Exploit.Siggen3.16264

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'ImagePath' = '<SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"'

Creates the following services

'MsRkNrL' <SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"

Malicious functions

Creates and executes the following (exploit)

'<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"

Modifies file system

Creates the following files

%TEMP%\dm6331.tmp
%WINDIR%\temp\radde710.tmp
%WINDIR%\temp\rad753a3.tmp
%WINDIR%\temp\rad94aee.tmp
%WINDIR%\temp\radca3fc.tmp
%WINDIR%\temp\rad452ac.tmp
%WINDIR%\temp\rad0980f.tmp
%WINDIR%\temp\rad99612.tmp
%WINDIR%\temp\radf03e0.tmp
%WINDIR%\temp\rad0334d.tmp
%WINDIR%\temp\rad3b94e.tmp
%WINDIR%\temp\rada9bef.tmp
%WINDIR%\temp\rad452de.tmp
%WINDIR%\temp\rad92111.tmp
%WINDIR%\temp\rad5306e.tmp
%WINDIR%\temp\rad3946d.tmp
%WINDIR%\temp\rada77ae.tmp
%WINDIR%\temp\rad6fed0.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[1].php
%WINDIR%\temp\rad91efc.tmp
%WINDIR%\temp\rad3dd53.tmp
%WINDIR%\temp\radf44e2.tmp
%WINDIR%\temp\rad74ef2.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
%WINDIR%\temp\rad01511.tmp
%WINDIR%\temp\radd2f82.tmp
%WINDIR%\temp\rade0f92.tmp
%TEMP%\rknrl.vbs
%WINDIR%\temp\dm6331.tmp
%WINDIR%\temp\winstart.vbs
%TEMP%\winstart.vbs
%WINDIR%\temp\rknrl.vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[2]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[2]
%TEMP%\radf3352.tmp
%TEMP%\rad20edc.tmp
%TEMP%\rad65093.tmp
%TEMP%\rad6846f.tmp
%TEMP%\rad14fb1.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\url[1].htm
%WINDIR%\temp\rad15e7f.tmp
%WINDIR%\temp\rad20b51.tmp
%WINDIR%\temp\rad557bc.tmp
%WINDIR%\temp\rada9dee.tmp
%WINDIR%\temp\rad25753.tmp
%WINDIR%\temp\rad832a2.tmp
%WINDIR%\temp\rad1f7bc.tmp
%WINDIR%\temp\rade78b3.tmp
%WINDIR%\temp\rad157a0.tmp
%WINDIR%\temp\rad2cee0.tmp
%WINDIR%\temp\radd9471.tmp
%WINDIR%\temp\rad33140.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
%WINDIR%\temp\rad40cae.tmp
%WINDIR%\temp\radbeb4f.tmp
%WINDIR%\temp\rad881b3.tmp
%WINDIR%\temp\rad0a9f1.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[2].vbs

Deletes the following files

<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\url[1].htm
%WINDIR%\temp\dm6332.tmp
%TEMP%\dm6332.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[2]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[2]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[2].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[1].tmp

Moves the following files

from %TEMP%\radf3352.tmp to %TEMP%\dm6332.tmp
from %WINDIR%\temp\rad15e7f.tmp to %WINDIR%\temp\dm6332.tmp

Substitutes the following files

<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
%TEMP%\dm6332.tmp
%WINDIR%\temp\dm6332.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs

Network activity

Connects to

'ap#.##herscan.io':80
'ai########ill.aigoingtokill.club':80

TCP

HTTP GET requests

http://ap#.##herscan.io/api?mo#############################################################################
http://ai########ill.aigoingtokill.club/ctrl/file/DM6331.TMP
http://ai########ill.aigoingtokill.club/ctrl/file/rknrl.vbs

UDP

DNS ASK ap#.##herscan.io
DNS ASK ai########ill.aigoingtokill.club

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' //B "%WINDIR%\TEMP\rknrl.vbs"
'<SYSTEM32>\wscript.exe' //B "%WINDIR%\TEMP\winstart.vbs"
'<SYSTEM32>\wscript.exe' //B "%TEMP%\winstart.vbs"
'<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial