Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\CoreRuntime' = '00000000'
Patches code
in AMSI dll
- iyqwzc.exe process, Amsi.dll module
- searchprotocolhost.exe process, Amsi.dll module
- searchfilterhost.exe process, Amsi.dll module
- taskhostw.exe process, Amsi.dll module
- sihost.exe process, Amsi.dll module
in NTDLL dll
- iyqwzc.exe process, ntdll.dll module
- searchprotocolhost.exe process, ntdll.dll module
- searchfilterhost.exe process, ntdll.dll module
- taskhostw.exe process, ntdll.dll module
- sihost.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe
- %LOCALAPPDATA%\microsoft\coreruntime\sihost.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe
- %LOCALAPPDATA%\microsoft\coreruntime\sihost.exe
Network activity
TCP
Other
- 'de####sync.ipv64.de':60485
UDP
- DNS ASK de####sync.ipv64.de
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\sihost.exe'
