Exploit.Siggen3.34849

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office14\clview.exe' "EXCEL" "Microsoft Excel"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.lck
%TEMP%\imt4361.tmp
%TEMP%\imt4321.tmp
%TEMP%\imt42a3.tmp
%TEMP%\imt41e7.tmp
%TEMP%\imt415a.tmp
%TEMP%\imt4159.tmp
%TEMP%\imt4139.tmp
%TEMP%\imt4138.tmp
%TEMP%\imt4127.tmp
%TEMP%\imt4126.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imt4381.tmp
%TEMP%\imt4115.tmp
%TEMP%\imt40f4.tmp
%TEMP%\imt4096.tmp
%TEMP%\imt4075.tmp
%TEMP%\imt4046.tmp
%TEMP%\imt4035.tmp
%TEMP%\imt4024.tmp
%TEMP%\imt4023.tmp
%TEMP%\imt3ff4.tmp
%TEMP%\imt3ff3.tmp
%TEMP%\imt3fe2.tmp
%TEMP%\imt3fe1.tmp
%TEMP%\imt40f5.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imt4391.tmp
%TEMP%\imt43a2.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070820220709\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10384307[1].htm
%TEMP%\imt46a4.tmp
%TEMP%\imt46a3.tmp
%TEMP%\imt4644.tmp
%TEMP%\imt4643.tmp
%TEMP%\imt4633.tmp
%TEMP%\imt4632.tmp
%TEMP%\imt4631.tmp
%TEMP%\imt4610.tmp
%TEMP%\imt45b2.tmp
%TEMP%\imt45b1.tmp
%TEMP%\imt4562.tmp
%TEMP%\imt4513.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imt44c4.tmp
%TEMP%\imt44a4.tmp
%TEMP%\imt4483.tmp
%TEMP%\imt4454.tmp
%TEMP%\imt4443.tmp
%TEMP%\imt4432.tmp
%TEMP%\imt4431.tmp
%TEMP%\imt43b4.tmp
%TEMP%\imt43b3.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%TEMP%\imt3fc1.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\moh1b4f.tmp\clientviewersettings.xml
%TEMP%\imt18f3.tmp
%TEMP%\imt18a4.tmp
%TEMP%\imt1864.tmp
%TEMP%\imt1825.tmp
%TEMP%\imt17a7.tmp
%TEMP%\imt17a6.tmp
%TEMP%\imt17a5.tmp
%TEMP%\imt1795.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%TEMP%\imt1784.tmp
%TEMP%\imt1764.tmp
%TEMP%\imt1923.tmp
%TEMP%\imt1753.tmp
%TEMP%\imt1722.tmp
%TEMP%\imt1712.tmp
%TEMP%\imt1701.tmp
%TEMP%\imt16f1.tmp
%TEMP%\imt16f0.tmp
%TEMP%\imt16cf.tmp
%TEMP%\imt16ce.tmp
%TEMP%\imt16be.tmp
%TEMP%\imt16bd.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%TEMP%\imt169d.tmp
%TEMP%\imt1733.tmp
%TEMP%\imt1943.tmp
%TEMP%\imt1963.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imt1b2f.tmp
%TEMP%\imt1b1e.tmp
%TEMP%\imt1aee.tmp
%TEMP%\imt1aed.tmp
%TEMP%\imt1add.tmp
%TEMP%\imt1adc.tmp
%TEMP%\imt1adb.tmp
%TEMP%\imt1aca.tmp
%TEMP%\imt1a8b.tmp
%TEMP%\imt1a8a.tmp
%TEMP%\imt1a79.tmp
%TEMP%\imt1a69.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%TEMP%\imt1a58.tmp
%TEMP%\imt1a47.tmp
%TEMP%\imt1a27.tmp
%TEMP%\imt1a07.tmp
%TEMP%\imt19f6.tmp
%TEMP%\imt19e6.tmp
%TEMP%\imt19c6.tmp
%TEMP%\imt1986.tmp
%TEMP%\imt1985.tmp
%TEMP%\imt1984.tmp
%TEMP%\imt1964.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.lck
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd

Другое

Ищет следующие окна