Trojan.Siggen31.26309

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ATISmart' = '"%ProgramFiles%\Microsoft Office\MEDIA\OFFICE14\ati2s9ag.exe"'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AppExtender' = '"%ProgramFiles%\Windows NT\Accessories\AppExtB.exe"'
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Media Manager Indexer' = '"%ProgramFiles%\Mozilla Firefox\browser\VisualElements\AIRSVCU.EXE"'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Java(TM) Platform SE Auto Updater' = '"%ProgramFiles%\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\jusched.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\atismart
<SYSTEM32>\tasks\appextender
<SYSTEM32>\tasks\media manager indexer
<SYSTEM32>\tasks\java(tm) platform se auto updater
<SYSTEM32>\tasks\adobe reader speed launcher

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%ProgramFiles%\microsoft office\media\office14\~nahxczm.tmp
%ProgramFiles%\microsoft office\media\office14\ati2s9ag.exe
%ProgramFiles%\windows nt\accessories\~nmcfnqo.tmp
%ProgramFiles%\windows nt\accessories\appextb.exe
%ProgramFiles%\mozilla firefox\browser\visualelements\~ubmxwdv.tmp
%ProgramFiles%\mozilla firefox\browser\visualelements\airsvcu.exe
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\~vbgdhoc.tmp
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\jusched.exe
%CommonProgramFiles%\microsoft shared\ink\he-il\~mjgzoiy.tmp
%CommonProgramFiles%\microsoft shared\ink\he-il\reader_sl.exe
%ProgramFiles%\java\jre1.8.0_45\bin\~tyqgnxx.tmp
%ProgramFiles%\java\jre1.8.0_45\bin\igfxpers.exe

Deletes the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%ProgramFiles%\microsoft office\media\office14\~nahxczm.tmp
%ProgramFiles%\microsoft office\media\office14\ati2s9ag.exe
%ProgramFiles%\windows nt\accessories\~nmcfnqo.tmp
%ProgramFiles%\windows nt\accessories\appextb.exe
%ProgramFiles%\mozilla firefox\browser\visualelements\~ubmxwdv.tmp
%ProgramFiles%\mozilla firefox\browser\visualelements\airsvcu.exe
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\~vbgdhoc.tmp
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\jusched.exe
%CommonProgramFiles%\microsoft shared\ink\he-il\~mjgzoiy.tmp
%CommonProgramFiles%\microsoft shared\ink\he-il\reader_sl.exe
%ProgramFiles%\java\jre1.8.0_45\bin\~tyqgnxx.tmp
%ProgramFiles%\java\jre1.8.0_45\bin\igfxpers.exe

Substitutes the following files

%APPDATA%\mozilla\firefox\plugin-container.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
%ProgramFiles%\microsoft office\media\office14\ati2s9ag.exe
%ProgramFiles%\windows nt\accessories\appextb.exe
%ProgramFiles%\mozilla firefox\browser\visualelements\airsvcu.exe
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\jusched.exe
%CommonProgramFiles%\microsoft shared\ink\he-il\reader_sl.exe
%ProgramFiles%\java\jre1.8.0_45\bin\igfxpers.exe
%ProgramFiles%\microsoft office\media\office14\~nahxczm.tmp
%ProgramFiles%\windows nt\accessories\~nmcfnqo.tmp
%ProgramFiles%\mozilla firefox\browser\visualelements\~ubmxwdv.tmp
%ProgramFiles%\windows sidebar\gadgets\calendar.gadget\en-us\js\~vbgdhoc.tmp
%CommonProgramFiles%\microsoft shared\ink\he-il\~mjgzoiy.tmp
%ProgramFiles%\java\jre1.8.0_45\bin\~tyqgnxx.tmp

Network activity

UDP

'localhost':64546
'localhost':63190

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 30 /TN "ATISmart" /TR "\"%ProgramFiles%\Microsoft Office\MEDIA\OFFICE14\ati2s9ag.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 20 /TN "AppExtender" /TR "\"%ProgramFiles%\Windows NT\Accessories\AppExtB.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 31 /TN "Media Manager Indexer" /TR "\"%ProgramFiles%\Mozilla Firefox\browser\VisualElements\AIRSVCU.EXE\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 26 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\jusched.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Adobe Reader Speed Launcher" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\he-IL\Reader_sl.exe\""
'<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 30 /TN "ATISmart" /TR "\"%ProgramFiles%\Microsoft Office\MEDIA\OFFICE14\ati2s9ag.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 20 /TN "AppExtender" /TR "\"%ProgramFiles%\Windows NT\Accessories\AppExtB.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 31 /TN "Media Manager Indexer" /TR "\"%ProgramFiles%\Mozilla Firefox\browser\VisualElements\AIRSVCU.EXE\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 26 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\jusched.exe\""' (with hidden window)
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Adobe Reader Speed Launcher" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\he-IL\Reader_sl.exe\""' (with hidden window)
'<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE' (with hidden window)