Trojan.Siggen22.18924

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\systeye

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\reg_booster_pro.exe
%ProgramFiles(x86)%\systeye\reg booster pro\es\is-ksp8h.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\fr\is-5av79.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\ja\is-lissc.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg booster pro\reg booster pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg booster pro\reg booster pro on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg booster pro\uninstall reg booster pro.lnk
C:\users\public\desktop\reg booster pro.lnk
%ProgramFiles(x86)%\systeye\reg booster pro\unins000.dat
%TEMP%\etilqs_8a07oplm2yluo8j
%TEMP%\etilqs_5diz2pl0frwch4b
%TEMP%\dfb1.tmp
%TEMP%\etilqs_xjr6vhfn5hqejba
%TEMP%\etilqs_2ige6alckxgrwzd
%TEMP%\etilqs_yv8nkjtwwzrqi8y
%TEMP%\etilqs_kknmexw3lqgph7x
%TEMP%\etilqs_gwb4qllygfq0ii4
%TEMP%\etilqs_pbxygz75aecdnoc
%ProgramFiles(x86)%\systeye\reg booster pro\sys_auth.xml
%TEMP%\etilqs_f7ylxiuucpkjrkn
%TEMP%\dfb0.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\en\is-9h8cd.tmp
%TEMP%\etilqs_gsr255oaf9dqzo6
%ProgramFiles(x86)%\systeye\reg booster pro\de\is-b95cl.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-8soh9.tmp
%TEMP%\is-tqj47.tmp\reg_booster_pro.tmp
%TEMP%\is-vscks.tmp\_isetup\_setup64.tmp
%TEMP%\is-vscks.tmp\_isetup\_shfoldr.dll
%ProgramFiles(x86)%\systeye\reg booster pro\is-7pl6j.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-a140d.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-jpa7n.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-3uubf.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-q1jqi.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-jjrja.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-qnvid.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-pkuc9.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-esqg6.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-e4vue.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-qut3t.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-hs0md.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-jmj77.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-24r0g.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-981p8.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-56ao8.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\is-9g33c.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\bull\waves\is-mamf5.tmp
%ProgramFiles(x86)%\systeye\reg booster pro\log.xml

Deletes the following files

%TEMP%\is-vscks.tmp\_isetup\_setup64.tmp
%TEMP%\is-vscks.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tqj47.tmp\reg_booster_pro.tmp
%TEMP%\7zipsfx.000\reg_booster_pro.exe
%TEMP%\dfb0.tmp
%TEMP%\dfb1.tmp

Moves the following files

from %ProgramFiles(x86)%\systeye\reg booster pro\is-7pl6j.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\unins000.exe
from %ProgramFiles(x86)%\systeye\reg booster pro\es\is-ksp8h.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\es\regprocleaner.resources.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\en\is-9h8cd.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\en\regprocleaner.resources.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\de\is-b95cl.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\de\regprocleaner.resources.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\bull\waves\is-mamf5.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\bull\waves\issues.wav
from %ProgramFiles(x86)%\systeye\reg booster pro\is-pkuc9.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\wpfanimatedgif.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\is-9g33c.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\vtregscan.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\is-56ao8.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\trialerror.xml
from %ProgramFiles(x86)%\systeye\reg booster pro\is-981p8.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\sys_auth.xml
from %ProgramFiles(x86)%\systeye\reg booster pro\is-24r0g.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.vshost.exe.manifest
from %ProgramFiles(x86)%\systeye\reg booster pro\is-jmj77.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.vshost.exe.config
from %ProgramFiles(x86)%\systeye\reg booster pro\is-hs0md.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.vshost.exe
from %ProgramFiles(x86)%\systeye\reg booster pro\is-qut3t.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.pdb
from %ProgramFiles(x86)%\systeye\reg booster pro\is-e4vue.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.exe.config
from %ProgramFiles(x86)%\systeye\reg booster pro\is-esqg6.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.exe
from %ProgramFiles(x86)%\systeye\reg booster pro\is-qnvid.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\microsoft.win32.taskscheduler.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\is-8soh9.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\log.xml
from %ProgramFiles(x86)%\systeye\reg booster pro\is-jjrja.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\log.txt
from %ProgramFiles(x86)%\systeye\reg booster pro\is-q1jqi.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\extendedwindowscontrols.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\is-3uubf.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\errordetails.xml
from %ProgramFiles(x86)%\systeye\reg booster pro\is-jpa7n.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\error.xml
from %ProgramFiles(x86)%\systeye\reg booster pro\is-a140d.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\icon.ico
from %ProgramFiles(x86)%\systeye\reg booster pro\fr\is-5av79.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\fr\regprocleaner.resources.dll
from %ProgramFiles(x86)%\systeye\reg booster pro\ja\is-lissc.tmp to %ProgramFiles(x86)%\systeye\reg booster pro\ja\regprocleaner.resources.dll

Network activity

Connects to

'google.com':80
'tw##ter.com':80
'bo##ing.com':80
'nl.##hoo.com':80
'ro###.ebay.com':443
'ro###.ebay.com':80
'do#####d3.operacdn.com':443
'sd#####es.operacdn.com':443
'sy##eye.com':80
'ya###.opera.com':80
'fa###ook.com':443
'bo##ing.com':443
'fa###ook.com':80
're###.opera.com':80
'en.###ipedia.org':80
'au######te.geo.opera.com':443
'am##on.com':443
'se####.yahoo.com':443
'au######te.geo.opera.com':80
'bing.com':80
'du###uckgo.com':443
'am##on.com':80
'se####.yahoo.com':80
'si#####ck2.opera.com':80
'tw##ter.com':443

TCP

HTTP GET requests

http://www.google.com/favicon.ico
http://nl.##hoo.com/?il#####
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://www.am##on.com/?ta#########################
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://ya###.opera.com/favicon.ico
http://re###.opera.com/favicon.ico
http://www.fa###ook.com/
http://re###.opera.com/speeddials/partner/facebook
http://si#####ck2.opera.com/?ho###################################################
http://re###.opera.com/www.opera.com/firstrun/
http://au######te.geo.opera.com/geolocation/
http://www.bing.com/s/a/bing_p.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.bo##ing.com/index.html?ai##########################################################################################
http://www.tw##ter.com/?pa################

Other

'du###uckgo.com':443
'se####.yahoo.com':443
'am##on.com':443
'au######te.geo.opera.com':443
'fa###ook.com':443
'ya###.opera.com':443
'sd#####es.operacdn.com':443
'do#####d3.operacdn.com':443
'op##a.com':443
'ro###.ebay.com':443
'ya##o.com':443
'bo##ing.com':443
'tw##ter.com':443

UDP

DNS ASK google.com
DNS ASK ya##o.com
DNS ASK nl.##hoo.com
DNS ASK ro###.ebay.com
DNS ASK do#####d3.operacdn.com
DNS ASK sd#####es.operacdn.com
DNS ASK sy##eye.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK bo##ing.com
DNS ASK fa###ook.com
DNS ASK re###.opera.com
DNS ASK en.###ipedia.org
DNS ASK au######te.geo.opera.com
DNS ASK bi##.#ikimedia.org
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK si#####ck2.opera.com
DNS ASK tw##ter.com

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\7zipsfx.000\reg_booster_pro.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-tqj47.tmp\reg_booster_pro.tmp' /SL5="$C018A,2494830,208896,%TEMP%\7ZipSfx.000\Reg_Booster_Pro.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles(x86)%\systeye\reg booster pro\regprocleaner.exe' /Passive /NORESTART

Executes the following

'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.systeye.com/installed.aspx?p=regboosterpro"
'%WINDIR%\syswow64\cscript.exe' "%ProgramFiles(x86)%\Systeye\Reg Booster Pro\"PinItem.vbs /taskbar /item:"%ProgramFiles(x86)%\Systeye\Reg Booster Pro\RegProCleaner.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.12.1488794782\2078246417" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.11.2055245061\957780328" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.10.1146354188\1699901932" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.9.1822643145\1892322437" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.8.1269398671\1793240313" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="3032.4.1915491417\618158668" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2664
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.15.612587601\622103221" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.7.1056793809\1134992831" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.5.1776569064\35190218" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.4.1915491417\618158668" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="3032.0.857018404\1433485880" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.systeye.com/installed.aspx?p=regboosterpro /crash-reporter-parent-id=3032
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.systeye.com/installed.aspx?p=regboosterpro
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.6.1883629135\741654769" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3032.16.877516478\1407082449" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial