Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /k powershell.exe -noprofile -ExecutionPolicy UnRestricted -EncodedCommand YwBhAGwAYwAuAGUAeABlAA==
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /k powershell.exe -noprofile -ExecutionPolicy UnRestricted -EncodedCommand YwBhAGwAYwAuAGUAeABlAA==' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noprofile -ExecutionPolicy UnRestricted -EncodedCommand YwBhAGwAYwAuAGUAeABlAA==
- '<SYSTEM32>\calc.exe'
