Trojan.Siggen32.24830

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei36322\msvcp140.dll
%TEMP%\_mei36322\vcruntime140.dll
%TEMP%\_mei36322\vcruntime140_1.dll
%TEMP%\_mei36322\_asyncio.pyd
%TEMP%\_mei36322\_bz2.pyd
%TEMP%\_mei36322\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei36322\_ctypes.pyd
%TEMP%\_mei36322\_decimal.pyd
%TEMP%\_mei36322\_hashlib.pyd
%TEMP%\_mei36322\_lzma.pyd
%TEMP%\_mei36322\_multiprocessing.pyd
%TEMP%\_mei36322\_overlapped.pyd
%TEMP%\_mei36322\_queue.pyd
%TEMP%\_mei36322\_socket.pyd
%TEMP%\_mei36322\_ssl.pyd
%TEMP%\_mei36322\_uuid.pyd
%TEMP%\_mei36322\_zoneinfo.pyd
%TEMP%\_mei36322\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei36322\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei36322\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei36322\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei36322\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei36322\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei36322\base_library.zip
%TEMP%\_mei36322\certifi\cacert.pem
%TEMP%\_mei36322\charset_normalizer\md.cp310-win_amd64.pyd
%TEMP%\_mei36322\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
%TEMP%\_mei36322\click-8.3.1.dist-info\installer
%TEMP%\_mei36322\click-8.3.1.dist-info\metadata
%TEMP%\_mei36322\click-8.3.1.dist-info\record
%TEMP%\_mei36322\click-8.3.1.dist-info\wheel
%TEMP%\_mei36322\click-8.3.1.dist-info\licenses\license.txt
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\installer
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\metadata
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\record
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\wheel
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\licenses\license
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\licenses\license.apache
%TEMP%\_mei36322\cryptography-46.0.4.dist-info\licenses\license.bsd
%TEMP%\_mei36322\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei36322\dateutil\zoneinfo\dateutil-zoneinfo.tar.gz
%TEMP%\_mei36322\flask-3.1.2.dist-info\installer
%TEMP%\_mei36322\flask-3.1.2.dist-info\metadata
%TEMP%\_mei36322\flask-3.1.2.dist-info\record
%TEMP%\_mei36322\flask-3.1.2.dist-info\wheel
%TEMP%\_mei36322\flask-3.1.2.dist-info\entry_points.txt
%TEMP%\_mei36322\flask-3.1.2.dist-info\licenses\license.txt
%TEMP%\_mei36322\h2-4.3.0.dist-info\installer
%TEMP%\_mei36322\h2-4.3.0.dist-info\metadata
%TEMP%\_mei36322\h2-4.3.0.dist-info\record
%TEMP%\_mei36322\h2-4.3.0.dist-info\wheel
%TEMP%\_mei36322\h2-4.3.0.dist-info\licenses\license
%TEMP%\_mei36322\h2-4.3.0.dist-info\top_level.txt
%TEMP%\_mei36322\itsdangerous-2.2.0.dist-info\installer
%TEMP%\_mei36322\itsdangerous-2.2.0.dist-info\license.txt
%TEMP%\_mei36322\itsdangerous-2.2.0.dist-info\metadata
%TEMP%\_mei36322\itsdangerous-2.2.0.dist-info\record
%TEMP%\_mei36322\itsdangerous-2.2.0.dist-info\wheel
%TEMP%\_mei36322\libcrypto-1_1.dll
%TEMP%\_mei36322\libffi-7.dll
%TEMP%\_mei36322\libssl-1_1.dll
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\installer
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\metadata
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\record
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\wheel
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\licenses\license.txt
%TEMP%\_mei36322\markupsafe-3.0.3.dist-info\top_level.txt
%TEMP%\_mei36322\markupsafe\_speedups.cp310-win_amd64.pyd
%TEMP%\_mei36322\mido-1.3.3.dist-info\installer
%TEMP%\_mei36322\mido-1.3.3.dist-info\license
%TEMP%\_mei36322\mido-1.3.3.dist-info\metadata
%TEMP%\_mei36322\mido-1.3.3.dist-info\record
%TEMP%\_mei36322\mido-1.3.3.dist-info\wheel
%TEMP%\_mei36322\mido-1.3.3.dist-info\entry_points.txt
%TEMP%\_mei36322\mido-1.3.3.dist-info\top_level.txt
%TEMP%\_mei36322\mmh3.cp310-win_amd64.pyd
%TEMP%\_mei36322\multidict\_multidict.cp310-win_amd64.pyd
%TEMP%\_mei36322\propcache\_helpers_c.cp310-win_amd64.pyd
%TEMP%\_mei36322\pydantic-2.12.5.dist-info\installer
%TEMP%\_mei36322\pydantic-2.12.5.dist-info\metadata
%TEMP%\_mei36322\pydantic-2.12.5.dist-info\record
%TEMP%\_mei36322\pydantic-2.12.5.dist-info\wheel
%TEMP%\_mei36322\pydantic-2.12.5.dist-info\licenses\license
%TEMP%\_mei36322\pydantic_core\_pydantic_core.cp310-win_amd64.pyd
%TEMP%\_mei36322\pyexpat.pyd
%TEMP%\_mei36322\pyiceberg\avro\decoder_fast.cp310-win_amd64.pyd
%TEMP%\_mei36322\pyroaring.cp310-win_amd64.pyd
%TEMP%\_mei36322\python3.dll
%TEMP%\_mei36322\python310.dll
%TEMP%\_mei36322\select.pyd
%TEMP%\_mei36322\ucrtbase.dll
%TEMP%\_mei36322\unicodedata.pyd
%TEMP%\_mei36322\websockets-15.0.1.dist-info\installer
%TEMP%\_mei36322\websockets-15.0.1.dist-info\license
%TEMP%\_mei36322\websockets-15.0.1.dist-info\metadata
%TEMP%\_mei36322\websockets-15.0.1.dist-info\record
%TEMP%\_mei36322\websockets-15.0.1.dist-info\wheel
%TEMP%\_mei36322\websockets-15.0.1.dist-info\entry_points.txt
%TEMP%\_mei36322\websockets-15.0.1.dist-info\top_level.txt
%TEMP%\_mei36322\websockets\speedups.cp310-win_amd64.pyd
%TEMP%\_mei36322\werkzeug-3.1.5.dist-info\installer
%TEMP%\_mei36322\werkzeug-3.1.5.dist-info\metadata
%TEMP%\_mei36322\werkzeug-3.1.5.dist-info\record
%TEMP%\_mei36322\werkzeug-3.1.5.dist-info\wheel
%TEMP%\_mei36322\werkzeug-3.1.5.dist-info\licenses\license.txt
%TEMP%\_mei36322\yarl\_quoting_c.cp310-win_amd64.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-698e8679-1460.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-698e867c-940.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\2368_163589628\manifest.json
%TEMP%\2368_163589628\license.txt
%TEMP%\2368_163589628\filtering rules
%TEMP%\2368_163589628\_metadata\verified_contents.json
%TEMP%\2368_163589628\manifest.fingerprint
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir2368_1246361794\ruleset data

Удаляет файлы, которые сам же создал

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-698e8679-1460.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-698e867c-940.pma
%TEMP%\edge_bits_2368_960345556\dde93974-5cbc-4ecc-898f-436e62207c34
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
'localhost':5000
'fo###.#oogleapis.com':443
'cd###.#loudflare.com':443
'17#.66.2.5':80
'fo###.gstatic.com':443

TCP

Запросы HTTP GET

http://12#.#.0.1:5000/favicon.ico

Другие

'co####.edge.skype.com':443
'localhost':49695
'fo###.#oogleapis.com':443
'cd###.#loudflare.com':443
'fo###.gstatic.com':443
'localhost':49696

UDP

DNS ASK co####.edge.skype.com
DNS ASK fo###.#oogleapis.com
DNS ASK cd###.#loudflare.com
DNS ASK fo###.gstatic.com
DNS ASK gi##ub.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Перезапускает анализируемый образец

Запускает на исполнение

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://127.0.0.1:5000/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://127.0.0.1:5000/ (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,2831125240400717574,126859030371675310,131072 --lang=en-US --service-sandbox-type=none --mojo-pl...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней