Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\mshta.exe' "C:\DOCUME~1\user\LOCALS~1\Temp\IE_Nets.hta"
Modifies file system
Creates the following files
- C:\Documents\user\locals~1\temp\~df6bc4.tmp
- C:\Documents\user\locals~1\temp\ie_nets.hta
Network activity
Connects to
- '10#.#72.148.208':80
TCP
HTTP GET requests
- http://10#.#72.148.208/bg/bg.hta
Miscellaneous
Searches for the following windows
- ClassName: 'Ghost' WindowName: ''
- ClassName: 'MsoHelp11' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
