Exploit.Siggen3.50845

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM winword.exe

Executes the following (exploit)

'<SYSTEM32>\cmd.exe' /C CmD < "%TEMP%\ufFm.cMD"
'%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1436

Injects code into

the following user processes:

saver.scr

Searches for registry branches where third party applications store passwords

[HKCU\Software\LinasFTP\Site Manager]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKCU\Software\Ghisler\Total Commander]
[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKCU\Software\VanDyke\SecureFX]
[HKLM\Software\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\Software\NCH Software\Fling\Accounts]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\SimonTatham\PuTTY\Sessions]
[HKLM\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data

Modifies file system

Creates the following files

%TEMP%\uffm.cmd
%TEMP%\mt6nzqofd.cmd
%TEMP%\a.sct
%TEMP%\yoklmn.zip
%TEMP%\_.vbs
%TEMP%\gondi.doc
%TEMP%\666529.cvr
%TEMP%\saver.scr
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\1a9958\8d2b9c.lck

Deletes the following files

%TEMP%\666529.cvr
%TEMP%\_.vbs
%TEMP%\yoklmn.zip
%TEMP%\a.sct
%TEMP%\mt6nzqofd.cmd
%TEMP%\saver.scr
%TEMP%\gondi.doc
%APPDATA%\1a9958\8d2b9c.lck

Moves the following files

from %TEMP%\saver.scr to %APPDATA%\1a9958\8d2b9c.exe

Modifies the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814

Substitutes the following files

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814

Network activity

UDP

DNS ASK su####displays.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cscript.exe' //nologo "%TEMP%\_.vbs"
'%TEMP%\saver.scr'

Executes the following

'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency /f
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\Resiliency /f
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\Resiliency /f
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c dir /b /a-d /o-d
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\Resiliency /f
'<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\Resiliency /f
'<SYSTEM32>\timeout.exe' /T 1
'<SYSTEM32>\cmd.exe' /K mt6nzqofd.CMD
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\13.0\Word\Resiliency /f
'<SYSTEM32>\cmd.exe' /C CmD < "%TEMP%\ufFm.cMD"' (with hidden window)