Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\mshost
- <SYSTEM32>\tasks\appsynclaunch
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>\mshost.exe' -EA SilentlyContinue"
Modifies file system
Creates the following files
- <Current directory>\imgui.ini
- %TEMP%\cache_update.exe
- %TEMP%\app_sync.log
- <SYSTEM32>\mshost.exe.staging
- %TEMP%\lk_3904_1030187.db
- %TEMP%\lk_3904_1033750.db
- %TEMP%\lk_3904_1033890.db
- %TEMP%\lkrc858.tmp.ps1
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\mshost.exe
Deletes following files that it created itself
- %TEMP%\cache_update.exe
- %TEMP%\lk_3904_1030187.db
- %TEMP%\lk_3904_1033750.db
- %TEMP%\lk_3904_1033890.db
Moves the following files
- from <SYSTEM32>\mshost.exe.staging to <SYSTEM32>\mshost.exe
Substitutes the following files
- %TEMP%\cache_update.exe
Network activity
Connects to
- 'lo####.ky3ls.space':443
TCP
Other
- 'lo####.ky3ls.space':443
UDP
- DNS ASK lo####.ky3ls.space
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\mshost.exe' --run
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\lkrC858.tmp.ps1"
Executes the following
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\mshost.exe" /grant *S-1-5-32-544:F /C /Q
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Microsoft\Windows\mshost" /TR "\"<SYSTEM32>\mshost.exe\" --run" /SC ONLOGON /RL HIGHEST /DELAY 0000:03
- '<SYSTEM32>\schtasks.exe' /Create /F /TN AppSyncLaunch /TR "\"<SYSTEM32>\mshost.exe\" --run" /SC ONLOGON /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /Run /TN "Microsoft\Windows\mshost"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\mshost.exe" /grant *S-1-5-32-544:F /C /Q' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Microsoft\Windows\mshost" /TR "\"<SYSTEM32>\mshost.exe\" --run" /SC ONLOGON /RL HIGHEST /DELAY 0000:03' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /F /TN AppSyncLaunch /TR "\"<SYSTEM32>\mshost.exe\" --run" /SC ONLOGON /RL HIGHEST' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Run /TN "Microsoft\Windows\mshost"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<SYSTEM32>\mshost.exe' -EA SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\lkrC858.tmp.ps1"' (with hidden window)
