Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im:mongoose-2.8.exe /f
Modifies file system
Creates the following files
- %TEMP%\public\licence.txt
- %TEMP%\public\node_modules\bootstrap3\dist\fonts\glyphicons-halflings-regular.ttf
- %TEMP%\public\node_modules\bootstrap3\dist\fonts\glyphicons-halflings-regular.woff
- %TEMP%\public\node_modules\bootstrap3\dist\fonts\glyphicons-halflings-regular.woff2
- %TEMP%\public\templates\.ds_store
- %TEMP%\public\templates\auditdetailedsalestable.mustache
- %TEMP%\public\templates\auditnomenclaturetables.mustache
- %TEMP%\public\templates\auditpaymentstable.mustache
- %TEMP%\public\img\itxt.png
- %TEMP%\public\templates\auditstornosalestable.mustache
- %TEMP%\public\templates\audituseractionstable.mustache
- %TEMP%\public\templates\homepage.mustache
- %TEMP%\public\templates\login.mustache
- %TEMP%\public\templates\logoutpage.mustache
- %TEMP%\public\templates\menu.mustache
- %TEMP%\public\templates\modal.mustache
- %TEMP%\public\tiny.exe
- %TEMP%\public\node_modules\bootstrap3\dist\fonts\glyphicons-halflings-regular.eot
- %TEMP%\public\node_modules\bootstrap3\dist\fonts\glyphicons-halflings-regular.svg
- %TEMP%\public\node_modules\bootstrap3\dist\.ds_store
- %TEMP%\public\node_modules\bootstrap3\.ds_store
- %TEMP%\public\node_modules\.ds_store
- %TEMP%\public\.ds_store
- %TEMP%\public\.htaccess
- %TEMP%\public\bundle.js
- %TEMP%\public\img\.ds_store
- %TEMP%\public\img\csv.svg
- %TEMP%\public\img\examplefilter.png
- %TEMP%\public\img\exportbtns.png
- %TEMP%\public\mongoose-2.8.exe
- %TEMP%\public\templates\auditsummarysalestable.mustache
- %TEMP%\public\img\icsv.png
- %TEMP%\public\img\ixlsx.png
- %TEMP%\public\img\txt.svg
- %TEMP%\public\img\xls.svg
- %TEMP%\public\img\xlsx.svg
- %TEMP%\public\index.html
- %TEMP%\public\js\filesaver.min.js
- %TEMP%\public\js\tableexport.js
- %TEMP%\napexporter.bat
- %TEMP%\public\img\ixls.png
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019102520191026\index.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\public\.ds_store
- %TEMP%\public\.htaccess
- %TEMP%\public\img\.ds_store
- %TEMP%\public\node_modules\.ds_store
- %TEMP%\public\node_modules\bootstrap3\.ds_store
- %TEMP%\public\node_modules\bootstrap3\dist\.ds_store
- %TEMP%\public\templates\.ds_store
Network activity
Connects to
- 'localhost':3000
TCP
HTTP GET requests
- http://lo###host:3000/
- http://lo###host:3000/js/FileSaver.min.js
- http://lo###host:3000/js/tableexport.js
- http://lo###host:3000/bundle.js
- http://lo###host:3000/favicon.ico
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\public\mongoose-2.8.exe' -root "%TEMP%\public" -ports 3000
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\napExporter.bat" "
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "%TEMP%\public\mongoose-2.8.exe"
