Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\CoreRuntime' = '00000000'
Patches code
in AMSI dll
- ~7bb3.tmp process, Amsi.dll module
- searchprotocolhost.exe process, Amsi.dll module
- searchfilterhost.exe process, Amsi.dll module
- taskhostw.exe process, Amsi.dll module
- sihost.exe process, Amsi.dll module
in NTDLL dll
- ~7bb3.tmp process, ntdll.dll module
- searchprotocolhost.exe process, ntdll.dll module
- searchfilterhost.exe process, ntdll.dll module
- taskhostw.exe process, ntdll.dll module
- sihost.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\~7bb3.tmp
- %LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe
- %LOCALAPPDATA%\microsoft\coreruntime\sihost.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe
- %LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe
- %LOCALAPPDATA%\microsoft\coreruntime\sihost.exe
Network activity
UDP
- DNS ASK de####sync.ipv64.de
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Creates and executes the following
- '%TEMP%\~7bb3.tmp'
- '%LOCALAPPDATA%\microsoft\coreruntime\searchprotocolhost.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\searchfilterhost.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\taskhostw.exe'
- '%LOCALAPPDATA%\microsoft\coreruntime\sihost.exe'
Executes the following
- '%TEMP%\~7bb3.tmp' ' (with hidden window)
