Trojan.Siggen32.27020

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei10522\vcruntime140.dll
%TEMP%\_mei10522\_bz2.pyd
%TEMP%\_mei10522\_ctypes.pyd
%TEMP%\_mei10522\_decimal.pyd
%TEMP%\_mei10522\_hashlib.pyd
%TEMP%\_mei10522\_lzma.pyd
%TEMP%\_mei10522\_socket.pyd
%TEMP%\_mei10522\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei10522\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei10522\base_library.zip
%TEMP%\_mei10522\bg.png
%TEMP%\_mei10522\libcrypto-1_1.dll
%TEMP%\_mei10522\libffi-7.dll
%TEMP%\_mei10522\python310.dll
%TEMP%\_mei10522\select.pyd
%TEMP%\_mei10522\ucrtbase.dll
%TEMP%\_mei10522\unicodedata.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a1fb7c-117c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a1fb7f-244.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Удаляет файлы, которые сам же создал

%TEMP%\_mei10522\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei10522\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei10522\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei10522\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei10522\base_library.zip
%TEMP%\_mei10522\bg.png
%TEMP%\_mei10522\libcrypto-1_1.dll
%TEMP%\_mei10522\libffi-7.dll
%TEMP%\_mei10522\python310.dll
%TEMP%\_mei10522\select.pyd
%TEMP%\_mei10522\ucrtbase.dll
%TEMP%\_mei10522\unicodedata.pyd
%TEMP%\_mei10522\vcruntime140.dll
%TEMP%\_mei10522\_bz2.pyd
%TEMP%\_mei10522\_ctypes.pyd
%TEMP%\_mei10522\_decimal.pyd
%TEMP%\_mei10522\_hashlib.pyd
%TEMP%\_mei10522\_lzma.pyd
%TEMP%\_mei10522\_socket.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a1fb7c-117c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a1fb7f-244.pma
%TEMP%\edge_bits_580_720112246\dde93974-5cbc-4ecc-898f-436e62207c34

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Сетевая активность

Подключается к

'ip###############rqasd42gu0hkkxe.lambda-url.eu-north-1.on.aws':443
'co####.edge.skype.com':443
'fs.#sda.gov':443

TCP

Другие

'ip###############rqasd42gu0hkkxe.lambda-url.eu-north-1.on.aws':443
'co####.edge.skype.com':443
'fs.#sda.gov':443

UDP

DNS ASK ip###############rqasd42gu0hkkxe.lambda-url.eu-north-1.on.aws
DNS ASK fs.#sda.gov
DNS ASK co####.edge.skype.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "start msedge --app=https://www.fs.usda.gov/pnw/sciencef/scifi80.pdf" (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --app=https://www.fs.usda.gov/pnw/sciencef/scifi80.pdf
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --app=https://www.fs.usda.gov/pnw/sciencef/scifi80.pdf --flag-switches-begin --flag-switches-end --do-not-de-elevate (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1364,16748723671149125018,8745436280157675688,131072 --lang=en-US --service-sandbox-type=none --mojo-...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней