Trojan.Siggen31.19761

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = 'C:\Temp\UjyQii\WinRing0x64.sys'

Создает следующие сервисы

'WinRing0_1_2_0' C:\Temp\UjyQii\WinRing0x64.sys

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\bin\config.dat
C:\temp\ujyqii\dism\x64\dismprov.dll
C:\temp\ujyqii\dism\x86\dismprov.dll
C:\temp\ujyqii\dism\xp\dmiprovider.dll
C:\temp\ujyqii\dism\xp\folderprovider.dll
C:\temp\ujyqii\dism\x86\folderprovider.dll
C:\temp\ujyqii\dism\x64\folderprovider.dll
C:\temp\ujyqii\dism\x64\imagingprovider.dll
C:\temp\ujyqii\dism\x86\imagingprovider.dll
C:\temp\ujyqii\dism\xp\intlprovider.dll
C:\temp\ujyqii\dism\xp\logprovider.dll
C:\temp\ujyqii\dism\x64\logprovider.dll
C:\temp\ujyqii\dism\x86\logprovider.dll
C:\temp\ujyqii\dism\x86\microsoft.dism.powershell.dll
C:\temp\ujyqii\dism\x64\microsoft.dism.powershell.dll
C:\temp\ujyqii\dism\xp\osprovider.dll
C:\temp\ujyqii\dism\x64\siloedpackageprovider.dll
C:\temp\ujyqii\dism\x86\siloedpackageprovider.dll
C:\temp\ujyqii\dism\xp\dism.exe
C:\temp\ujyqii\dism\x86\dism.exe
C:\temp\ujyqii\dism\x64\wimprovider.dll
C:\temp\ujyqii\dism\xp\wimprovider.dll
C:\temp\ujyqii\dism\x86\wimprovider.dll
C:\temp\ujyqii\dism\xp\wimgapi.dll
C:\temp\ujyqii\dism\x64\wimgapi.dll
C:\temp\ujyqii\dism\x86\wimgapi.dll
C:\temp\ujyqii\dism\xp\wdscore.dll
C:\temp\ujyqii\dism\x64\vhdprovider.dll
C:\temp\ujyqii\dism\x86\vhdprovider.dll
C:\temp\ujyqii\dism\x86\ssshim.dll
C:\temp\ujyqii\dism\x64\ssshim.dll
C:\temp\ujyqii\dism\xp\smiprovider.dll
C:\temp\ujyqii\dism\x64\dism.exe
C:\temp\ujyqii\dism\xp\dismprov.dll
C:\temp\ujyqii\dism\x64\dismcoreps.dll
C:\temp\ujyqii\dism\x86\dismcoreps.dll
%TEMP%\7zipsfx.000\ujyqii.exe
C:\temp\ujyqii\passkey.exe
C:\temp\ujyqii\qiiaria2c.exe
C:\temp\ujyqii\pci.ids
C:\temp\ujyqii\usb3_drivers_for_win7.xim
C:\temp\ujyqii\isocmd.exe
C:\temp\ujyqii\isodrive.sys
C:\temp\ujyqii\isodrv64.sys
C:\temp\ujyqii\devcon.exe
C:\temp\ujyqii\qiibiosinfo.exe
C:\temp\ujyqii\winring0x64.sys
C:\temp\ujyqii\libcdix64.dll
C:\temp\ujyqii\cxdir.exe
C:\temp\ujyqii\wimlib.exe
C:\temp\ujyqii\qiipecmd.exe
C:\temp\ujyqii\qiibcdboot.exe
C:\temp\ujyqii\libwim-15.dll
C:\temp\ujyqii\dism\x86\dismcore.dll
C:\temp\ujyqii\dism\xp\dismcore.dll
C:\temp\ujyqii\dism\x64\dismcore.dll
C:\temp\ujyqii\dism\x64\dismapi.dll
C:\temp\ujyqii\dism\x86\dismapi.dll
C:\temp\ujyqii\dism\xp\compatprovider.dll
C:\temp\ujyqii\dism.wim
C:\temp\ujyqii\dism\xp\cbsprovider.dll
C:\temp\ujyqii\qiighost.exe
C:\temp\ujyqii\qiibootsect.exe
C:\temp\ujyqii\osfmount.sys
C:\temp\ujyqii\osfmount.com
C:\temp\ujyqii\qiibcdedit.exe
C:\temp\ujyqii\qiiimagex.exe
C:\temp\ujyqii\dism\xp\dismcoreps.dll
C:\temp\ujyqii\dism\xp\dismhost.exe

Сетевая активность

Подключается к

'51###oft.com':80

TCP

Запросы HTTP GET

http://www.51###oft.com/UjyQii/UjyQiikey.html

UDP

DNS ASK 51###oft.com

Другое

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\ujyqii.exe'
'C:\temp\ujyqii\wimlib.exe' apply "C:\\Temp\UjyQii\\dism.wim" 1 C:\\Temp\UjyQii\\dism
'C:\temp\ujyqii\qiibiosinfo.exe' --sys
'C:\temp\ujyqii\qiibiosinfo.exe' --uefi
'C:\temp\ujyqii\qiipecmd.exe' SHOW -check F:-1
'C:\temp\ujyqii\cxdir.exe' -mohong
'C:\temp\ujyqii\qiibiosinfo.exe' --disk=NO-SMART PHYS CD/HD

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\bcdedit.exe /enum {current} (со скрытым окном)
'<SYSTEM32>\bcdedit.exe' /enum {current}
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\wimlib.EXE apply "C:\\Temp\UjyQii\\dism.wim" 1 C:\\Temp\UjyQii\\dism (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\Qiibiosinfo.exe --sys (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\Qiibiosinfo.exe --uefi (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\QiiPECMD.exe SHOW -check F:-1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\cxdir.exe -mohong (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c C:\\Temp\UjyQii\\Qiibiosinfo.exe --disk=NO-SMART PHYS CD/HD (со скрытым окном)