Technical Information
Triggers a user-defined sigma rule:
- 4fc0deee-0057-4998-ab31-d24e46e0aba4
- 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
- 92626ddd-662c-49e3-ac59-f6535f12d189
- 7a02e22e-b885-4404-b38b-1ddc7e65258a
- 81325ce1-be01-4250-944f-b4789644556f
- 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
- d223b46b-5621-4037-88fe-fda32eead684
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsLockHost' = '%LOCALAPPDATA%\jhg9zpwkig\LockAppHost.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowslockhost
Modifies file system
Creates the following files
- %TEMP%\is-s9kif.tmp\<File name>.tmp
- %TEMP%\is-ntset.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-q5osm.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-h8tit.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-rsdo5.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-nf21m.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-8p0tk.tmp
- %LOCALAPPDATA%\jhg9zpwkig\is-dv26g.tmp
- %LOCALAPPDATA%\jhg9zpwkig\unins000.dat
- %LOCALAPPDATA%\jhg9zpwkig\lockapp_debug.log
- %TEMP%\svc_log.tmp
- %TEMP%\hx_agent_debug.log
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\23566aa11ef6f77f638b3398b3bcc6a5_2bb724b124e2bd148ea57d3e5ad49a6c
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\26c212d9399727259664bdfca073966e_912c3ca51de6018a7be4ca7bc64aafcd
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\892580777767344dcaef580ffa143ea6_ef1b61dd3f93c58dbd0734f13c15c0f6
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\b76be66d46c355931939d8cf818d03fd_39df7432e6ef50cda9c936e29e7da30d
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\b76be66d46c355931939d8cf818d03fd_879afeb08dcb012707582d902977ff92
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_eaf5d55d93603a879fa973006301f24f
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\fb0d848f74f70bb2eaa93746d24d9749
Deletes following files that it created itself
- %TEMP%\is-ntset.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s9kif.tmp\<File name>.tmp
Moves the following files
- from %LOCALAPPDATA%\jhg9zpwkig\is-q5osm.tmp to %LOCALAPPDATA%\jhg9zpwkig\unins000.exe
- from %LOCALAPPDATA%\jhg9zpwkig\is-h8tit.tmp to %LOCALAPPDATA%\jhg9zpwkig\lockhostingframework.dll
- from %LOCALAPPDATA%\jhg9zpwkig\is-rsdo5.tmp to %LOCALAPPDATA%\jhg9zpwkig\msiexec.dll
- from %LOCALAPPDATA%\jhg9zpwkig\is-nf21m.tmp to %LOCALAPPDATA%\jhg9zpwkig\wbem.dll
- from %LOCALAPPDATA%\jhg9zpwkig\is-8p0tk.tmp to %LOCALAPPDATA%\jhg9zpwkig\lockapphost.exe
- from %LOCALAPPDATA%\jhg9zpwkig\is-dv26g.tmp to %LOCALAPPDATA%\jhg9zpwkig\decoy_8707846915.mp4
Network activity
Connects to
- '47.##.51.107':9527
- 'se######-ssl.xboxlive.com':443
- 'go.microsoft.com':443
- '10#.#51.135.62':80
- 'oneocsp.microsoft.com':80
- 'activation.playready.microsoft.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d3##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQVgJZqCZ3Nr22JSLELeNxL%2F2feVwQUVAy87Bj3ffED4oS%2BNGREZ891H2UCE0MAVFZs%2FK8fYsU8Pd4AAABUVmw%3D
HTTP POST requests
- http://47.##.51.107/api/v1/sync
Other
- '47.##.51.107':9527
- 'se######-ssl.xboxlive.com':443
- 'go.microsoft.com':443
- 'activation.playready.microsoft.com':443
UDP
- DNS ASK se######-ssl.xboxlive.com
- DNS ASK go.microsoft.com
- DNS ASK oneocsp.microsoft.com
- DNS ASK activation.playready.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-s9kif.tmp\<File name>.tmp' /SL5="$B02A6,3191790,826880,<Full path to file>"
- '%LOCALAPPDATA%\jhg9zpwkig\lockapphost.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "WindowsLockHost" /tr ""%LOCALAPPDATA%\jhg9zpwkig\LockAppHost.exe"" /sc onlogon /rl highest
- '%ProgramFiles%\windowsapps\microsoft.zunevideo_10.19071.19011.0_x64__8wekyb3d8bbwe\video.ui.exe' -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
- '%LOCALAPPDATA%\jhg9zpwkig\lockapphost.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "WindowsLockHost" /tr ""%LOCALAPPDATA%\jhg9zpwkig\LockAppHost.exe"" /sc onlogon /rl highest' (with hidden window)