Trojan.Siggen32.58285

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\c__ifxbsuvi_<Имя файла>.exe

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\getintoway\recuva 1.54.120 technician 0.0.0.0\install\recuva technician.msi
%TEMP%\shib1d.tmp
%TEMP%\msid32.tmp
%TEMP%\msi1b7b.tmp
%TEMP%\msi260b.tmp
%TEMP%\msi2aa0.tmp
%TEMP%\ai_extui_bin_4900\dialog.jpg
%TEMP%\ai_extui_bin_4900\completi
%TEMP%\ai_extui_bin_4900\custicon
%TEMP%\ai_extui_bin_4900\exclamic
%TEMP%\ai_extui_bin_4900\info
%TEMP%\ai_extui_bin_4900\insticon
%TEMP%\ai_extui_bin_4900\removico
%TEMP%\ai_extui_bin_4900\repairic
%TEMP%\ai_extui_bin_4900\up
%TEMP%\ai_extui_bin_4900\new
%TEMP%\ai_extui_bin_4900\banner.jpg
%TEMP%\ai_extui_bin_4900\tabback
%TEMP%\ai_extui_bin_4900\cmdlinkarrow
%TEMP%\ai_extui_bin_4900\dialog.scale125.jpg
%TEMP%\ai_extui_bin_4900\file_deleter.ps1
%TEMP%\ai_extui_bin_4900\banner.svg
%TEMP%\ai_extui_bin_4900\lzmaextractor.dll
%TEMP%\ai_extui_bin_4900\dialog.svg
%TEMP%\ai_extui_bin_4900\banner.scale125.jpg
%TEMP%\ai_extui_bin_4900\banner.scale150.jpg
%TEMP%\ai_extui_bin_4900\banner.scale200.jpg
%TEMP%\ai_extui_bin_4900\dialog.scale150.jpg
%TEMP%\ai_extui_bin_4900\dialog.scale200.jpg
%TEMP%\msi5645.tmp
%APPDATA%\getintoway\recuva 1.54.120 technician\prerequisites\recuva\s.exe
%APPDATA%\getintoway\recuva 1.54.120 technician\prerequisites\piriform_ccleaner_hostsblock.cmd\piriform-blockerkeyverificator_runasadministrator.cmd
%TEMP%\nsw6285.tmp
%TEMP%\nsr62b5.tmp\userinfo.dll
%TEMP%\nsr62b5.tmp\system.dll
%TEMP%\nsr62b5.tmp\p\installerhelper.dll
%ALLUSERSPROFILE%\piriform\recuva\burgerdata\eventdata.json
%TEMP%\nsr62b5.tmp\inetc.dll
%ProgramFiles%\recuva\recuva.exe
%ProgramFiles%\recuva\recuva64.exe
%ProgramFiles%\recuva\recuvashell64.dll.new
%ProgramFiles%\recuva\branding.dll
%ProgramFiles%\recuva\lang\lang-1031.dll
%ProgramFiles%\recuva\lang\lang-1041.dll
%ProgramFiles%\recuva\lang\lang-1049.dll
%ProgramFiles%\recuva\lang\lang-1053.dll
%ProgramFiles%\recuva\lang\lang-1044.dll
%ProgramFiles%\recuva\lang\lang-1040.dll
%ProgramFiles%\recuva\lang\lang-1043.dll
%ProgramFiles%\recuva\lang\lang-1036.dll
%ProgramFiles%\recuva\lang\lang-1034.dll
%ProgramFiles%\recuva\lang\lang-1045.dll
%ProgramFiles%\recuva\lang\lang-1028.dll
%ProgramFiles%\recuva\lang\lang-1030.dll
%ProgramFiles%\recuva\lang\lang-1035.dll
%ProgramFiles%\recuva\lang\lang-1046.dll
%ProgramFiles%\recuva\lang\lang-1038.dll
%ProgramFiles%\recuva\lang\lang-1029.dll
%ProgramFiles%\recuva\lang\lang-2052.dll
%ProgramFiles%\recuva\lang\lang-1027.dll
%ProgramFiles%\recuva\lang\lang-1037.dll
%ProgramFiles%\recuva\lang\lang-1032.dll
%ProgramFiles%\recuva\lang\lang-1055.dll
%ProgramFiles%\recuva\lang\lang-1025.dll
%ProgramFiles%\recuva\lang\lang-1048.dll
%ProgramFiles%\recuva\lang\lang-1063.dll
%ProgramFiles%\recuva\lang\lang-1052.dll
%ProgramFiles%\recuva\lang\lang-3098.dll
%ProgramFiles%\recuva\lang\lang-2074.dll
%ProgramFiles%\recuva\lang\lang-1051.dll
%ProgramFiles%\recuva\lang\lang-1071.dll
%ProgramFiles%\recuva\lang\lang-5146.dll
%ProgramFiles%\recuva\lang\lang-1026.dll
%ProgramFiles%\recuva\lang\lang-1058.dll
%ProgramFiles%\recuva\lang\lang-1050.dll
%ProgramFiles%\recuva\lang\lang-1066.dll
%ProgramFiles%\recuva\lang\lang-1067.dll
%ProgramFiles%\recuva\lang\lang-1061.dll
%ProgramFiles%\recuva\lang\lang-1079.dll
%ProgramFiles%\recuva\lang\lang-9999.dll
%ProgramFiles%\recuva\lang\lang-1068.dll
%ProgramFiles%\recuva\lang\lang-1060.dll
%ProgramFiles%\recuva\lang\lang-1059.dll
%ProgramFiles%\recuva\lang\lang-1062.dll
%ProgramFiles%\recuva\lang\lang-1057.dll
%ProgramFiles%\recuva\lang\lang-1054.dll
C:\users\public\desktop\recuva.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\recuva\recuva.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\recuva\recuva homepage.url
%ProgramFiles%\recuva\uninst.exe
%ProgramFiles%\recuva\lil.log.tmp.f35a2a00-1f5e-45ba-a50e-f59c6865d111
%ProgramFiles%\recuva\lil.log
nul

