Trojan.Siggen32.26807

Техническая информация

Вредоносные функции

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f910f-580.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f9112-f58.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0d407dea1c3045b0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b17fd14163a379c9_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\173943595a386a3a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\420e60f13cb0f7bb_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c66e9a17bd9443cc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%TEMP%\659f0e2f-899a-4ff9-bfca-dec038ea0823.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Удаляет файлы, которые сам же создал

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f910f-580.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f9112-f58.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\edge_bits_3928_453248937\788fa935-2f28-4dfa-81f8-ef0341588055

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Сетевая активность

Подключается к

'localhost':49694
'ez##al.com':443
'localhost':49698
'localhost':49701
'localhost':49704
'localhost':49707
'localhost':49710
'localhost':49713
'localhost':49716
'co####.edge.skype.com':443
'localhost':49725
'localhost':49734
'st####.##oudflareinsights.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'localhost':49740
'a.###.#loudflare.com':443
'localhost':49745
'localhost':49748
'localhost':49751
'localhost':49754
'localhost':49757
'localhost':49760
'localhost':49763
'localhost':49766
'localhost':49770
'localhost':49774
'localhost':49777
'localhost':49780
'localhost':49783
'localhost':49786
'localhost':49789
'localhost':49793
'localhost':49796
'localhost':49799
'localhost':49802
'localhost':49805
'localhost':49808
'localhost':49811
'localhost':49814
'localhost':49817
'localhost':49820
'localhost':49823
'localhost':49826
'localhost':49829
'localhost':49832
'localhost':49835
'localhost':49838
'localhost':49842
'localhost':49845
'localhost':49848
'localhost':49851
'localhost':49854
'localhost':49858
'localhost':49861
'localhost':49864
'localhost':49867
'localhost':49870
'localhost':49873
'localhost':49876
'localhost':49879
'localhost':49882
'localhost':49886
'localhost':49889
'localhost':49894
'localhost':49898
'localhost':49901
'localhost':49905
'localhost':49908
'localhost':49911
'localhost':49914
'localhost':49917
'localhost':49920
'localhost':49924
'localhost':49927
'localhost':49930
'localhost':49933
'localhost':49936
'localhost':49940
'localhost':49943
'localhost':49946
'localhost':49949
'localhost':49952
'localhost':49955

TCP

Другие

'localhost':49694
'localhost':49695
'ez##al.com':443
'localhost':49698
'localhost':49699
'localhost':49701
'localhost':49702
'localhost':49704
'localhost':49705
'localhost':49707
'localhost':49708
'localhost':49710
'localhost':49711
'localhost':49713
'localhost':49714
'localhost':49716
'localhost':49717
'co####.edge.skype.com':443
'localhost':49725
'localhost':49726
'localhost':49734
'localhost':49735
'st####.##oudflareinsights.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'localhost':49740
'localhost':49742
'a.###.#loudflare.com':443
'localhost':49745
'localhost':49746
'localhost':49748
'localhost':49749
'localhost':49751
'localhost':49752
'localhost':49754
'localhost':49755
'localhost':49757
'localhost':49758
'localhost':49760
'localhost':49761
'localhost':49763
'localhost':49764
'localhost':49766
'localhost':49767
'localhost':49770
'localhost':49771
'localhost':49774
'localhost':49775
'localhost':49777
'localhost':49778
'localhost':49780
'localhost':49781
'localhost':49783
'localhost':49784
'localhost':49786
'localhost':49787
'localhost':49789
'localhost':49790
'localhost':49793
'localhost':49794
'localhost':49796
'localhost':49797
'localhost':49799
'localhost':49800
'localhost':49802
'localhost':49803
'localhost':49805
'localhost':49806
'localhost':49808
'localhost':49809
'localhost':49811
'localhost':49812
'localhost':49814
'localhost':49815
'localhost':49817
'localhost':49818
'localhost':49820
'localhost':49821
'localhost':49823
'localhost':49824
'localhost':49826
'localhost':49827
'localhost':49829
'localhost':49830
'localhost':49832
'localhost':49833
'localhost':49835
'localhost':49836
'localhost':49838
'localhost':49839
'localhost':49842
'localhost':49843
'localhost':49845
'localhost':49846
'localhost':49848
'localhost':49849
'localhost':49851
'localhost':49852
'localhost':49854
'localhost':49855
'localhost':49858
'localhost':49859
'localhost':49861
'localhost':49862
'localhost':49864
'localhost':49865
'localhost':49867
'localhost':49868
'localhost':49870
'localhost':49871
'localhost':49873
'localhost':49874
'localhost':49876
'localhost':49877
'localhost':49879
'localhost':49880
'localhost':49882
'localhost':49883
'localhost':49886
'localhost':49887
'localhost':49889
'localhost':49890
'localhost':49894
'localhost':49895
'localhost':49898
'localhost':49899
'localhost':49901
'localhost':49902
'localhost':49905
'localhost':49906
'localhost':49908
'localhost':49909
'localhost':49911
'localhost':49912
'localhost':49914
'localhost':49915
'localhost':49917
'localhost':49918
'localhost':49920
'localhost':49921
'localhost':49924
'localhost':49925
'localhost':49927
'localhost':49928
'localhost':49930
'localhost':49931
'localhost':49933
'localhost':49934
'localhost':49936
'localhost':49937
'localhost':49940
'localhost':49941
'localhost':49943
'localhost':49944
'localhost':49946
'localhost':49947
'localhost':49949
'localhost':49950
'localhost':49952
'localhost':49953
'localhost':49955
'localhost':49956

UDP

DNS ASK ez##al.com
DNS ASK co####.edge.skype.com
DNS ASK st####.##oudflareinsights.com
DNS ASK fo###.#oogleapis.com
DNS ASK fo###.gstatic.com
DNS ASK a.###.#loudflare.com

Другое

Ищет следующие окна

ClassName: 'ID' WindowName: ''
ClassName: 'Rock' WindowName: ''
ClassName: 'ObsidianGUI' WindowName: ''
ClassName: 'WinDbgFrameClass' WindowName: ''
ClassName: 'idaabortiondialog' WindowName: ''
ClassName: '' WindowName: 'x64dbg'
ClassName: '' WindowName: 'x32dbg'
ClassName: '' WindowName: 'OllyDbg'
ClassName: '' WindowName: 'Cheat Engine'
ClassName: '' WindowName: 'IDA -'
ClassName: '' WindowName: 'IDA:'
ClassName: '' WindowName: 'Ghidra'
ClassName: '' WindowName: 'Binary Ninja'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Запускает на исполнение

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://ez-val.com/session/ac05f0c40e3faea3cd5b5fedd269020b402cb49edbf09876
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://ez-val.com/session/ac05f0c40e3faea3cd5b5fedd269020b402cb49edbf09876 (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,15012864271548088092,10499978104184466702,131072 --lang=en-US --service-sandbox-type=none --mojo...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней