Trojan.Siggen10.22224

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\dcdbas] 'ImagePath' = 'system32\DRIVERS\dcdbas64.sys'

Creates the following services

'dcdbas' system32\DRIVERS\dcdbas64.sys

Modifies file system

Creates the following files

%TEMP%\7zs497af160\package.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcwipm32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\hapint.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\omsacntl.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapinst.bat
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setca31.tmp
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setcbe7.tmp
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setcd2f.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev32.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev64.exe
%WINDIR%\temp\uddc6e.tmp
%WINDIR%\hapint.exe
%WINDIR%\dcmdev64.exe
%WINDIR%\dchcfg32.exe
%WINDIR%\syswow64\dchcfl32.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\104[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\styles[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\script[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\close_normal[1]
%WINDIR%\syswow64\dchbas32.dll
%WINDIR%\syswow64\dchapi32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dciwds32.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchtvm32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchipm32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi.zip
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\miniunz.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\zlibwapi.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas32.cat
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas32.inf
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas32.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas64.cat
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas64.inf
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdbas64.sys
%ALLUSERSPROFILE%\dell\updatepackage\log\package.txt
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdesm32.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdipm64.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdtvm32.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcesm.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcesmwdm.sys
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchapi32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchbas32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchcfg32.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchcfl32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchesm32.dll
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcdipm32.sys
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_normal[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\logo[1]

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Deletes the following files

%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\miniunz.exe
%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\zlibwapi.dll
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.cat
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.inf
%TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.sys
%WINDIR%\temp\uddc6e.tmp

Moves the following files

from %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setca31.tmp to %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.cat
from %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setcbe7.tmp to %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.inf
from %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\setcd2f.tmp to %TEMP%\{08d1c7ed-c8ce-11e2-4d4b-2c2b33184c43}\dcdbas64.sys

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\7zs497af160\package.exe'
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\miniunz.exe' -x %WINDIR%\temp\{23C06505-1A23-446C-A0CD-B58F04891671}\hapi.zip -o -d %WINDIR%\temp\{23C06505-1A23-446C-A0CD-B58F04891671}
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\hapint.exe' -k SPHAPIDA5 -p %WINDIR%\hapint.exe -q
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev64.exe' remove root\dcdbas
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev64.exe' install .\dcdbas64.inf root\dcdbas
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchcfg32.exe' command=getsupportedsystypes
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\miniunz.exe' -x %WINDIR%\temp\{23C06505-1A23-446C-A0CD-B58F04891671}\hapi.zip -o -d %WINDIR%\temp\{23C06505-1A23-446C-A0CD-B58F04891671}' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\temp\{23C06505-1A23-446C-A0CD-B58F04891671}\hapinst.bat" install"' (with hidden window)
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev64.exe' remove root\dcdbas' (with hidden window)
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dcmdev64.exe' install .\dcdbas64.inf root\dcdbas' (with hidden window)
'%WINDIR%\temp\{23c06505-1a23-446c-a0cd-b58f04891671}\hapi\dchcfg32.exe' command=getsupportedsystypes' (with hidden window)