Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' "%APPDATA%\sfoWQ.js"
Modifies file system
Creates the following files
- %TEMP%\sfowq.txt
- %APPDATA%\sfowq.txt
Deletes the following files
- %TEMP%\sfowq.txt
Moves the following files
- from %APPDATA%\sfowq.txt to %APPDATA%\sfowq.js
Network activity
TCP
Other
- '34.##0.144.191':443
- '34.##7.121.53':443
- '34.##9.100.209':443
