Trojan.Siggen9.13047

Technical Information

Malicious functions

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{00,00,00,00}'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1601' = '00000000'

Modifies file system

Creates the following files

%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\manifests\cafw.exe_0xf25ee57d28303381c19a5ca1c307e5c5.1.manifest
%TEMP%\res18d5.tmp
%TEMP%\csc18d4.tmp
%TEMP%\tmh3cqgt.out
%TEMP%\tmh3cqgt.cmdline
%TEMP%\tmh3cqgt.0.cs
%TEMP%\pvjpyq3h.dll
%TEMP%\res84b.tmp
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe
%TEMP%\csc84a.tmp
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe
%TEMP%\pvjpyq3h.out
%TEMP%\pvjpyq3h.cmdline
%TEMP%\pvjpyq3h.0.cs
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\myapplication.app@1.0.0.0\myapplication.app@1.0.0.0.manifest
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\myapplication.app@1.0.0.0\myapplication.app.manifest
%TEMP%\tmh3cqgt.dll
%PROGRAMDATA%\cladgenius.com\cladgenius\logs\cafw.log

Deletes the following files

%TEMP%\res84b.tmp
%TEMP%\csc84a.tmp
%TEMP%\pvjpyq3h.0.cs
%TEMP%\pvjpyq3h.dll
%TEMP%\pvjpyq3h.cmdline
%TEMP%\pvjpyq3h.out
%TEMP%\res18d5.tmp
%TEMP%\csc18d4.tmp
%TEMP%\tmh3cqgt.0.cs
%TEMP%\tmh3cqgt.cmdline
%TEMP%\tmh3cqgt.dll
%TEMP%\tmh3cqgt.out

Network activity

Connects to

'94.##9.77.62':80

TCP

HTTP GET requests

http://en.###ipedia.org/wiki/Special:Random

'en.###ipedia.org':443

UDP

DNS ASK en.###ipedia.org
'94.##9.77.62':8752
'94.##9.66.191':8752
'83.##2.48.27':8752
'20#.#4.240.76':8752
'91.##4.44.122':8752

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pvjpyq3h.cmdline"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES84B.tmp" "%TEMP%\CSC84A.tmp"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tmh3cqgt.cmdline"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18D5.tmp" "%TEMP%\CSC18D4.tmp"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pvjpyq3h.cmdline"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES84B.tmp" "%TEMP%\CSC84A.tmp"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tmh3cqgt.cmdline"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18D5.tmp" "%TEMP%\CSC18D4.tmp"' (with hidden window)

Executes the following