Trojan.Siggen33.18031

Technical Information

Triggers a user-defined sigma rule:

4281cb20-2994-4580-aa63-c8b86d019934
20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
2aa0a6b4-a865-495b-ab51-c28249537b75
ec82e2a5-81ea-4211-a1f8-37a0286df2c2
edf3485d-dac4-4d50-90e4-b0e5813f7e60
297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
d223b46b-5621-4037-88fe-fda32eead684
ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '%APPDATA%\Microsoft\Crypto\wims50pn\r3u2710c.exe'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\ozpb0v.exe

Modifies file system

Creates the following files

%TEMP%\_mei20162\vcruntime140.dll
%TEMP%\_mei20162\_asyncio.pyd
%TEMP%\_mei20162\_bz2.pyd
%TEMP%\_mei20162\_cffi_backend.cp39-win_amd64.pyd
%TEMP%\_mei20162\_ctypes.pyd
%TEMP%\_mei20162\_decimal.pyd
%TEMP%\_mei20162\_hashlib.pyd
%TEMP%\_mei20162\_lzma.pyd
%TEMP%\_mei20162\_multiprocessing.pyd
%TEMP%\_mei20162\_overlapped.pyd
%TEMP%\_mei20162\_queue.pyd
%TEMP%\_mei20162\_socket.pyd
%TEMP%\_mei20162\_ssl.pyd
%TEMP%\_mei20162\_uuid.pyd
%TEMP%\_mei20162\base_library.zip
%TEMP%\_mei20162\certifi\cacert.pem
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\installer
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\metadata
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\record
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\wheel
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\licenses\license
%TEMP%\_mei20162\curl_cffi-0.13.0.dist-info\top_level.txt
%TEMP%\_mei20162\curl_cffi\__init__.py
%TEMP%\_mei20162\curl_cffi\__version__.py
%TEMP%\_mei20162\curl_cffi\_asyncio_selector.py
%TEMP%\_mei20162\curl_cffi\_wrapper.pyd
%TEMP%\_mei20162\curl_cffi\aio.py
%TEMP%\_mei20162\curl_cffi\const.py
%TEMP%\_mei20162\curl_cffi\curl.py
%TEMP%\_mei20162\curl_cffi\py.typed
%TEMP%\_mei20162\curl_cffi\requests\__init__.py
%TEMP%\_mei20162\curl_cffi\requests\cookies.py
%TEMP%\_mei20162\curl_cffi\requests\errors.py
%TEMP%\_mei20162\curl_cffi\requests\exceptions.py
%TEMP%\_mei20162\curl_cffi\requests\headers.py
%TEMP%\_mei20162\curl_cffi\requests\impersonate.py
%TEMP%\_mei20162\curl_cffi\requests\models.py
%TEMP%\_mei20162\curl_cffi\requests\session.py
%TEMP%\_mei20162\curl_cffi\requests\utils.py
%TEMP%\_mei20162\curl_cffi\requests\websockets.py
%TEMP%\_mei20162\curl_cffi\utils.py
%TEMP%\_mei20162\libcrypto-1_1.dll
%TEMP%\_mei20162\libffi-7.dll
%TEMP%\_mei20162\libssl-1_1.dll
%TEMP%\_mei20162\pyexpat.pyd
%TEMP%\_mei20162\python3.dll
%TEMP%\_mei20162\python39.dll
%TEMP%\_mei20162\select.pyd
%TEMP%\_mei20162\unicodedata.pyd
%APPDATA%\microsoft\crypto\wims50pn\r3u2710c.exe
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-bcc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-e70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-1398.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-e4c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-c68.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d20-88c.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Sets the 'hidden' attribute to the following files

%APPDATA%\microsoft\crypto\wims50pn\r3u2710c.exe

Deletes following files that it created itself

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-1398.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-bcc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-c68.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-e4c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d18-e70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a751d20-88c.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%TEMP%\.ses

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'localhost':49691
'go###.org.ua':443
'localhost':49694
'if##nfig.me':443
't.#e':80
'2.##.167.200':80
'fa###ook.com':80
'localhost':49700
'co####.edge.skype.com':443
'localhost':49709
'localhost':49715
'localhost':49718
'localhost':49721
'localhost':49724
'localhost':49730
'localhost':49735
'localhost':49740
'localhost':49744
'23.#3.4.198':443
'localhost':49747
'localhost':49749
'localhost':49751
'localhost':49763
'23.#3.4.198':80
'localhost':49779
'localhost':49808
'localhost':49816
'localhost':49820
'localhost':49831
'localhost':49838
'localhost':49841
'localhost':49845
'localhost':49850
'13#.#01.132.148':80
'localhost':49858
'localhost':49868
'localhost':49869
'localhost':49871
't.#e':443
'localhost':49886
'localhost':49898
'localhost':49919
'localhost':49923
'localhost':49922
'localhost':49929
'localhost':49931
'localhost':49935
'localhost':49936
'localhost':49939
'localhost':49940
'23.##.32.217':443
'localhost':49947
'localhost':49951
'localhost':49950
'localhost':49956
'localhost':49959
'localhost':49963
'localhost':49966
'localhost':49967
'localhost':49970
'localhost':49975
'localhost':49976
'localhost':49978
'localhost':49981
'localhost':49983
'localhost':49986
'localhost':49990
'localhost':49995
'localhost':49999
'localhost':50001
'localhost':50005
'localhost':50008
'localhost':50011
'localhost':50015
'localhost':50018
'localhost':50021
'localhost':50024
'localhost':50027
'localhost':50030
'localhost':50033
'localhost':50036
'localhost':50038