Удаляет файлы, которые сам же создал

%TEMP%\shib1d.tmp
%TEMP%\msid32.tmp
%TEMP%\msi1b7b.tmp
%TEMP%\msi260b.tmp
%TEMP%\msi2aa0.tmp
%TEMP%\msi5645.tmp
<SYSTEM32>\tasks\c__ifxbsuvi_<Имя файла>.exe
%TEMP%\nsr62b5.tmp\inetc.dll
%TEMP%\nsr62b5.tmp\p\installerhelper.dll
%TEMP%\nsr62b5.tmp\system.dll
%TEMP%\nsr62b5.tmp\userinfo.dll

Перемещает следующие файлы

%ProgramFiles%\recuva\recuvashell64.dll.new в %ProgramFiles%\recuva\recuvashell64.dll
%ProgramFiles%\recuva\lil.log.tmp.f35a2a00-1f5e-45ba-a50e-f59c6865d111 в %ProgramFiles%\recuva\lil.log

Сетевая активность

Подключается к

'an#####cs.ff.avast.com':443
'nc#.#vast.com':80
'12#.#5.231.32':80
'se#####.piriform.com':443

TCP

Запросы HTTP GET

http://nc#.#vast.com/ncc.txt
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f##############

Другие

'an#####cs.ff.avast.com':443
'se#####.piriform.com':443

UDP

DNS ASK nc#.#vast.com
DNS ASK an#####cs.ff.avast.com
DNS ASK se#####.piriform.com

Другое

Ищет следующие окна

ClassName: 'PiriformRegistration' WindowName: ''
ClassName: '#32770' WindowName: 'Piriform Recuva'
ClassName: '#32770' WindowName: 'Recuva'
ClassName: 'PiriformRecuva' WindowName: ''
ClassName: '#32770' WindowName: ''

Создает и запускает на исполнение

'%APPDATA%\getintoway\recuva 1.54.120 technician\prerequisites\recuva\s.exe' /S
'%ProgramFiles%\recuva\recuva64.exe' /installationComplete "bin|folders|allusers"

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /I "%ProgramFiles%\Recuva\RecuvaShell64.dll" /s
'<SYSTEM32>\regsvr32.exe' /I "%ProgramFiles%\Recuva\RecuvaShell64.dll" /s
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\GetintoWAY\Recuva 1.54.120 Technician\prerequisites\Piriform_CCleaner_HostsBlock.cmd\Piriform-BlockerKeyVerificator_RunAsAdministrator.cmd" /S"
'%WINDIR%\syswow64\fltmc.exe'
'%WINDIR%\syswow64\timeout.exe' -1