Trojan.Siggen9.54077

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\SMChk.exe,<SYSTEM32>\userinit.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '%ProgramFiles%\Fortres Grand\Fortres 101 10\Fortres.exe,<SYSTEM32>\SMChk.exe,<SYSTEM32>\userinit.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'F101Tray' = '"%ProgramFiles%\Fortres Grand\Fortres 101 10\F101Tray.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'FSRT' = '%ProgramFiles%\Fortres Grand\Fortres Security Runtime 6.0\fsrtu.exe'

Creates the following services

[<HKLM>\SYSTEM\CurrentControlSet\Services\f101fs] 'ImagePath' = 'system32\drivers\f101fs.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\f101fs] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\FSRT] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\FSRT] 'ImagePath' = '"%ProgramFiles%\Fortres Grand\Fortres Security Runtime 6.0\FSRT.exe"'

Malicious functions

Registers file system filter

[<HKLM>\SYSTEM\CurrentControlSet\Services\f101fs] 'Group' = 'FSFilter Security Enhancer'

Modifies file system

Creates the following files

%TEMP%\f101v10.msi
<SYSTEM32>\fortresd.dll
%ProgramFiles%\fortres grand\fortres security interface\fsi.exe
%ProgramFiles%\fortres grand\fortres security interface\fsi6.adu
%ProgramFiles%\fortres grand\fortres security runtime 6.0\fsrt.exe
%ProgramFiles%\fortres grand\fortres security runtime 6.0\fsrtu.exe
%ProgramFiles%\fortres grand\fortres security runtime 6.0\fsrtv7.adu
%ProgramFiles%\fortres grand\fortres 101 10\launcher.exe
%ProgramFiles%\fortres grand\propedit6.dll
<SYSTEM32>\smchk.exe
%WINDIR%\temp\udd7983.tmp
%WINDIR%\temp\udd8183.tmp
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\userlist.fdb-journal
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\userlist.fdb
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\complist.fdb
%ProgramFiles%\fortres grand\fortres security runtime 6.0\repl\userlist.fdb-journal
%ProgramFiles%\fortres grand\fortres security runtime 6.0\repl\userlist.fdb
%ProgramFiles%\fortres grand\fortres security runtime 6.0\repl\complist.fdb
%PROGRAMDATA%\fortres grand\fortres 101 10\ipdb-journal
%PROGRAMDATA%\fortres grand\fortres 101 10\ipdb
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\appmgr.ad
%ProgramFiles%\fortres grand\fortres 101 10\fortres.exe
%WINDIR%\temp\udd7973.tmp
%ProgramFiles%\fortres grand\fortres security runtime 6.0\flogo.exe
%ProgramFiles%\fortres grand\fortres 101 10\f101ui.dll
%TEMP%\f101v10.msi.log
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\appmgr.default
%ProgramFiles%\fortres grand\fortres security interface\cc6eng.dll
%ProgramFiles%\fortres grand\fortres 101 10\f101.chm
<DRIVERS>\f101fs.sys
%ProgramFiles%\fortres grand\fortres 101 10\f101rt.dll
%ProgramFiles%\fortres grand\fortres 101 10\f101tray.exe
%ProgramFiles%\fortres grand\fortres 101 10\f101v7.adb
%ProgramFiles%\fortres grand\fgpriv.dll
%ProgramFiles%\fortres grand\fortres 101 10\f101v7.adu
%ProgramFiles%\fortres grand\fgactwiz.dll
%ProgramFiles%\fortres grand\fgattr6.dll
<DRIVERS>\fgcf101kb.sys
%ProgramFiles%\fortres grand\fgclient.dll
%ProgramFiles(x86)%\fortres grand\fgclient.dll
%ProgramFiles%\fortres grand\fgcshared.adu
%ProgramFiles%\fortres grand\fgcupdmgr.dll
%ProgramFiles%\fortres grand\fgcupdstub.exe
%ProgramFiles%\fortres grand\fgrchstr.dll
%WINDIR%\installer\{0258a16c-6117-4234-8fcd-9b2bb30fd013}\fortres.ico

Deletes the following files

%WINDIR%\temp\udd7983.tmp
%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\userlist.fdb-journal
%ProgramFiles%\fortres grand\fortres security runtime 6.0\repl\userlist.fdb-journal
%PROGRAMDATA%\fortres grand\fortres 101 10\ipdb-journal
%WINDIR%\temp\udd7973.tmp

Substitutes the following files

%ProgramFiles%\fortres grand\fortres security runtime 6.0\settings\userlist.fdb-journal
%ProgramFiles%\fortres grand\fortres security runtime 6.0\repl\userlist.fdb-journal
%PROGRAMDATA%\fortres grand\fortres 101 10\ipdb-journal

Network activity

TCP

HTTP GET requests