Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'LockFrameSvcCbCYp3' = '%LOCALAPPDATA%\yqmh7c3jtk\LockAppHost.exe'
Modifies file system
Creates the following files
- %TEMP%\is-hq2rp.tmp\<File name>.tmp
- %TEMP%\is-h0hc4.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-q6rm1.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-k0mlr.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-9ras5.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-7epvu.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-04085.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\is-mecrh.tmp
- %LOCALAPPDATA%\yqmh7c3jtk\unins000.dat
- %TEMP%\svc_log.tmp
- %TEMP%\hx_agent_debug.log
- %TEMP%\hx_mod_00000f54_3dc0.dll
Deletes following files that it created itself
- %TEMP%\is-h0hc4.tmp\_isetup\_setup64.tmp
- %TEMP%\is-hq2rp.tmp\<File name>.tmp
Moves the following files
- from %LOCALAPPDATA%\yqmh7c3jtk\is-q6rm1.tmp to %LOCALAPPDATA%\yqmh7c3jtk\unins000.exe
- from %LOCALAPPDATA%\yqmh7c3jtk\is-k0mlr.tmp to %LOCALAPPDATA%\yqmh7c3jtk\lockhostingframework.dll
- from %LOCALAPPDATA%\yqmh7c3jtk\is-9ras5.tmp to %LOCALAPPDATA%\yqmh7c3jtk\msiexec.dll
- from %LOCALAPPDATA%\yqmh7c3jtk\is-7epvu.tmp to %LOCALAPPDATA%\yqmh7c3jtk\wbem.dll
- from %LOCALAPPDATA%\yqmh7c3jtk\is-04085.tmp to %LOCALAPPDATA%\yqmh7c3jtk\lockapphost.exe
- from %LOCALAPPDATA%\yqmh7c3jtk\is-mecrh.tmp to %LOCALAPPDATA%\yqmh7c3jtk\decoy_8100576702.jpg
Network activity
Connects to
- '47.##.104.31':16886
TCP
HTTP POST requests
- http://47.##.104.31/api/v1/sync
Other
- '47.##.104.31':16886
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-hq2rp.tmp\<File name>.tmp' /SL5="$1902A8,1252844,826880,<Full path to file>"
- '%LOCALAPPDATA%\yqmh7c3jtk\lockapphost.exe'
Executes the following
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '%LOCALAPPDATA%\yqmh7c3jtk\lockapphost.exe' ' (with hidden window)
