Trojan.PWS.Siggen2.1735

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gittens' = '"%ProgramFiles%\Resistor\couching.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'readmit' = '"%ProgramFiles%\gien\readmit.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\ritch.lnk

Malicious functions:

Creates and executes the following:

'%TEMP%\nsq2.tmp\115854.exe'
'%TEMP%\nsq2.tmp\NMrailroading.exe' "%ProgramFiles%\nashville\nashville.exe" "k75755904"
'%TEMP%\nsq2.tmp\NMrailroading.exe' "%ProgramFiles%\Entente\couching.exe" "75755904"
'%ProgramFiles%\gien\readmit.exe'
'%TEMP%\nsoC.tmp\nsE.tmp' taskkill /im chrome.exe
'%TEMP%\nsq2.tmp\96298.exe'
'%TEMP%\nsq2.tmp\57318.exe'
'%TEMP%\nsq2.tmp\133329.exe'
'%TEMP%\nsq2.tmp\NMrailroading.exe' "%ProgramFiles%\Resistor\couching.exe" "46224590"
'%TEMP%\nsq2.tmp\84337.exe'
'%ProgramFiles%\Resistor\couching.exe'
'%ProgramFiles%\Entente\couching.exe'
'%TEMP%\nsq2.tmp\NMrailroading.exe' "<LS_APPDATA>\couching.exe" "56471884"
'%TEMP%\nsq2.tmp\45895.exe'

Executes the following:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Searches for registry branches where third party applications store passwords:

[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]

Modifies file system:

Creates the following files:

%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[6].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[5].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[7].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[9].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[8].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[4].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[3].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[10].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[2].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[17].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[3].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[5].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[4].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[16].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[12].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[11].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[13].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[15].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[14].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU[1].asp
%TEMP%\nsq2.tmp\Microsoft.Win32.TaskScheduler.dll
%TEMP%\nsq2.tmp\NMrailroading.exe
%TEMP%\nsq2.tmp\115854.exe
%ProgramFiles%\Resistor\couching.dll
%ProgramFiles%\Resistor\Resistor.exe
%TEMP%\nsq2.tmp\133329.exe
%TEMP%\nsq2.tmp\45895.exe
%TEMP%\nsq2.tmp\28069.exe
%TEMP%\nsq2.tmp\57318.exe
%TEMP%\nsq2.tmp\96298.exe
%TEMP%\nsq2.tmp\84337.exe
%ProgramFiles%\Resistor\couching.exe
%WINDIR%\racoon.exe
%TEMP%\nso9.tmp\AccessControl.dll
%TEMP%\nsoC.tmp\nsExec.dll
%TEMP%\nsaF.tmp\ShellLink.dll
%TEMP%\nsoC.tmp\nsE.tmp
%ProgramFiles%\gien\readmit.exe
%TEMP%\nsl4.tmp\AccessControl.dll
<LS_APPDATA>\couching.exe
%ProgramFiles%\Entente\couching.exe
%ProgramFiles%\nashville\nashville.exe
%TEMP%\nse7.tmp\SimpleFC.dll

Deletes the following files:

%TEMP%\nsaF.tmp\ShellLink.dll
%TEMP%\nso9.tmp\AccessControl.dll
%TEMP%\nsl4.tmp\AccessControl.dll
%TEMP%\nse7.tmp\SimpleFC.dll

Modifies the HOSTS file.

Network activity:

Connects to:

'ww##.##nfinepercy.pw':80
'localhost':1046
'www.co###nepercy.pw':80
'localhost':1037
'localhost':1039

TCP:

HTTP GET requests:

http://ww##.##nfinepercy.pw/Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU.asp?cl################################################
http://www.co###nepercy.pw/Jgfy2QhOHedU0QhOHedU1QhOHedU71RH10Jgfy3QhOHedU.asp?cl################################################

UDP: