Exploit.Siggen3.15301

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office14\clview.exe' "EXCEL" "Microsoft Excel"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.lck
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imt7a0b.tmp
%TEMP%\imt79eb.tmp
%TEMP%\imt79da.tmp
%TEMP%\imt799b.tmp
%TEMP%\imt77e5.tmp
%TEMP%\imt7786.tmp
%TEMP%\imt7766.tmp
%TEMP%\imt7707.tmp
%TEMP%\imt7706.tmp
%TEMP%\imt76f6.tmp
%TEMP%\imt76f5.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imt76e4.tmp
%TEMP%\imt76c4.tmp
%TEMP%\imt7675.tmp
%TEMP%\imt7636.tmp
%TEMP%\imt7625.tmp
%TEMP%\imt75f5.tmp
%TEMP%\imt75f4.tmp
%TEMP%\imt75e4.tmp
%TEMP%\imt75d3.tmp
%TEMP%\imt75c2.tmp
%TEMP%\imt75c1.tmp
%TEMP%\imt75b1.tmp
%TEMP%\imt7a1b.tmp
%TEMP%\imt7a2d.tmp
<Текущая директория>\18931000
%TEMP%\imt7a3e.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021031520210316\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10383759[1].htm
%TEMP%\imt7b69.tmp
%TEMP%\imt7b59.tmp
%TEMP%\imt7b39.tmp
%TEMP%\imt7b38.tmp
%TEMP%\imt7b27.tmp
%TEMP%\imt7b26.tmp
%TEMP%\imt7b25.tmp
%TEMP%\imt7b14.tmp
%TEMP%\imt7af4.tmp
%TEMP%\imt7af3.tmp
%TEMP%\imt7ae3.tmp
%TEMP%\imt7ac2.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imt7ab2.tmp
%TEMP%\imt7a92.tmp
%TEMP%\imt7a91.tmp
%TEMP%\imt7a70.tmp
%TEMP%\imt7a6f.tmp
%TEMP%\imt7a5f.tmp
%TEMP%\imt7a5e.tmp
%TEMP%\imt75b0.tmp
%TEMP%\imt7a2c.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%TEMP%\imt6fdb.tmp
%TEMP%\imt6fab.tmp
%TEMP%\imt6f9a.tmp
%TEMP%\imt6f6a.tmp
%TEMP%\imt6f5a.tmp
%TEMP%\imt6f39.tmp
%TEMP%\imt6edb.tmp
%TEMP%\imt6eda.tmp
%TEMP%\imt6eaa.tmp
%TEMP%\imt6e99.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%TEMP%\imt6e89.tmp
%TEMP%\imt6e78.tmp
%TEMP%\imt6e68.tmp
%TEMP%\imt6e38.tmp
%TEMP%\imt6e27.tmp
%TEMP%\imt6e17.tmp
%TEMP%\imt6e16.tmp
%TEMP%\imt6e05.tmp
%TEMP%\imt6df4.tmp
%TEMP%\imt6de4.tmp
%TEMP%\imt6de3.tmp
%TEMP%\imt6dd2.tmp
%TEMP%\imt6dc2.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%TEMP%\imt6db1.tmp
%TEMP%\imt6fbb.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.lck
%TEMP%\imt6fec.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\moh7199.tmp\clientviewersettings.xml
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imt7159.tmp
%TEMP%\imt7158.tmp
%TEMP%\imt7109.tmp
%TEMP%\imt7108.tmp
%TEMP%\imt7107.tmp
%TEMP%\imt70f7.tmp
%TEMP%\imt70f6.tmp
%TEMP%\imt70e5.tmp
%TEMP%\imt70a6.tmp
%TEMP%\imt70a5.tmp
%TEMP%\imt7094.tmp
%TEMP%\imt7093.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%TEMP%\imt7082.tmp
%TEMP%\imt7053.tmp
%TEMP%\imt7052.tmp
%TEMP%\imt7041.tmp
%TEMP%\imt7030.tmp
%TEMP%\imt702f.tmp
%TEMP%\imt701f.tmp
%TEMP%\imt6fff.tmp
%TEMP%\imt6ffe.tmp
%TEMP%\imt6fed.tmp
%TEMP%\imt759f.tmp
%APPDATA%\microsoft\excel\09931000

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd

Удаляет следующие файлы