Trojan.PWS.Siggen.43757

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'vmmart' = '%PROGRAM_FILES%\niu\oiwejz.exe'
[<HKLM>\SOFTWARE\Classes\icwfile\Shell\Open\Command] '' = ''
[<HKLM>\SOFTWARE\Classes\opfile\shell\open\command] '' = 'explorer /n,"%PROGRAM_FILES%\%H"'
[<HKLM>\SOFTWARE\Classes\odfile\shell\open\command] '' = 'explorer /n,"%PROGRAM_FILES%\T%H"'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Creates and executes the following:

%TEMP%\nsz4.tmp\nsE.tmp "<SYSTEM32>\cscript.exe" "%PROGRAM_FILES%\EditPlus\kk44.icw"
%HOMEPATH%\Templates\installstat.exe
%HOMEPATH%\Templates\kksetup.exe
%HOMEPATH%\Templates\ba44.exe
%TEMP%\nsz4.tmp\ns5.tmp c:\5344.bat

Executes the following:

%WINDIR%\regedit.exe /s %TEMP%\test1.reg
<SYSTEM32>\regedt32.exe /s %TEMP%\test1.reg
<SYSTEM32>\msiexec.exe -Embedding DBA5DB5F81D099B232CFC020E9A7AD42
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\Templates\a.bat" "
<SYSTEM32>\wscript.exe "%HOMEPATH%\Templates\kk44.icw"
<SYSTEM32>\cscript.exe "%PROGRAM_FILES%\EditPlus\kk44.icw"
<SYSTEM32>\reg.exe add HKCU\Software\sid\ /v Sid /d S-1-5-21-2052111302-484763869-725345543-1003 /f
<SYSTEM32>\wbem\wmic.exe userAccount where "Name='%USERNAME%'" get SID /value
<SYSTEM32>\cmd.exe /c c:\5344.bat
<SYSTEM32>\msiexec.exe /V
<SYSTEM32>\msiexec.exe /fauv "%HOMEPATH%\Templates\534444\53440.msj"
%WINDIR%\regedit.exe /s "%WINDIR%\Installer\5344.reg"

Searches for registry branches where third party applications store passwords:

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\TTPlayer\home\bd.exe
%PROGRAM_FILES%\TTPlayer\home\start.vbs
%TEMP%\test1.reg
%PROGRAM_FILES%\0\Desktop.ini
%PROGRAM_FILES%\0\target.lnk
%WINDIR%\Installer\2b4a0.msi
%HOMEPATH%\Templates534444uio.txt
C:\Config.Msi\2b4a3.rbs
%WINDIR%\Installer\MSIB.tmp
%TEMP%\nsz4.tmp\AccessControl.dll
%TEMP%\nsz4.tmp\nsE.tmp
%PROGRAM_FILES%\EditPlus\kk44.icw
%HOMEPATH%\Templates\installstat.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\buy.3525[1]
%HOMEPATH%\Templates\statistics.dll
%PROGRAM_FILES%\T0\target.lnk
%HOMEPATH%\Desktop\Internat Exlporar.op
%PROGRAM_FILES%\T0\Desktop.ini
%HOMEPATH%\Templates\kk44.icw
%HOMEPATH%\Desktop\МФ±¦µј№єНш.od
%TEMP%\nsz4.tmp\nsExec.dll
C:\5344.bat
%TEMP%\nsz4.tmp\ns5.tmp
%TEMP%\nsi7.tmp\ioSpecial.ini
%HOMEPATH%\Templates\kksetup.exe
%HOMEPATH%\Templates\winar30.ime
%TEMP%\nsd2.tmp\System.dll
%HOMEPATH%\Templates\win04453.txt
%TEMP%\nsz4.tmp\System.dll
%HOMEPATH%\Templates\a.bat
%TEMP%\nsi7.tmp\modern-wizard.bmp
%HOMEPATH%\Templates\TempWmicBatchFile.bat
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
%WINDIR%\Installer\3e6cc5.msi
%HOMEPATH%\Templates\534444\uio.txt
%WINDIR%\Installer\5344.reg
%TEMP%\tmp8.tmp
%TEMP%\nsi7.tmp\InstallOptions.dll
%TEMP%\tmp9.tmp
%TEMP%\tmpA.tmp
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Moves the following files:

from %PROGRAM_FILES%\TTPlayer\home\bd.exe to %PROGRAM_FILES%\niu\oiwejz.exe
from %WINDIR%\Installer\3e6cc5.msi to C:\Config.Msi\2b4a4.rbf
from %HOMEPATH%\Templates\534444\uio.txt to %HOMEPATH%\Templates\534444\53440.msj
from %HOMEPATH%\Templates\winar30.ime to %HOMEPATH%\Templates\win04453.txt
from %HOMEPATH%\Templates\win04453.txt to %HOMEPATH%\Templates\ba44.exe

Network activity:

Connects to:

TCP:

HTTP GET requests:

HTTP POST requests:

UDP:

Miscellaneous:

Searches for the following windows: