Trojan.Siggen9.43157

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '0Joshua0.exe' = '%WINDIR%\0Joshua0.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2Joshua5.exe' = '%WINDIR%\2Joshua5.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6Joshua15.exe' = '<SYSTEM32>\6Joshua15.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8Damian20.exe' = '<SYSTEM32>\8Damian20.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10Damian25.exe' = '%ProgramFiles%\10Damian25.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12Damian30.exe' = '%ProgramFiles%\12Damian30.exe'

Creates the following files on removable media

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Modifies file system

Creates the following files

%WINDIR%\inf\sound3x86.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserrordiagoff_weboc[1]
%ProgramFiles%\12damian30.exe
%ProgramFiles%\10damian25.exe
<SYSTEM32>\8damian20.exe
<SYSTEM32>\6joshua15.exe
%WINDIR%\2joshua5.exe
%WINDIR%\0joshua0.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]

Sets the 'hidden' attribute to the following files

Deletes the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]

Network activity

TCP

HTTP GET requests