Exploit.Siggen3.3058

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'ImagePath' = '<SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"'

Creates the following services

'MsRkNrL' <SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"

Malicious functions

Creates and executes the following (exploit)

'<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im miner.exe
'<SYSTEM32>\taskkill.exe' /f /im myminer.exe
'<SYSTEM32>\taskkill.exe' /f /im myminera.exe
'<SYSTEM32>\taskkill.exe' /f /im myminern.exe

Modifies file system

Creates the following files

%TEMP%\dm6331.tmp
%WINDIR%\temp\rad1bd15.tmp
%WINDIR%\temp\rad0bd96.tmp
%WINDIR%\temp\radb3d3b.tmp
%WINDIR%\temp\radef0d3.tmp
%WINDIR%\temp\rada7b47.tmp
%WINDIR%\temp\rad643c4.tmp
%WINDIR%\temp\rad0ee9a.tmp
%WINDIR%\temp\radaa3f5.tmp
%WINDIR%\temp\rad5aaa3.tmp
%WINDIR%\temp\radfb919.tmp
%WINDIR%\temp\radbec34.tmp
%WINDIR%\temp\rad4c134.tmp
%WINDIR%\temp\rad76d66.tmp
%WINDIR%\temp\rad0da68.tmp
%WINDIR%\temp\rad6c56b.tmp
%WINDIR%\temp\radff768.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[2].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\rknrl[1].vbs
%WINDIR%\temp\rad5f067.tmp
%WINDIR%\temp\rad8fb7a.tmp
%WINDIR%\temp\rad65028.tmp
%WINDIR%\temp\rade9795.tmp
%WINDIR%\temp\radedcd8.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[2].vbs
%WINDIR%\temp\rad4d9ca.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\dm6331[1].tmp
%WINDIR%\temp\rad09ea8.tmp
%WINDIR%\temp\rade1474.tmp
%WINDIR%\temp\rad77f85.tmp
%WINDIR%\temp\radffae6.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
%TEMP%\rad93854.tmp
%TEMP%\rad891b8.tmp
%TEMP%\rad2c9f7.tmp
%TEMP%\rad420a9.tmp
%TEMP%\radb0205.tmp
%WINDIR%\temp\rknrl.vbs
%WINDIR%\temp\winstart.vbs
%TEMP%\winstart.vbs
%WINDIR%\temp\dm6331.tmp
%TEMP%\rknrl.vbs
%WINDIR%\temp\radfb194.tmp
%WINDIR%\temp\radd85b4.tmp
%WINDIR%\temp\radbebda.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[4].htm
%WINDIR%\temp\rad36284.tmp
%WINDIR%\temp\radaae86.tmp
%WINDIR%\temp\rad9d255.tmp
%WINDIR%\temp\radea9f5.tmp
%WINDIR%\temp\rad2f109.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[3].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[2].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
%WINDIR%\temp\radafeb2.tmp
%WINDIR%\temp\radd32d7.tmp
%WINDIR%\temp\rad528e9.tmp
%WINDIR%\temp\rad9b0e5.tmp
%WINDIR%\temp\raded005.tmp
%WINDIR%\temp\rade53b6.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[2].tmp

Deletes the following files

%TEMP%\dm6332.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\url[1].htm
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\api[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[2].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[2].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[2].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[4].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[3].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[2].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\url[1].htm
%WINDIR%\temp\dm6332.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[2].tmp

Moves the following files

from %TEMP%\radb0205.tmp to %TEMP%\dm6332.tmp
from %WINDIR%\temp\radffae6.tmp to %WINDIR%\temp\dm6332.tmp

Substitutes the following files

%TEMP%\dm6332.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\api[1]
%WINDIR%\temp\dm6332.tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\url[1].htm
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\api[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\dm6331[1].tmp
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\rknrl[1].vbs
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\rknrl[1].vbs

Network activity

TCP

HTTP GET requests

http://ap#.##herscan.io/api?mo#############################################################################
http://ai########ill.aigoingtokill.club/ctrl/url.html
http://ai########ill.aigoingtokill.club/ctrl/playback.php
http://ai########ill.aigoingtokill.club/ctrl/file/DM6331.TMP
http://ai########ill.aigoingtokill.club/ctrl/file/rknrl.vbs

UDP

DNS ASK ap#.##herscan.io
DNS ASK ai########ill.aigoingtokill.club

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' //B "%WINDIR%\TEMP\rknrl.vbs"
'<SYSTEM32>\wscript.exe' //B "%TEMP%\winstart.vbs"
'<SYSTEM32>\wscript.exe' //B "%WINDIR%\TEMP\winstart.vbs"
'<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /im miner.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /im myminer.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /im myminera.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /im myminern.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del winstart\miner.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\miner.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del winstart\myminer.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminer.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del winstart\myminera.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminera.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del winstart\myminern.exe /s /q' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminern.exe /s /q' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c del winstart\miner.exe /s /q
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\miner.exe /s /q
'<SYSTEM32>\cmd.exe' /c del winstart\myminer.exe /s /q
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminer.exe /s /q
'<SYSTEM32>\cmd.exe' /c del winstart\myminera.exe /s /q
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminera.exe /s /q
'<SYSTEM32>\cmd.exe' /c del winstart\myminern.exe /s /q
'<SYSTEM32>\cmd.exe' /c del %TEMP%\winstart\myminern.exe /s /q

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial