Trojan.Siggen17.49640

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\.exe] '' = 'jpegfile'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\Rsnjgl cxjnoqxe] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Rsnjgl cxjnoqxe] 'ImagePath' = '%ProgramFiles(x86)%\Wgkqqa.exe'

Creates the following services

'Rsnjgl cxjnoqxe' %ProgramFiles(x86)%\Wgkqqa.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Command Prompt (CMD)
Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im KVXP.kxp
'%WINDIR%\syswow64\taskkill.exe' /f /im Ravmon.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im kavsvc.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im Rav.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im VsTskMgr.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im Mcshield.exe

Modifies file system

Creates the following files

<Current directory>\1.exe
%ProgramFiles(x86)%\wgkqqa.exe
D:\swtc.exe
C:\17mt.ico
%WINDIR%\reg.reg
%WINDIR%\17mt.bat

Sets the 'hidden' attribute to the following files

%ProgramFiles(x86)%\wgkqqa.exe

Moves the following files

from <Current directory>\1.exe to %WINDIR%\syswow64\1363355.bak

Modifies the following files

Network activity

Connects to

'ly######7.e1.luyouxia.net':29091
'hi.##idu.com':80
'in####ow.baidu.com':443

TCP

HTTP GET requests

http://hi.##idu.com/17mt

Other

'hi.##idu.com':443

UDP

DNS ASK ly######7.e1.luyouxia.net
DNS ASK hi.##idu.com
DNS ASK in####ow.baidu.com
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Microsoft Internet Explorer'
ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Static' WindowName: ''

Creates and executes the following

'<Current directory>\1.exe'
'%ProgramFiles(x86)%\wgkqqa.exe'
'%ProgramFiles(x86)%\wgkqqa.exe' Win7
'D:\swtc.exe'
'%WINDIR%\syswow64\cmd.exe' /c del /f /s /q c:\bootfont.bin' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /f /s /q c:\boot.ini' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /f /s /q c:\ntldr' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /f /s /q c:\CONFIG.SYS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r %WINDIR%\explorer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r %WINDIR%\explorer' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r C:\NTDETECT.COM' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r c:\CONFIG.SYS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /f /s /q c:\NTDETECT.COM' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r C:\bootfont.bin' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r C:\ntldr' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im Mcshield.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im VsTskMgr.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im Rav.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im kavsvc.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im Ravmon.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im KVXP.kxp' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r C:\boot.ini' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del /f /q %WINDIR%\*.*' (with hidden window)