Trojan.Siggen10.22565

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /t /f /IM KMSS.exe
'<SYSTEM32>\netsh.exe' Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Deletes the following files

Network activity

TCP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%CommonProgramFiles(x86)%\~zzcaoir.tmp' /convert /activate
'%CommonProgramFiles(x86)%\files\files.dat' -y -pkmsauto
'%CommonProgramFiles(x86)%\files\kmss.dat' -y -pkmsauto
'%CommonProgramFiles(x86)%\files\bin\kmss.exe' -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort
'%WINDIR%\temp\test.dat' 127.0.0.2:1688 -l Windows -6
'<SYSTEM32>\cmd.exe' /D /c copy <SYSTEM32>\Tasks\OInstall "%WINDIR%\Temp\OInstall.tmp" /Y' (with hidden window)
'<SYSTEM32>\cmd.exe' /D /c files.dat -y -pkmsauto' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY HKLM\Software\WOW6432Node\Microsoft\Office /s /v Path' (with hidden window)
'<SYSTEM32>\cmd.exe' /D /c kmss.dat -y -pkmsauto' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /t /f /IM KMSS.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /D /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP' (with hidden window)
'<SYSTEM32>\cmd.exe' /D /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=' (with hidden window)
'%CommonProgramFiles(x86)%\files\bin\kmss.exe' -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort' (with hidden window)
'<SYSTEM32>\cmd.exe' /D /c %WINDIR%\Temp\test.dat 127.0.0.2:1688 -l Windows -6' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /D /c copy <SYSTEM32>\Tasks\OInstall "%WINDIR%\Temp\OInstall.tmp" /Y
'<SYSTEM32>\cmd.exe' /D /c files.dat -y -pkmsauto
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64
'%WINDIR%\syswow64\reg.exe' QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64
'%WINDIR%\syswow64\cmd.exe' /c REG QUERY HKLM\Software\WOW6432Node\Microsoft\Office /s /v Path
'%WINDIR%\syswow64\reg.exe' QUERY HKLM\Software\WOW6432Node\Microsoft\Office /s /v Path
'<SYSTEM32>\cmd.exe' /D /c kmss.dat -y -pkmsauto
'<SYSTEM32>\cmd.exe' /D /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
'<SYSTEM32>\netsh.exe' Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
'<SYSTEM32>\cmd.exe' /D /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=
'<SYSTEM32>\cmd.exe' /D /c %WINDIR%\Temp\test.dat 127.0.0.2:1688 -l Windows -6
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%CommonProgramFiles(x86)%\files\...

Выдаётся при установке

Завантажте
Dr.Web для Android