TCP

HTTP GET requests

http://www.fa###ook.com/gononstopukraine

HTTP POST requests

http://go###.org.ua/@gononstopukraine
http://go###.org.ua/gononstopukraine
http://go###.org.ua/xmlrpc.php
http://go###.org.ua/wp-cron.php
http://go###.org.ua/wp-content/themes/go-ns/send-message-to-telegram.php

Other

'localhost':49691
'localhost':49692
'go###.org.ua':443
'localhost':49694
'localhost':49695
'if##nfig.me':443
'localhost':49700
'localhost':49701
'co####.edge.skype.com':443
'localhost':49709
'localhost':49710
'localhost':49715
'localhost':49716
'localhost':49718
'localhost':49719
'localhost':49721
'localhost':49722
'localhost':49724
'localhost':49725
'localhost':49730
'localhost':49731
'localhost':49735
'localhost':49737
'localhost':49740
'localhost':49741
'localhost':49744
'localhost':49745
'23.#3.4.198':443
'localhost':49747
'localhost':49749
'localhost':49748
'localhost':49751
'localhost':49750
'localhost':49752
'localhost':49763
'localhost':49764
'localhost':49779
'localhost':49781
'localhost':49808
'localhost':49809
'localhost':49816
'localhost':49817
'localhost':49820
'localhost':49823
'localhost':49831
'localhost':49832
'localhost':49838
'localhost':49840
'localhost':49841
'localhost':49843
'localhost':49845
'localhost':49846
'localhost':49850
'localhost':49851
'localhost':49858
'localhost':49860
'localhost':49868
'localhost':49869
'localhost':49871
'localhost':49870
'localhost':49873
'localhost':49872
'localhost':49886
'localhost':49888
'localhost':49898
'localhost':49902
'localhost':49919
'localhost':49921
'localhost':49922
'localhost':49923
'localhost':49924
'localhost':49925
'localhost':49929
'localhost':49930
'localhost':49931
'localhost':49932
'localhost':49935
'localhost':49936
'localhost':49940
'localhost':49939
'localhost':49941
'localhost':49942
'localhost':49937
'localhost':49938
'localhost':49947
'localhost':49948
'localhost':49951
'localhost':49953
'localhost':49950
'localhost':49954
'localhost':49956
'localhost':49957
'localhost':49959
'localhost':49960
'23.##.32.217':443
'localhost':49963
'localhost':49964
'localhost':49967
'localhost':49969
'localhost':49966
'localhost':49970
'localhost':49968
'localhost':49971
'localhost':49975
'localhost':49976
'localhost':49978
'localhost':49981
'localhost':49983
'localhost':49977
'localhost':49979
'localhost':49980
'localhost':49982
'localhost':49986
'localhost':49990
'localhost':49984
'localhost':49987
'localhost':49995
'localhost':49992
'localhost':49996
'localhost':49999
'localhost':50000
'localhost':50001
'localhost':50002
'localhost':50005
'localhost':50006
'localhost':50008
'localhost':50009
'localhost':50011
'localhost':50012
'localhost':50015
'localhost':50016
'localhost':50018
'localhost':50019
'localhost':50021
'localhost':50022
'localhost':50024
'localhost':50025
'localhost':50027
'localhost':50028
'localhost':50030
'localhost':50031
'localhost':50033
'localhost':50034
'localhost':50036
'localhost':50038
'localhost':50039
'localhost':50037

UDP

DNS ASK go###.org.ua
DNS ASK if##nfig.me
DNS ASK t.#e
DNS ASK ti##ok.com
DNS ASK fa###ook.com
DNS ASK co####.edge.skype.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c attrib +h +s "%APPDATA%\Microsoft\Crypto\wims50pn\r3u2710c.exe"
'<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Crypto\wims50pn\r3u2710c.exe"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://t.me/s/gononstopukraine
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.tiktok.com/@gononstopukraine
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.facebook.com/gononstopukraine
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://go-ns.org.ua/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://go-ns.org.ua/
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,12906744620396464128,5871370571232383183,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://go-ns.org.ua/' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial