Exploit.Siggen3.37293

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office14\clview.exe' "EXCEL" "Microsoft Excel"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.lck
%TEMP%\imt4f81.tmp
%TEMP%\imt4f80.tmp
%TEMP%\imt4f6f.tmp
%TEMP%\imt4f20.tmp
%TEMP%\imt4ed1.tmp
%TEMP%\imt4ec1.tmp
%TEMP%\imt4ea1.tmp
%TEMP%\imt4ea0.tmp
%TEMP%\imt4e9f.tmp
%TEMP%\imt4e8e.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imt4fa1.tmp
%TEMP%\imt4e8d.tmp
%TEMP%\imt4e5c.tmp
%TEMP%\imt4e4c.tmp
%TEMP%\imt4e3b.tmp
%TEMP%\imt4e0b.tmp
%TEMP%\imt4deb.tmp
%TEMP%\imt4dda.tmp
%TEMP%\imt4dca.tmp
%TEMP%\imt4d8a.tmp
%TEMP%\imt4d89.tmp
%TEMP%\imt4d69.tmp
%TEMP%\imt4d68.tmp
%TEMP%\imt4e6d.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imt4fb2.tmp
%TEMP%\imt4fb3.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022092320220924\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10383759[1].htm
%TEMP%\imt50d1.tmp
%TEMP%\imt50c0.tmp
%TEMP%\imt50a0.tmp
%TEMP%\imt5090.tmp
%TEMP%\imt508f.tmp
%TEMP%\imt508e.tmp
%TEMP%\imt508d.tmp
%TEMP%\imt507c.tmp
%TEMP%\imt505c.tmp
%TEMP%\imt505b.tmp
%TEMP%\imt505a.tmp
%TEMP%\imt5059.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imt5048.tmp
%TEMP%\imt5028.tmp
%TEMP%\imt5017.tmp
%TEMP%\imt4ff7.tmp
%TEMP%\imt4ff6.tmp
%TEMP%\imt4fe6.tmp
%TEMP%\imt4fd5.tmp
%TEMP%\imt4fc4.tmp
%TEMP%\imt4fb4.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%TEMP%\imt4d58.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\moh4961.tmp\clientviewersettings.xml
%TEMP%\imt4743.tmp
%TEMP%\imt4732.tmp
%TEMP%\imt4712.tmp
%TEMP%\imt46f2.tmp
%TEMP%\imt46b2.tmp
%TEMP%\imt46b1.tmp
%TEMP%\imt46a1.tmp
%TEMP%\imt4690.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%TEMP%\imt4670.tmp
%TEMP%\imt465f.tmp
%TEMP%\imt4773.tmp
%TEMP%\imt464f.tmp
%TEMP%\imt45ff.tmp
%TEMP%\imt45ee.tmp
%TEMP%\imt45ce.tmp
%TEMP%\imt45bd.tmp
%TEMP%\imt459d.tmp
%TEMP%\imt452f.tmp
%TEMP%\imt452e.tmp
%TEMP%\imt450e.tmp
%TEMP%\imt44ee.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%TEMP%\imt44cd.tmp
%TEMP%\imt460f.tmp
%TEMP%\imt4783.tmp
%TEMP%\imt47a3.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imt4931.tmp
%TEMP%\imt4930.tmp
%TEMP%\imt4900.tmp
%TEMP%\imt48ff.tmp
%TEMP%\imt48fe.tmp
%TEMP%\imt48fd.tmp
%TEMP%\imt48fc.tmp
%TEMP%\imt48eb.tmp
%TEMP%\imt48cb.tmp
%TEMP%\imt48ca.tmp
%TEMP%\imt48ba.tmp
%TEMP%\imt48a9.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%TEMP%\imt48a8.tmp
%TEMP%\imt4878.tmp
%TEMP%\imt4848.tmp
%TEMP%\imt4819.tmp
%TEMP%\imt4808.tmp
%TEMP%\imt47f7.tmp
%TEMP%\imt47e7.tmp
%TEMP%\imt47b7.tmp
%TEMP%\imt47b6.tmp
%TEMP%\imt47b5.tmp
%TEMP%\imt47a4.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.lck
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd

Другое

Ищет следующие окна