Exploit.Siggen3.36544

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office14\clview.exe' "WINWORD" "Microsoft Word"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.lck
%TEMP%\imtc607.tmp
%TEMP%\imtc5c8.tmp
%TEMP%\imtc569.tmp
%TEMP%\imtc3a4.tmp
%TEMP%\imtc2f7.tmp
%TEMP%\imtc2e7.tmp
%TEMP%\imtc288.tmp
%TEMP%\imtc287.tmp
%TEMP%\imtc276.tmp
%TEMP%\imtc266.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imtc647.tmp
%TEMP%\imtc246.tmp
%TEMP%\imtc215.tmp
%TEMP%\imtc178.tmp
%TEMP%\imtc138.tmp
%TEMP%\imtc0f9.tmp
%TEMP%\imtc0d9.tmp
%TEMP%\imtc0c8.tmp
%TEMP%\imtc0b8.tmp
%TEMP%\imtc069.tmp
%TEMP%\imtc058.tmp
%TEMP%\imtc057.tmp
%TEMP%\imtc037.tmp
%TEMP%\imtc225.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imtc667.tmp
%TEMP%\imtc687.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022081420220815\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10383930[1].htm
%TEMP%\imtc89f.tmp
%TEMP%\imtc88e.tmp
%TEMP%\imtc810.tmp
%TEMP%\imtc80f.tmp
%TEMP%\imtc7ff.tmp
%TEMP%\imtc7fe.tmp
%TEMP%\imtc7fd.tmp
%TEMP%\imtc7ec.tmp
%TEMP%\imtc7cc.tmp
%TEMP%\imtc7cb.tmp
%TEMP%\imtc7ba.tmp
%TEMP%\imtc7b9.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imtc799.tmp
%TEMP%\imtc779.tmp
%TEMP%\imtc768.tmp
%TEMP%\imtc758.tmp
%TEMP%\imtc747.tmp
%TEMP%\imtc727.tmp
%TEMP%\imtc726.tmp
%TEMP%\imtc6a8.tmp
%TEMP%\imtc6a7.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mtoc_winword.dev_col.hxh
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%TEMP%\imtc007.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\mohba1d.tmp\clientviewersettings.xml
%TEMP%\imtb4b5.tmp
%TEMP%\imtb427.tmp
%TEMP%\imtb3c9.tmp
%TEMP%\imtb35a.tmp
%TEMP%\imtb2fc.tmp
%TEMP%\imtb2fb.tmp
%TEMP%\imtb2bb.tmp
%TEMP%\imtb28c.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_f.hxw
%TEMP%\imtb26b.tmp
%TEMP%\imtb23c.tmp
%TEMP%\imtb4f4.tmp
%TEMP%\imtb21b.tmp
%TEMP%\imtb1cb.tmp
%TEMP%\imtb1bb.tmp
%TEMP%\imtb19b.tmp
%TEMP%\imtb18a.tmp
%TEMP%\imtb15a.tmp
%TEMP%\imtb11b.tmp
%TEMP%\imtb11a.tmp
%TEMP%\imtb0bb.tmp
%TEMP%\imtb09b.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mtoc_winword_col.hxh
%TEMP%\imtaffe.tmp
%TEMP%\imtb1dc.tmp
%TEMP%\imtb514.tmp
%TEMP%\imtb544.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_k.hxw
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imtb9be.tmp
%TEMP%\imtb98e.tmp
%TEMP%\imtb901.tmp
%TEMP%\imtb900.tmp
%TEMP%\imtb8ef.tmp
%TEMP%\imtb8ee.tmp
%TEMP%\imtb8ed.tmp
%TEMP%\imtb8be.tmp
%TEMP%\imtb84f.tmp
%TEMP%\imtb84e.tmp
%TEMP%\imtb83e.tmp
%TEMP%\imtb80e.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.hxd
%TEMP%\imtb7af.tmp
%TEMP%\imtb751.tmp
%TEMP%\imtb721.tmp
%TEMP%\imtb6c2.tmp
%TEMP%\imtb6a2.tmp
%TEMP%\imtb653.tmp
%TEMP%\imtb623.tmp
%TEMP%\imtb5a6.tmp
%TEMP%\imtb5a5.tmp
%TEMP%\imtb575.tmp
%TEMP%\imtb564.tmp
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.lck
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mtoc_winword_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mtoc_winword.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033_1033_mvalidator.hxd

Сетевая активность

Подключается к

'a.##mf.cat':443
'x1.#.lencr.org':80
'r3.#.lencr.org':80

TCP

Запросы HTTP GET

http://x1.#.lencr.org/
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgO8gCBDzmn%2B1i3Iu%2Ba%2FIeKLnQ%3D%3D

Другие