Primary Indicators of Compromise (IOCs)
The malware attempts to hide in legitimate-looking system directories.
Main Payload C:\Windows\SysWOW64\msres\Setup.exe
Log Directory C:\Windows\SysWOW64\msres\log
Common Files Path
C:\Program Files\Common Files\ytcommon
Persistence & Privilege Escalation
UAC Bypass
The malware uses a COM-based technique involving the ICMLuaUtil interface to elevate privileges silently.
Registry Modification
It modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer by setting the value NoPropertiesMyComputer to 0, likely to hide system information or hinder user investigation.
PDB String
The binary contains the debug path C:\Users\sakur\Desktop\k7\bypassuac1-main\x64\Release\bypassuac.pdb, linking it to known development environments.
Attribution Context
The campaign utilizes the Yangtu (SyncFuture) software certificate and infrastructure, heavily suggesting a Chinese origin targeting Indian government and infrastructure sectors.
Recommendation / Remediation
If you suspect this malware is present or are auditing a machine based on these reports, perform the following immediately.
Isolate the Host
Disconnect the machine from the network to prevent data exfiltration.
Verify Avast Exclusions
Open Avast Antivirus.
Navigate to Settings > Exceptions.
Look for any exclusions pointing to C:\Windows\SysWOW64\msres\ or Setup.exe.
Remove them
immediately.
Manual IOC Check (Powershell)
Run this command in an Administrator PowerShell to check for the specific file markers.
Code:
$paths = @(
"C:\Windows\SysWOW64\msres\Setup.exe",
"C:\Program Files\Common Files\ytcommon"
)
foreach ($path in $paths) {
if (Test-Path $path) {
Write-Host "CRITICAL: Malicious artifact found at $path" -ForegroundColor Red
} else {
Write-Host "CLEAN: $path not found." -ForegroundColor Green
}
}
Cleanup
Check the Registry for the NoPropertiesMyComputer value mentioned above.
Scan the machine with a different non-resident scanner (e.g., Malwarebytes or HitmanPro) since the installed Avast instance may be compromised/tampered with.
References
MITRE ATT&CK T1204.001
(User Execution: Malicious Link)
MITRE ATT&CK T1562.001
(Impair Defenses: Disable or Modify Tools)
www.esentire.com
