Trojan.Siggen31.29049

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im "RegOrganizer.exe"

Modifies file system

Creates the following files

%TEMP%\rarsfx0\32.exe
%ProgramFiles%\reg organizer\is-1l2sb.tmp
%ProgramFiles%\reg organizer\shell\is-uutq7.tmp
%ProgramFiles%\reg organizer\shell\is-h2m9p.tmp
%ProgramFiles%\reg organizer\shell\is-pkhqq.tmp
%ProgramFiles%\reg organizer\languages\is-2k908.tmp
%ProgramFiles%\reg organizer\is-8b8co.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\reg organizer.lnk
C:\users\public\desktop\reg organizer.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\uninstall reg organizer.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\reg organizer\user's manual.lnk
%ProgramFiles%\reg organizer\unins000.dat
%TEMP%\etilqs_cm2f3x6qspxb1bn
%ALLUSERSPROFILE%\chemtable software\shared\startupcheckingservice.log
%ProgramFiles%\reg organizer\version.dll
%TEMP%\etilqs_sgcrpg7fvuqqbth
%TEMP%\etilqs_hvlsux26dbd7qbu
%TEMP%\etilqs_dmwbpm8hvb153bw
%TEMP%\etilqs_kunowdzbclofycn
%TEMP%\etilqs_hbtykrjqnbhvhun
%TEMP%\etilqs_vfdrdmxxemvgfqf
%TEMP%\etilqs_tejcrag7wyn6ofa
%TEMP%\etilqs_sl80rmuekcp0z3f
%ProgramFiles%\reg organizer\is-45847.tmp
%ProgramFiles%\reg organizer\unins000.msg
%ProgramFiles%\reg organizer\is-939ml.tmp
%ProgramFiles%\reg organizer\is-ienml.tmp
%TEMP%\rarsfx0\32or64.cmd
%TEMP%\rarsfx0\64.exe
%TEMP%\rarsfx0\absba.url
%TEMP%\rarsfx0\reg-organizer-setup.exe
%TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp
%TEMP%\is-04t2u.tmp\_isetup\_setup64.tmp
%TEMP%\is-04t2u.tmp\closeapplication.dll
%ProgramFiles%\reg organizer\is-lhog4.tmp
%LOCALAPPDATA%\chemtable software\reg organizer\is-l8i0b.tmp
%ProgramFiles%\reg organizer\is-u1bom.tmp
%ProgramFiles%\reg organizer\is-mkj1l.tmp
%ProgramFiles%\reg organizer\is-g0d1j.tmp
%ProgramFiles%\reg organizer\is-au22t.tmp
%ProgramFiles%\reg organizer\is-1sksf.tmp
%ProgramFiles%\reg organizer\is-qt0sf.tmp
%ProgramFiles%\reg organizer\is-9catr.tmp
%ProgramFiles%\reg organizer\is-c5bav.tmp
%ProgramFiles%\reg organizer\is-mesbq.tmp
%ProgramFiles%\reg organizer\documentation\english\is-q44c7.tmp
%ProgramFiles%\reg organizer\documentation\russian\is-geirh.tmp
%ProgramFiles%\reg organizer\is-rp3aa.tmp
%ProgramFiles%\reg organizer\is-d75vf.tmp
%ProgramFiles%\reg organizer\is-dsp5d.tmp
%TEMP%\etilqs_8hqu2pfpwusfafr

Deletes the following files

%TEMP%\is-04t2u.tmp\closeapplication.dll
%TEMP%\is-04t2u.tmp\_isetup\_setup64.tmp
%TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp

Moves the following files

from %ProgramFiles%\reg organizer\is-lhog4.tmp to %ProgramFiles%\reg organizer\unins000.exe
from %ProgramFiles%\reg organizer\shell\is-pkhqq.tmp to %ProgramFiles%\reg organizer\shell\shellcontextmenu_4.dll
from %ProgramFiles%\reg organizer\shell\is-h2m9p.tmp to %ProgramFiles%\reg organizer\shell\shellcontextmenuinstallerro.msix
from %ProgramFiles%\reg organizer\shell\is-uutq7.tmp to %ProgramFiles%\reg organizer\shell\shellcontextmenuinstaller.exe
from %ProgramFiles%\reg organizer\is-1l2sb.tmp to %ProgramFiles%\reg organizer\winrtapps.dll
from %ProgramFiles%\reg organizer\is-45847.tmp to %ProgramFiles%\reg organizer\startupcheckingservice.exe
from %ProgramFiles%\reg organizer\is-939ml.tmp to %ProgramFiles%\reg organizer\sciter.dll
from %ProgramFiles%\reg organizer\is-dsp5d.tmp to %ProgramFiles%\reg organizer\notifications.dll
from %ProgramFiles%\reg organizer\is-g0d1j.tmp to %ProgramFiles%\reg organizer\launcher.exe
from %ProgramFiles%\reg organizer\is-d75vf.tmp to %ProgramFiles%\reg organizer\hardwareconstant.dll
from %ProgramFiles%\reg organizer\is-rp3aa.tmp to %ProgramFiles%\reg organizer\regorganizer.exe
from %ProgramFiles%\reg organizer\languages\is-2k908.tmp to %ProgramFiles%\reg organizer\languages\russian.sib
from %ProgramFiles%\reg organizer\documentation\russian\is-geirh.tmp to %ProgramFiles%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles%\reg organizer\is-mesbq.tmp to %ProgramFiles%\reg organizer\tweaks.bkp.xml
from %ProgramFiles%\reg organizer\is-c5bav.tmp to %ProgramFiles%\reg organizer\tracesprofiles.bin
from %ProgramFiles%\reg organizer\is-9catr.tmp to %ProgramFiles%\reg organizer\ignoreregcleaner.bkp.xml
from %ProgramFiles%\reg organizer\is-qt0sf.tmp to %ProgramFiles%\reg organizer\cleanupignore.bkp.xml
from %ProgramFiles%\reg organizer\is-1sksf.tmp to %ProgramFiles%\reg organizer\appuninstignore.bkp.xml
from %ProgramFiles%\reg organizer\is-au22t.tmp to %ProgramFiles%\reg organizer\whatsnew.txt
from %ProgramFiles%\reg organizer\is-mkj1l.tmp to %ProgramFiles%\reg organizer\license.txt
from %ProgramFiles%\reg organizer\is-ienml.tmp to %ProgramFiles%\reg organizer\readme.txt
from %ProgramFiles%\reg organizer\is-u1bom.tmp to %ProgramFiles%\reg organizer\closeapplication.dll
from %LOCALAPPDATA%\chemtable software\reg organizer\is-l8i0b.tmp to %LOCALAPPDATA%\chemtable software\reg organizer\appscache.bin
from %ProgramFiles%\reg organizer\documentation\english\is-q44c7.tmp to %ProgramFiles%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles%\reg organizer\is-8b8co.tmp to %ProgramFiles%\reg organizer\links.xml

Network activity

Connects to

'au######te.geo.opera.com':80
'tw##ter.com':80
'ro###.ebay.com':443
'ro###.ebay.com':80
'x1.#.lencr.org':80
'sd#####es.operacdn.com':443
'fz###.ttk.ru':80
'fa###ook.com':80
'ya###.opera.com':80
'ch###able.com':443
'ab##a.cc':80
'si#####ck2.opera.com':443
'si#####ck2.opera.com':80
're###.opera.com':80
'en.###ipedia.org':443
'se####.yahoo.com':443
'en.###ipedia.org':80
'am##on.com':443
'bing.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'am##on.com':80
'google.com':80
'au######te.geo.opera.com':443
'bl#####st.rkn.gov.ru':80
'bl#####st.rkn.gov.ru':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.tw##ter.com/?pa################
http://www.ya##o.com/?il#####
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://x1.#.lencr.org/
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://re###.opera.com/favicon.ico
http://fz###.ttk.ru/favicon.ico
http://fz###.ttk.ru/fz139/?or####################################
http://fz###.ttk.ru/?or####################################
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/speeddials/partner/facebook
http://ya###.opera.com/favicon.ico
http://si#####ck2.opera.com/?ho################################################
http://si#####ck2.opera.com/?ho###################################################
http://re###.opera.com/www.opera.com/firstrun/
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.google.com/favicon.ico
http://bl#####st.rkn.gov.ru/
http://bl#####st.rkn.gov.ru/DDoS01/ba5f08b1/

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'si#####ck2.opera.com':443
'ch###able.com':443
'ya###.opera.com':443
'sd#####es.operacdn.com':443
'op##a.com':443
'ro###.ebay.com':443
'ya##o.com':443
'bl#####st.rkn.gov.ru':443

UDP

DNS ASK google.com
DNS ASK ya##o.com
DNS ASK ro###.ebay.com
DNS ASK x1.#.lencr.org
DNS ASK sd#####es.operacdn.com
DNS ASK fz###.ttk.ru
DNS ASK fa###ook.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK ch###able.com
DNS ASK ab##a.cc
DNS ASK re###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bi##.#ikimedia.org
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK tw##ter.com
DNS ASK bl#####st.rkn.gov.ru

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\rarsfx0\reg-organizer-setup.exe' /verysilent
'%TEMP%\is-ud1pu.tmp\reg-organizer-setup.tmp' /SL5="$1025A,25404699,832512,%TEMP%\RarSFX0\reg-organizer-setup.exe" /verysilent
'%ProgramFiles%\reg organizer\startupcheckingservice.exe' start
'%ProgramFiles%\reg organizer\regorganizer.exe'
'%TEMP%\rarsfx0\64.exe'

Executes the following

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Reg Organizer\Shell\ShellContextMenu_4.dll"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.8.409003452\1286715183" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.5.38725475\1222187861" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2748.4.1575820134\1936149520" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2860
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.6.80005962\611069453" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.7.656800506\1208333125" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.10.350412142\1593679460" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.9.3162766\642604384" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.4.1575820134\1936149520" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.11.1867282061\563942557" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.12.50661881\1226228378" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.absba.cc/ /crash-reporter-parent-id=1196
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.absba.cc/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1196.0.1846502252\650051415" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.16.2012107815\155826819" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2748.17.2088063210\669567035" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'<SYSTEM32>\schtasks.exe' /Delete /TN "RegOrganizerQuickLaunch" /F
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.absba.cc/
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" "
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2748.0.2081793105\1501500108" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
'<SYSTEM32>\reg.exe' add "HKCU\Software\ChemTable Software\Reg Organizer" /v "LicenseKeys" /t REG_SZ /d "AAGKN5-MA967U-5LZSKF-VFK29W-49J4WJ-8ARKUN-RQGJQ6-BSFPA7-EDPA" /f
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.chemtable.com/thank-you.htm?prod_id=RegOrganizer&ver=9.71 /crash-reporter-parent-id=2748
'<SYSTEM32>\taskkill.exe' /f /im "RegOrganizer.exe"' (with hidden window)
'%ProgramFiles%\reg organizer\startupcheckingservice.exe' start' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKCU\Software\ChemTable Software\Reg Organizer" /v "LicenseKeys" /t REG_SZ /d "AAGKN5-MA967U-5LZSKF-VFK29W-49J4WJ-8ARKUN-RQGJQ6-BSFPA7-EDPA" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" "' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Delete /TN "RegOrganizerQuickLaunch" /F' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial