Trojan.Siggen11.38992

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\dcdbas] 'ImagePath' = 'system32\DRIVERS\dcdbas64.sys'

Creates the following services

'dcdbas' system32\DRIVERS\dcdbas64.sys

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\dell\updatepackage\log\<File name>.txt
%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set3eb4.tmp
%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set3ffd.tmp
%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set4107.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%WINDIR%\temp\udd902e.tmp
%WINDIR%\syswow64\dchbas32.dll
%WINDIR%\syswow64\dchapi32.dll
%WINDIR%\hapint.exe
%WINDIR%\dcmdev64.exe
%WINDIR%\dchcfg32.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\104[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\info[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\styles[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\script[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\header[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\action_button_blue_up_left[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\action_button_blue_up_middle[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\action_button_blue_up_right[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\arrow[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\footer[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\close[1]
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapinst.bat
%WINDIR%\syswow64\dchcfl32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\testhapi.exe
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdtvm32.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi.zip
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas32.cat
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas32.inf
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas32.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas64.cat
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas64.inf
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdbas64.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdesm32.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdipm32.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcdipm64.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcesm.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcwipm32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcesmwdm.sys
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchapi.cer
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchapi32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchbas32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchcfg32.exe
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchcfl32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchipm32.dll
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dciwds32.exe
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev32.exe
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev64.exe
%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\hapint.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\arrow[2]

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Deletes the following files

%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.cat
%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.inf
%TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.sys
%WINDIR%\temp\udd902e.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\arrow[1]

Moves the following files

from %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set3eb4.tmp to %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.cat
from %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set3ffd.tmp to %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.inf
from %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\set4107.tmp to %TEMP%\{37f4d59a-35b2-7bcf-8b09-705203c94e3c}\dcdbas64.sys

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\hapint.exe' -k SPHAPIDA5 -p %WINDIR%\hapint.exe -q
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev64.exe' remove root\dcdbas
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev64.exe' install .\dcdbas64.inf root\dcdbas
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchcfg32.exe' command=getsupportedsystypes
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\temp\{849F1B75-F004-40A7-8428-BD43D932C44C}\hapinst.bat" install"' (with hidden window)
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev64.exe' remove root\dcdbas' (with hidden window)
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dcmdev64.exe' install .\dcdbas64.inf root\dcdbas' (with hidden window)
'%WINDIR%\temp\{849f1b75-f004-40a7-8428-bd43d932c44c}\hapi\dchcfg32.exe' command=getsupportedsystypes' (with hidden window)

Executes the following