Exploit.Siggen3.16612

Technical Information

Malicious functions

Creates and executes the following

'' (downloaded from the Internet)

Creates and executes the following (exploit)

'C:\users\public\69577.exe'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM cmd.exe /F

Injects code into

the following user processes:

69577.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\cmd.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\sdszfo.docx

Modifies file system

Creates the following files

C:\users\public\69577.exe
%WINDIR%\syswow64\r.bat

Network activity

Connects to

'bi#.ly':80
'na##1d.site':80
'na###050.com':8080

TCP

HTTP POST requests

http://na####50.com:8080/upld/CECBDBE9 via na###050.com

UDP

DNS ASK bi#.ly
DNS ASK na##1d.site
DNS ASK na###050.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.doc" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.tar" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.zip" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.rar" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.ppa" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.pps" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.pot" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.accdb" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.mdb" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.rtf" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.csv" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.xl" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.dot" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.ppt" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.pdf" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.7z" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "d:\*.doc" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.tar" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.zip" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.rar" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.ppa" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.pps" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.pot" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.accdb" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.mdb" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.rtf" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.csv" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.xl" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.dot" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.ppt" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.pdf" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /U /C DIR "\Users\user\*.7z" /S /B /A' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start /min r.bat' (with hidden window)