Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c start "" 18.exe
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 2020
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %HOMEPATH%\documents\18.exe
- %TEMP%\1277507.cvr
Network activity
Connects to
- '95.##6.189.14':80
TCP
HTTP GET requests
- http://95.##6.189.14/w4
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c start "" 18.exe' (with hidden window)
