Trojan.Siggen32.24084

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\HTTP\shell\open\command] '' = '"%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Start Page' = '<SYSTEM32>\ctfmon.exe'
[HKLM\Software\Classes\WinRAR\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'
[HKLM\Software\Classes\WinRAR.ZIP\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'
[HKLM\Software\Classes\WinRAR.REV\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'

Malicious functions

Modifies settings of Windows Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\aut7c02.tmp
%TEMP%\softinstall.exe
%TEMP%\aut7e93.tmp
%TEMP%\winset.exe
%TEMP%\aut7f7c.tmp
%TEMP%\kugou7_tmp.exe
%TEMP%\aut8134.tmp
%TEMP%\systemset.exe
C:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\启动 internet explorer 浏览器.lnk
%APPDATA%\microsoft\internet explorer\quick launch\启动 internet explorer 浏览器.lnk
C:\documents and settings\default user\application data\microsoft\internet explorer\quick launch\好桌道美化软件.lnk
%APPDATA%\microsoft\internet explorer\quick launch\好桌道美化软件.lnk
%HOMEPATH%\favorites\256安全导航.url
%HOMEPATH%\favorites\xp系统下载,windows7系统下载,最新windows8系统下载_系统之家.url
%HOMEPATH%\favorites\淘宝购物.url
%HOMEPATH%\favorites\256电影排行榜——最新，最好看的高清电影.url
%HOMEPATH%\favorites\256电视剧排行榜——最新,最好看的高清电视剧.url
%HOMEPATH%\favorites\xp主题下载,win7主题下载-主题之家.url
%HOMEPATH%\favorites\软件下载绿色软件软件之家 - 绿色软件下载基地.url
%HOMEPATH%\favorites\哇哇网 - 女性时尚导购分享社区.url
%TEMP%\{c19c4008-404e-4a92-acfd-959ad8610085}.png
%LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{bfd8037c-7e4f-b963-fe53-6179e645b629}.png
%TEMP%\aut920b.tmp
%TEMP%\winrar.exe
%TEMP%\aut971b.tmp
%LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{f6c01ae2-42bd-8fe9-b12c-326955a68690}.png
%TEMP%\winrar_install.exe
%TEMP%\auta40e.tmp
%TEMP%\sogou_pinyin.exe
%ProgramFiles(x86)%\winrar\file_id.diz
%ProgramFiles(x86)%\winrar\descript.ion
%ProgramFiles(x86)%\winrar\readme.txt
%ProgramFiles(x86)%\winrar\license.txt
%ProgramFiles(x86)%\winrar\rar.txt
%ProgramFiles(x86)%\winrar\technote.txt
%ProgramFiles(x86)%\winrar\whatsnew.txt
%ProgramFiles(x86)%\winrar\order.htm
%ProgramFiles(x86)%\winrar\下载站下载说明.htm
%ProgramFiles(x86)%\winrar\rarfiles.lst
%ProgramFiles(x86)%\winrar\uninstall.lst
%ProgramFiles(x86)%\winrar\rar.exe
%ProgramFiles(x86)%\winrar\uninstall.exe
%ProgramFiles(x86)%\winrar\unrar.exe
%ProgramFiles(x86)%\winrar\winrar.exe
%ProgramFiles(x86)%\winrar\formats\7zxa.dll
%ProgramFiles(x86)%\winrar\rarext.dll
%ProgramFiles(x86)%\winrar\rarext64.dll
%ProgramFiles(x86)%\winrar\formats\unacev2.dll
%ProgramFiles(x86)%\winrar\formats\7z.fmt
%ProgramFiles(x86)%\winrar\formats\ace.fmt
%ProgramFiles(x86)%\winrar\formats\arj.fmt
%ProgramFiles(x86)%\winrar\formats\bz2.fmt
%ProgramFiles(x86)%\winrar\formats\cab.fmt
%ProgramFiles(x86)%\winrar\formats\gz.fmt
%ProgramFiles(x86)%\winrar\formats\iso.fmt
%ProgramFiles(x86)%\winrar\formats\lzh.fmt
%ProgramFiles(x86)%\winrar\formats\tar.fmt
%ProgramFiles(x86)%\winrar\formats\uue.fmt
%ProgramFiles(x86)%\winrar\formats\z.fmt
%ProgramFiles(x86)%\winrar\rarreg.key
%ProgramFiles(x86)%\winrar\default.sfx
%ProgramFiles(x86)%\winrar\wincon.sfx
%ProgramFiles(x86)%\winrar\zip.sfx
%ProgramFiles(x86)%\winrar\winrar.chm
%ProgramFiles(x86)%\winrar\rarnew.dat
%ProgramFiles(x86)%\winrar\zipnew.dat
%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar 中文帮助.lnk
%APPDATA%\microsoft\windows\start menu\programs\winrar\控制台 rar 中文手册.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar 中文帮助.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\控制台 rar 中文手册.lnk
%TEMP%\autbe1e.tmp
%TEMP%\pps_install.exe
%TEMP%\autd8ac.tmp
%TEMP%\sougou_install.exe
%TEMP%\autf2fc.tmp
%TEMP%\xunyou_install.exe

Deletes the following system files

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
<SYSTEM32>\tasks\microsoft\office\office 15 subscription heartbeat
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentfallback2016
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentlogon2016
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64 critical
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 critical
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\appid\edp policy manager
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\application experience\microsoft compatibility appraiser
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\application experience\startupapptask
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierdaily
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierinstall
<SYSTEM32>\tasks\microsoft\windows\applicationdata\cleanuptemporarystate
<SYSTEM32>\tasks\microsoft\windows\applicationdata\dssvccleanup
<SYSTEM32>\tasks\microsoft\windows\appxdeploymentclient\pre-staged app cleanup
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker encrypt all drives
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\brokerinfrastructure\bgtaskregistrationmaintenancetask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\aikcertenrolltask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\cryptopolicytask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\keypregentask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\chkdsk\proactivescan
<SYSTEM32>\tasks\microsoft\windows\chkdsk\syspartrepair
<SYSTEM32>\tasks\microsoft\windows\clip\license validation
<SYSTEM32>\tasks\microsoft\windows\cloudexperiencehost\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity check and scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan for crash recovery
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\device setup\metadata refresh
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlecommand
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlewnscommand
<SYSTEM32>\tasks\microsoft\windows\diagnosis\recommendedtroubleshootingscanner
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\directx\directxdatabaseupdater
<SYSTEM32>\tasks\microsoft\windows\directx\dxgiadaptercache
<SYSTEM32>\tasks\microsoft\windows\diskcleanup\silentcleanup
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\diagnostics
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\storagesense
<SYSTEM32>\tasks\microsoft\windows\edp\edp app launch task
<SYSTEM32>\tasks\microsoft\windows\edp\edp auth task
<SYSTEM32>\tasks\microsoft\windows\edp\edp inaccessible credentials task
<SYSTEM32>\tasks\microsoft\windows\edp\storagecardencryption task
<SYSTEM32>\tasks\microsoft\windows\exploitguard\exploitguard mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclient
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclientonscenariodownload
<SYSTEM32>\tasks\microsoft\windows\file classification infrastructure\property definition sync
<SYSTEM32>\tasks\microsoft\windows\filehistory\file history (maintenance mode)
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\reconcilefeatures
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedataflushing
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedatareporting
<SYSTEM32>\tasks\microsoft\windows\helloface\fodcleanuptask
<SYSTEM32>\tasks\microsoft\windows\input\localusersyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\mousesyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\pensyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\touchpadsyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdatesasuser
<SYSTEM32>\tasks\microsoft\windows\installservice\smartretry
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandcontinueupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandscanforupdates
<SYSTEM32>\tasks\microsoft\windows\international\synchronize language settings
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\installation
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\reconcilelanguageresources
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\uninstallation
<SYSTEM32>\tasks\microsoft\windows\license manager\tempsignedlicenseexchange
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\location\windowsactiondialog
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\cellular
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\logon
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\retry
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\runonreboot
<SYSTEM32>\tasks\microsoft\windows\maps\mapstoasttask
<SYSTEM32>\tasks\microsoft\windows\maps\mapsupdatetask
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\processmemorydiagnosticevents
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\runfullmemorydiagnostic
<SYSTEM32>\tasks\microsoft\windows\mobile broadband accounts\mno metadata parser
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\nlasvc\wifitask
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\pi\secure-boot-update
<SYSTEM32>\tasks\microsoft\windows\pi\sqm-tasks
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install group policy
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install reboot required
<SYSTEM32>\tasks\microsoft\windows\plug and play\sysprep generalize drivers
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\printing\eduprintprov
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\logincheck
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\registration
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\recoveryenvironment\verifywinre
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\servicing\startcomponentcleanup
<SYSTEM32>\tasks\microsoft\windows\settingsync\backgrounduploadtask
<SYSTEM32>\tasks\microsoft\windows\settingsync\networkstatechangetask
<SYSTEM32>\tasks\microsoft\windows\setup\setupcleanuptask
<SYSTEM32>\tasks\microsoft\windows\sharedpc\account cleanup
<SYSTEM32>\tasks\microsoft\windows\shell\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetymonitor
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetyrefreshtask
<SYSTEM32>\tasks\microsoft\windows\shell\indexerautomaticmaintenance
<SYSTEM32>\tasks\microsoft\windows\shell\updateuserpicturetask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasklogon
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasknetwork
<SYSTEM32>\tasks\microsoft\windows\spaceport\spaceagenttask
<SYSTEM32>\tasks\microsoft\windows\spaceport\spacemanagertask
<SYSTEM32>\tasks\microsoft\windows\speech\speechmodeldownloadtask
<SYSTEM32>\tasks\microsoft\windows\staterepository\maintenancetasks
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers management initialization
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers optimization
<SYSTEM32>\tasks\microsoft\windows\subscription\enablelicenseacquisition
<SYSTEM32>\tasks\microsoft\windows\subscription\licenseacquisition
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacheprepopulate
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacherebalance
<SYSTEM32>\tasks\microsoft\windows\sysmain\respristaticdbsync
<SYSTEM32>\tasks\microsoft\windows\sysmain\wsswapassessmenttask
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\time synchronization\forcesynchronizetime
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\time zone\synchronizetimezone
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-hascertretr
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-maintenance

Deletes following files that it created itself

%TEMP%\aut7c02.tmp
%TEMP%\aut7e93.tmp
%TEMP%\aut7f7c.tmp
%TEMP%\aut8134.tmp
%TEMP%\{c19c4008-404e-4a92-acfd-959ad8610085}.png
%TEMP%\aut920b.tmp
%TEMP%\aut971b.tmp
%TEMP%\auta40e.tmp
%TEMP%\autbe1e.tmp
%TEMP%\autd8ac.tmp
%TEMP%\autf2fc.tmp

Modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnk

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\softinstall.exe'
'%TEMP%\winset.exe'
'%TEMP%\kugou7_tmp.exe'
'%TEMP%\systemset.exe'
'%TEMP%\winrar.exe'
'%TEMP%\winrar_install.exe'
'%TEMP%\sogou_pinyin.exe'
'%ProgramFiles(x86)%\winrar\uninstall.exe' /setup
'%TEMP%\pps_install.exe'
'%TEMP%\sougou_install.exe'
'%TEMP%\xunyou_install.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN * /F
'%WINDIR%\syswow64\schtasks.exe' /Delete /TN * /F
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\winset.exe"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\softinstall.exe"
'%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN * /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\winset.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\softinstall.exe"' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial