Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Driver Easy Scheduled Scan.job
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\Eas...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\E...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe" name="Driver Easy" mode=ENABLE profile=ALL
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-25LNG.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-UTC17.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-6RL8V.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-CPC41.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-29HGI.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-HHK9I.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-MGH9Q.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-H6LR6.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-7NM3B.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-SHF2F.tmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
- %ProgramFiles%\Easeware\DriverEasy\is-21020.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-B8AD7.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-LHODJ.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-B54RU.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-OFIBT.tmp
- %TEMP%\is-K7MLV.tmp\is-T3A50.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Driver Easy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Uninstall Driver Easy.lnk
- %ALLUSERSPROFILE%\Desktop\Driver Easy.lnk
- %ProgramFiles%\Easeware\DriverEasy\unins000.msg
- %ProgramFiles%\Easeware\DriverEasy\unins000.dat
- %APPDATA%\Easeware\DriverEasy\settings.dat
- %ProgramFiles%\Easeware\DriverEasy\is-NVJF7.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-O1AMJ.tmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-U0TPE.tmp\~scjvmga.tmp
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\isxdl.dll
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %CommonProgramFiles%\~scjvmga.ibo
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\aut2.tmp
- %APPDATA%\Easeware\DriverEasy\license.dat
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~scjvmga.ibo
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %TEMP%\is-K7MLV.tmp\isxdl.dll
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\InstallDotNet.bat
- <SYSTEM32>\d3d9caps.dat
- %TEMP%\is-U0TPE.tmp\~scjvmga.tmp
- %TEMP%\aut2.tmp
Moves the following files:
- from %ProgramFiles%\Easeware\DriverEasy\is-21020.tmp to %ProgramFiles%\Easeware\DriverEasy\unins000.exe
- from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-B54RU.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo.dll
- from %ProgramFiles%\Easeware\DriverEasy\7z\is-LHODJ.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z86.dll
- from %ProgramFiles%\Easeware\DriverEasy\7z\is-O1AMJ.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-NVJF7.tmp to %ProgramFiles%\Easeware\DriverEasy\SevenZipSharp.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-B8AD7.tmp to %ProgramFiles%\Easeware\DriverEasy\Map.xml
- from %ProgramFiles%\Easeware\DriverEasy\is-SHF2F.tmp to %ProgramFiles%\Easeware\DriverEasy\Interop.WUApiLib.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-7NM3B.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-H6LR6.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Backup.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-MGH9Q.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-HHK9I.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-29HGI.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-CPC41.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-6RL8V.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-UTC17.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-25LNG.tmp to %ProgramFiles%\Easeware\DriverEasy\7zip_license.txt
- from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-OFIBT.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo64.dll
- from %TEMP%\is-K7MLV.tmp\is-T3A50.tmp to %TEMP%\is-K7MLV.tmp\InstallDotNet.bat
Substitutes the following files:
- <SYSTEM32>\d3d9caps.dat
Modifies the HOSTS file.
Network activity:
Connects to:
- 'wp#d':80
- 'go#####analytics.com':443
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK www.go#####analytics.com
- DNS ASK www.dr###reasy.com
Miscellaneous:
Creates and executes the following:
- '%CommonProgramFiles%\~scjvmga.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-U0TPE.tmp\~scjvmga.tmp' /SL5="$100E0,3590243,397824,%CommonProgramFiles%\~scjvmga.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe' -create "Driver Easy Scheduled Scan" "%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe"
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe' DriverEasy en
- '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe'
