Trojan.PWS.Siggen2.28304

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\31281657\oqs.exe %TEMP%\31281657\WDD_UJ~1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'appgfx' = '%APPDATA%\appgfx\appgfx.exe'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\RimArts\B2\Settings]
[<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
[<HKCU>\Software\FTPWare\COREFTP\Sites]

Reads files which store third party applications passwords

%APPDATA%\thunderbird\profiles.ini
<LS_APPDATA>\google\chrome\user data\default\cookies

Modifies file system

Creates the following files

%TEMP%\31281657\xiq.xls
%TEMP%\31281657\ioo.mp3
%TEMP%\31281657\qjq.txt
%TEMP%\31281657\trp.ppt
%TEMP%\31281657\vph.xls
%TEMP%\31281657\fsn.docx
%TEMP%\31281657\spv.msc
%TEMP%\31281657\kmm.dll
%TEMP%\31281657\dqi.log
%TEMP%\31281657\ntb.pdf
%TEMP%\31281657\lcn.jpg
%TEMP%\31281657\xwm.pdf
%TEMP%\31281657\pqb.docx
%TEMP%\31281657\xip.cpl
%TEMP%\31281657\agq.xls
%TEMP%\31281657\iol.ini
%TEMP%\31281657\acb.mp3
%TEMP%\31281657\kkm.ini
%TEMP%\31281657\krl.msc
%TEMP%\31281657\ojd.dat
%TEMP%\31281657\idk.dat
%TEMP%\31281657\ixe.jpg
%TEMP%\31281657\pwr.xls
%APPDATA%\43qqlv5l.mil\firefox\profiles\k0im4xo3.default\cookies.sqlite
%APPDATA%\43qqlv5l.mil\opera\cookies
%APPDATA%\43qqlv5l.mil\chrome\default\cookies
<LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%APPDATA%\appgfx\appgfx.exe
%HOMEPATH%\temp\xiq.xls
%TEMP%\31281657\mxe.pdf
%TEMP%\31281657\xsr.ico
%TEMP%\31281657\qnc.xml
%TEMP%\31281657\rrp.mp3
%TEMP%\31281657\aga.pdf
%TEMP%\31281657\kts.cpl
%TEMP%\31281657\fgf.msc
%TEMP%\31281657\pnm.xml
%TEMP%\31281657\cbc.icm
%TEMP%\31281657\wbo.jpg
%TEMP%\31281657\oln.xls
%TEMP%\31281657\wtr.bmp
%TEMP%\31281657\mvk.exe
%TEMP%\31281657\kfb.pdf
%TEMP%\31281657\asg.dat
%TEMP%\31281657\kow.xls
%TEMP%\31281657\fiu.jpg
%TEMP%\31281657\oum.ppt
%TEMP%\31281657\kwj.docx
%TEMP%\31281657\mqu.ini
%TEMP%\31281657\klu.log
%TEMP%\31281657\kxd.xls
%TEMP%\31281657\nvn.txt
%TEMP%\31281657\dwt.ppt
%TEMP%\31281657\udq.xl
%APPDATA%\43qqlv5l.mil\thunderbird\profiles\10e4mhmg.default\cookies.sqlite
%TEMP%\31281657\ewc.exe
%TEMP%\31281657\uhh.log
%TEMP%\31281657\eml.ico
%TEMP%\31281657\xuc.ico
%TEMP%\31281657\img.dat
%TEMP%\31281657\swc.msc
%TEMP%\31281657\tvw.bmp
%TEMP%\31281657\oqs.exe
%TEMP%\31281657\lgh.vbs
%TEMP%\31281657\wdd=uju
%TEMP%\31281657\vjg.log
%TEMP%\31281657\fau.icm
%TEMP%\31281657\wlr.icm
%TEMP%\31281657\poa.exe
%TEMP%\31281657\nit.bmp
%TEMP%\31281657\rvo.log
%TEMP%\31281657\xps.log
%TEMP%\31281657\hfh.jpg
%TEMP%\31281657\dgp.log
%TEMP%\31281657\jbp.cpl
%TEMP%\31281657\bcl.xls
%TEMP%\31281657\fdh.mp3
%TEMP%\31281657\jwe.exe
%TEMP%\31281657\pmi.msc
%TEMP%\31281657\dms.msc
%TEMP%\31281657\glg.exe
%TEMP%\31281657\tpu.mp3
%TEMP%\31281657\waa.xml
%TEMP%\31281657\ndx.ico
%TEMP%\31281657\mhe.dll
%TEMP%\31281657\atm.dll
%TEMP%\31281657\ege.bmp
%TEMP%\31281657\nch.ini
%TEMP%\31281657\gip.jpg
%TEMP%\31281657\wkc.exe
%APPDATA%\43qqlv5l.mil.zip