Trojan.Siggen11.48575

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\hardlock] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\hardlock] 'ImagePath' = '<DRIVERS>\hardlock.sys'

Creates the following services

'hardlock' <DRIVERS>\hardlock.sys

Modifies file system

Creates the following files

%TEMP%\rarsfx0\haspdinst_cloud.exe
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\ru.15.0.alp
<SYSTEM32>\setup\aladdin\akspccard.cat
<SYSTEM32>\setup\aladdin\akspccard.inf
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\zh-cn.15.0.alp
%WINDIR%\syswow64\hlvdd.dll
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1.cat
%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set55dc.tmp
%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set5744.tmp
%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set5938.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta009.tmp
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta132.tmp
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta28a.tmp
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta411.tmp
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setcfc4.tmp
<DRIVERS>\hardlock.sys
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd0dd.tmp
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd207.tmp
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd340.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set111b.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set12b2.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set13fa.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1572.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1737.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set18fc.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1ab2.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1bdc.tmp
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1cf5.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\ja.15.0.alp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\it.15.0.alp
<SYSTEM32>\setup\aladdin\hasphl\akshhl.cat
%TEMP%\haspds_windows.dll
%WINDIR%\aksdrvsetup.log
%TEMP%\srm.cab
%TEMP%\hasp_windows.dll
%TEMP%\haspdinst_x64.exe
%TEMP%\hhl01.cab
%TEMP%\haspds_windows_x64.dll
%TEMP%\0pdc.txt
<SYSTEM32>\setup\aladdin\hasphl\aksclass.sys
<SYSTEM32>\setup\aladdin\hasphl\aksdf.sys
<SYSTEM32>\setup\aladdin\hasphl\aksfridge.sys
<SYSTEM32>\setup\aladdin\hasphl\akshasp.cat
<SYSTEM32>\setup\aladdin\hasphl\akshasp.inf
<SYSTEM32>\setup\aladdin\hasphl\akshasp.sys
<SYSTEM32>\setup\aladdin\hasphl\akshhl.inf
<SYSTEM32>\setup\aladdin\hasphl\hasplmv.exe
<SYSTEM32>\setup\aladdin\hasphl\akshhl.sys
<SYSTEM32>\setup\aladdin\hasphl\akshhl33.dll
<SYSTEM32>\setup\aladdin\hasphl\akshsp53.dll
<SYSTEM32>\setup\aladdin\akspccard.sys
<SYSTEM32>\setup\aladdin\hasphl\aksusb.cat
<SYSTEM32>\setup\aladdin\hasphl\aksusb.inf
<SYSTEM32>\setup\aladdin\hasphl\aksusb.sys
<SYSTEM32>\setup\aladdin\hasphl\aksusb5.dll
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\de.15.0.alp
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\es.15.0.alp
%CommonProgramFiles(x86)%\aladdin shared\hasp\templates\fr.15.0.alp
<SYSTEM32>\setup\aladdin\hasphl\hardlock.cat
<SYSTEM32>\setup\aladdin\hasphl\hardlock.sys
<SYSTEM32>\setup\aladdin\hasphl\hasplms.exe
<SYSTEM32>\setup\aladdin\hasphl\hlvdd.dll
%WINDIR%\temp\udd6824.tmp

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat

Deletes the following files

%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.cat
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.sys
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.inf
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.cat
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshsp53.dll
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshhl33.dll
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshhl.sys
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshasp.sys
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksclass.sys
%TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb5.dll
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl33.dll
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.inf
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.cat
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshsp53.dll
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.sys
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.inf
%TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.cat
%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.sys
%TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.inf
%TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.sys
%WINDIR%\temp\udd6824.tmp

Moves the following files

from %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set55dc.tmp to %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.cat
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1ab2.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksclass.sys
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set18fc.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshasp.sys
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1737.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshsp53.dll
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1572.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshhl33.dll
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set13fa.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb5.dll
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set12b2.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.sys
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set111b.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\akshhl.sys
from %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd340.tmp to %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.inf
from %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd207.tmp to %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.cat
from %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setd0dd.tmp to %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl33.dll
from %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\setcfc4.tmp to %TEMP%\{3a7c13f2-3a89-6f28-9de2-6a58c71a650e}\akshhl.sys
from %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta411.tmp to %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.sys
from %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta28a.tmp to %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshsp53.dll
from %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta132.tmp to %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.inf
from %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\seta009.tmp to %TEMP%\{7d91fa2c-375c-5ca2-799f-39539a68bc2b}\akshasp.cat
from %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set5938.tmp to %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.sys
from %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\set5744.tmp to %TEMP%\{60498596-397b-2508-f2d9-ed54b8651475}\akspccard.inf
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1bdc.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.cat
from %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\set1cf5.tmp to %TEMP%\{7b547fba-dc43-004a-b8ea-2130fa74e963}\aksusb.inf

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\haspdinst_cloud.exe' -i
'%TEMP%\haspdinst_x64.exe' -i -nomsg -32to64

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial