Exploit.Siggen3.14420

Техническая информация

Вредоносные функции

Загружает и запускает на исполнение

$_ как $myfilename

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office14\clview.exe' "WINWORD" "Microsoft Word"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.lck
%TEMP%\imtb7e4.tmp
%TEMP%\imtb7e3.tmp
%TEMP%\imtb7d2.tmp
%TEMP%\imtb783.tmp
%TEMP%\imtb744.tmp
%TEMP%\imtb733.tmp
%TEMP%\imtb723.tmp
%TEMP%\imtb722.tmp
%TEMP%\imtb711.tmp
%TEMP%\imtb700.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imtb7f4.tmp
%TEMP%\imtb6ff.tmp
%TEMP%\imtb6de.tmp
%TEMP%\imtb6be.tmp
%TEMP%\imtb6ad.tmp
%TEMP%\imtb68d.tmp
%TEMP%\imtb67d.tmp
%TEMP%\imtb67c.tmp
%TEMP%\imtb66b.tmp
%TEMP%\imtb65a.tmp
%TEMP%\imtb659.tmp
%TEMP%\imtb649.tmp
%TEMP%\imtb648.tmp
%TEMP%\imtb6df.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imtb805.tmp
%TEMP%\imtb806.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021030120210302\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10384264[1].htm
%TEMP%\imtb8e6.tmp
%TEMP%\imtb8e5.tmp
%TEMP%\imtb8c5.tmp
%TEMP%\imtb8c4.tmp
%TEMP%\imtb8c3.tmp
%TEMP%\imtb8c2.tmp
%TEMP%\imtb8c1.tmp
%TEMP%\imtb8b0.tmp
%TEMP%\imtb89f.tmp
%TEMP%\imtb88f.tmp
%TEMP%\imtb88e.tmp
%TEMP%\imtb88d.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imtb84d.tmp
%TEMP%\imtb83d.tmp
%TEMP%\imtb83c.tmp
%TEMP%\imtb82b.tmp
%TEMP%\imtb82a.tmp
%TEMP%\imtb829.tmp
%TEMP%\imtb819.tmp
%TEMP%\imtb808.tmp
%TEMP%\imtb807.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mtoc_winword.dev_col.hxh
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%TEMP%\imtb637.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\mohb3f5.tmp\clientviewersettings.xml
%TEMP%\imtb2b2.tmp
%TEMP%\imtb2a1.tmp
%TEMP%\imtb290.tmp
%TEMP%\imtb28f.tmp
%TEMP%\imtb26f.tmp
%TEMP%\imtb26e.tmp
%TEMP%\imtb26d.tmp
%TEMP%\imtb25d.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_f.hxw
%TEMP%\imtb25c.tmp
%TEMP%\imtb23b.tmp
%TEMP%\imtb2c2.tmp
%TEMP%\imtb23a.tmp
%TEMP%\imtb219.tmp
%TEMP%\imtb209.tmp
%TEMP%\imtb1f8.tmp
%TEMP%\imtb1f7.tmp
%TEMP%\imtb1e6.tmp
%TEMP%\imtb1c6.tmp
%TEMP%\imtb1c5.tmp
%TEMP%\imtb1b5.tmp
%TEMP%\imtb1b4.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mtoc_winword_col.hxh
%TEMP%\imtb1a3.tmp
%TEMP%\imtb22a.tmp
%TEMP%\imtb2c3.tmp
%TEMP%\imtb2d4.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_k.hxw
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imtb3d5.tmp
%TEMP%\imtb3d4.tmp
%TEMP%\imtb3b4.tmp
%TEMP%\imtb3b3.tmp
%TEMP%\imtb3a2.tmp
%TEMP%\imtb3a1.tmp
%TEMP%\imtb3a0.tmp
%TEMP%\imtb39f.tmp
%TEMP%\imtb37f.tmp
%TEMP%\imtb37e.tmp
%TEMP%\imtb37d.tmp
%TEMP%\imtb36c.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.hxd
%TEMP%\imtb35c.tmp
%TEMP%\imtb34b.tmp
%TEMP%\imtb34a.tmp
%TEMP%\imtb339.tmp
%TEMP%\imtb329.tmp
%TEMP%\imtb328.tmp
%TEMP%\imtb317.tmp
%TEMP%\imtb2f7.tmp
%TEMP%\imtb2f6.tmp
%TEMP%\imtb2f5.tmp
%TEMP%\imtb2e4.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.lck
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mtoc_winword_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mtoc_winword.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.hxd

Удаляет следующие файлы