleaner.dat "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\regedit.exe' /s chrome.reg
'%WINDIR%\syswow64\cmd.exe' /c xcopy branding.dll "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\xcopy.exe' branding.dll "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\cmd.exe' /c xcopy ccleaner.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\xcopy.exe' ccleaner.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\cmd.exe' /c xcopy winapp2.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\xcopy.exe' winapp2.ini "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\cmd.exe' /c xcopy CCleaner.dat "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k
'%WINDIR%\syswow64\xcopy.exe' CCleaner.dat "%ProgramFiles%\CCleaner\" /s /e /i /y /h /r /k