Trojan.PWS.Siggen2.33725

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\508softwareandos.doc.wncryt
<Drive name for removable media>:\applicantform_en.doc.wncryt
<Drive name for removable media>:\ovp25012015.doc.wncryt

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Reads files which store third party applications passwords

%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\tileimage.bmp

Modifies file system

Creates the following files

%TEMP%\autf65d.tmp
%TEMP%\5963\s.wnry
%TEMP%\5963\t.wnry
%TEMP%\5963\taskdl.exe
%TEMP%\5963\taskse.exe
%TEMP%\5963\u.wnry
%TEMP%\5963\00000000.pky
%TEMP%\5963\00000000.eky
%TEMP%\5963\00000000.res
%TEMP%\5963\@wanadecryptor@.exe
%TEMP%\5963\127861570686228.bat
%TEMP%\5963\@please_read_me@.txt
%HOMEPATH%\desktop\cveuropeo.doc.wncryt
%TEMP%\5963\msg\m_french.wnry
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
%HOMEPATH%\desktop\sdszfo.docx.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\archer.avi.wncryt
%HOMEPATH%\desktop\coffee.bmp.wncryt
%HOMEPATH%\desktop\dashborder_120.bmp.wncryt
%HOMEPATH%\desktop\dashborder_144.bmp.wncryt
%HOMEPATH%\desktop\dashborder_192.bmp.wncryt
%HOMEPATH%\desktop\dial.bmp.wncryt
%HOMEPATH%\desktop\dialmap.bmp.wncryt
%HOMEPATH%\desktop\join.avi.wncryt
%HOMEPATH%\desktop\tileimage.bmp.wncryt
%TEMP%\5963\msg\m_vietnamese.wnry
%TEMP%\5963\r.wnry
%TEMP%\5963\msg\m_turkish.wnry
%TEMP%\5963\msg\m_swedish.wnry
%TEMP%\5963\msg\m_spanish.wnry
%TEMP%\5963\5963.exe
%TEMP%\5963\b.wnry
%TEMP%\5963\c.wnry
%TEMP%\5963\msg\m_bulgarian.wnry
%TEMP%\5963\msg\m_chinese (simplified).wnry
%TEMP%\5963\msg\m_chinese (traditional).wnry
%TEMP%\5963\msg\m_croatian.wnry
%TEMP%\5963\msg\m_czech.wnry
%TEMP%\5963\msg\m_danish.wnry
%TEMP%\5963\msg\m_dutch.wnry
%TEMP%\5963\msg\m_english.wnry
%TEMP%\5963\msg\m_filipino.wnry
%TEMP%\5963\m.vbs
%HOMEPATH%\desktop\ovp25012015.doc.wncryt
%TEMP%\5963\msg\m_finnish.wnry
%TEMP%\5963\msg\m_greek.wnry
%TEMP%\5963\msg\m_indonesian.wnry
%TEMP%\5963\msg\m_italian.wnry
%TEMP%\5963\msg\m_japanese.wnry
%TEMP%\5963\msg\m_korean.wnry
%TEMP%\5963\msg\m_latvian.wnry
%TEMP%\5963\msg\m_norwegian.wnry
%TEMP%\5963\msg\m_polish.wnry
%TEMP%\5963\msg\m_portuguese.wnry
%TEMP%\5963\msg\m_romanian.wnry
%TEMP%\5963\msg\m_russian.wnry
%TEMP%\5963\msg\m_slovak.wnry
%TEMP%\pjezsid
%TEMP%\5963\msg\m_german.wnry
%TEMP%\5963\@wanadecryptor@.exe.lnk

Deletes the following files

%TEMP%\autf65d.tmp
%TEMP%\pjezsid
%TEMP%\5963\5963.exe
%TEMP%\5963\m.vbs
<Drive name for removable media>:\ovp25012015.doc.wncryt

Moves the following files

from %HOMEPATH%\desktop\cveuropeo.doc.wncryt to %HOMEPATH%\desktop\cveuropeo.doc.wncry
from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
from %HOMEPATH%\desktop\ovp25012015.doc.wncryt to %HOMEPATH%\desktop\ovp25012015.doc.wncry
from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
from %HOMEPATH%\desktop\archer.avi.wncryt to %HOMEPATH%\desktop\archer.avi.wncry
from %HOMEPATH%\desktop\coffee.bmp.wncryt to %HOMEPATH%\desktop\coffee.bmp.wncry
from %HOMEPATH%\desktop\dashborder_120.bmp.wncryt to %HOMEPATH%\desktop\dashborder_120.bmp.wncry
from %HOMEPATH%\desktop\dashborder_144.bmp.wncryt to %HOMEPATH%\desktop\dashborder_144.bmp.wncry
from %HOMEPATH%\desktop\dashborder_192.bmp.wncryt to %HOMEPATH%\desktop\dashborder_192.bmp.wncry
from %HOMEPATH%\desktop\dial.bmp.wncryt to %HOMEPATH%\desktop\dial.bmp.wncry
from %HOMEPATH%\desktop\dialmap.bmp.wncryt to %HOMEPATH%\desktop\dialmap.bmp.wncry
from %HOMEPATH%\desktop\join.avi.wncryt to %HOMEPATH%\desktop\join.avi.wncry
from %HOMEPATH%\desktop\tileimage.bmp.wncryt to %HOMEPATH%\desktop\tileimage.bmp.wncry

Miscellaneous

Creates and executes the following

'%TEMP%\5963\5963.exe'
'%TEMP%\5963\taskdl.exe'
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'%TEMP%\5963\taskdl.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 127861570686228.bat' (with hidden window)

Executes the following