Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Driver Detective-RTMUpdater.job
- %WINDIR%\Tasks\Driver Detective-RTMRules.job
- %WINDIR%\Tasks\Driver Detective-RTMScanRunOnce.job
- %WINDIR%\Tasks\Driver Detective-RTMScan.job
Malicious functions:
Creates and executes the following:
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1C.tmp" "%TEMP%\CSC1B.tmp"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe' /noconfig /fullpaths @"%TEMP%\hmfhphmg.cmdline"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E.tmp" "%TEMP%\CSC3D.tmp"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe' /noconfig /fullpaths @"%TEMP%\zcui67nu.cmdline"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES12.tmp" "%TEMP%\CSC11.tmp"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe' /noconfig /fullpaths @"%TEMP%\jxid_pyx.cmdline"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x1EF6C705624F7246\DriversHQ.DriverDetective.Client.exe'
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe' /noconfig /fullpaths @"%TEMP%\twtdd3vp.cmdline"
- '<Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
Modifies file system :
Creates the following files:
- %TEMP%\Cab23.tmp
- %TEMP%\Cab25.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab2B.tmp
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab29.tmp
- %TEMP%\hmfhphmg.cmdline
- %TEMP%\hmfhphmg.out
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters.__meta__.__tmp__
- %TEMP%\hmfhphmg.0.cs
- %TEMP%\hmfhphmg.dll
- %TEMP%\Cab1D.tmp
- %TEMP%\CSC1B.tmp
- %TEMP%\RES1C.tmp
- %TEMP%\Cab2F.tmp
- %TEMP%\RES3E.tmp
- %TEMP%\zcui67nu.dll
- %TEMP%\zcui67nu.out
- %TEMP%\CSC3D.tmp
- %TEMP%\Cab43.tmp
- %TEMP%\Cab45.tmp
- %TEMP%\Cab3F.tmp
- %TEMP%\Cab41.tmp
- %TEMP%\Cab35.tmp
- %TEMP%\Cab37.tmp
- %TEMP%\Cab31.tmp
- %TEMP%\Cab33.tmp
- %TEMP%\zcui67nu.0.cs
- %TEMP%\zcui67nu.cmdline
- %TEMP%\Cab39.tmp
- %TEMP%\Cab3B.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab7.tmp
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\b-xsc34-.newcfg
- %TEMP%\Cab3.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\jxid_pyx.0.cs
- %TEMP%\jxid_pyx.cmdline
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\xsandbox.bin.__tmp__
- %TEMP%\RES2.tmp
- %TEMP%\jxid_pyx.dll
- %TEMP%\jxid_pyx.out
- %TEMP%\CSC1.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\twtdd3vp.dll
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\kscztyfm.newcfg
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\UAB.__meta__.__tmp__
- <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters\Driver Detective.__meta__.__tmp__
- %TEMP%\Cab17.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\CabF.tmp
- %TEMP%\twtdd3vp.0.cs
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CSC11.tmp
- %TEMP%\RES12.tmp
- %TEMP%\twtdd3vp.cmdline
- %TEMP%\twtdd3vp.out
Deletes the following files:
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab2B.tmp
- %TEMP%\Cab29.tmp
- %TEMP%\Cab33.tmp
- %TEMP%\Cab31.tmp
- %TEMP%\Cab2F.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab1D.tmp
- %TEMP%\hmfhphmg.0.cs
- %TEMP%\Cab25.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab35.tmp
- %TEMP%\Cab3F.tmp
- %TEMP%\zcui67nu.0.cs
- %TEMP%\zcui67nu.out
- %TEMP%\Cab45.tmp
- %TEMP%\Cab43.tmp
- %TEMP%\Cab41.tmp
- %TEMP%\zcui67nu.dll
- %TEMP%\Cab3B.tmp
- %TEMP%\Cab39.tmp
- %TEMP%\Cab37.tmp
- %TEMP%\zcui67nu.cmdline
- %TEMP%\CSC3D.tmp
- %TEMP%\RES3E.tmp
- %TEMP%\hmfhphmg.dll
- %TEMP%\Cab9.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\CabF.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\jxid_pyx.cmdline
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\jxid_pyx.0.cs
- %TEMP%\jxid_pyx.out
- %TEMP%\jxid_pyx.dll
- %TEMP%\RES12.tmp
- %TEMP%\RES1C.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\hmfhphmg.cmdline
- %TEMP%\hmfhphmg.out
- %TEMP%\CSC1B.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\twtdd3vp.cmdline
- %TEMP%\twtdd3vp.dll
- %TEMP%\CSC11.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\twtdd3vp.0.cs
- %TEMP%\twtdd3vp.out
Moves the following files:
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\X86_APNInstaller@1.0.0.0\APNInstaller.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\X86_APNInstaller@1.0.0.0\APNInstaller.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\X86_APNInstaller@1.0.0.0\X86_APNInstaller@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\X86_APNInstaller@1.0.0.0\X86_APNInstaller@1.0.0.0.manifest
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0xCB1C2728B419D9A1\csc.exe
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\ISUninstall.exe_0xc6c9ac0f279aea55fc9f66841fef93f8.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\ISUninstall.exe_0xc6c9ac0f279aea55fc9f66841fef93f8.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Offercast2802_PCD_.exe_0x135fb44681e6b409dc378960cfcb7a76.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Offercast2802_PCD_.exe_0x135fb44681e6b409dc378960cfcb7a76.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Offercast2802_PCD_.exe_0x135fb44681e6b409dc378960cfcb7a76.204.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Offercast2802_PCD_.exe_0x135fb44681e6b409dc378960cfcb7a76.204.manifest
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\UAB.__meta__.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\UAB.__meta__
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters\Driver Detective.__meta__.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters\Driver Detective.__meta__
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters.__meta__.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\meta\@APPDATACOMMON@\PC Drivers HeadQuarters.__meta__
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x2D1395E21B7E4B2B\cvtres.exe
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\b-xsc34-.newcfg to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\user.config
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\kscztyfm.newcfg to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\roaming\modified\@APPDATALOCAL@\PC_Drivers_Headquarters\DriversHQ.DriverDetective_Url_ljss1ytmefwoclnqrmuhmi2qtxzx42ya\8.2.0.10\user.config
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0\DriversHQ.DriverDetective.Client.Updater.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_DriversHQ.DriverDetective.Client.Updater@1.0.0.0\DriversHQ.DriverDetective.Client.Updater.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_MyApplication.app@1.0.0.0\_MyApplication.app@1.0.0.0.manifest
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\xsandbox.bin.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\xsandbox.bin
- from <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x1EF6C705624F7246\DriversHQ.DriverDetective.Client.exe.__tmp__ to <Current directory>\App\Sandbox\Driver Detective\8.2.0.10\@BUILD TIME@\local\stubexe\0x1EF6C705624F7246\DriversHQ.DriverDetective.Client.exe
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\shallow\Berlin Sans FB.TTF_0xFE2027C27B6A24505F548C6FD2E1076D.TTF.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\shallow\Berlin Sans FB.TTF_0xFE2027C27B6A24505F548C6FD2E1076D.TTF
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\DriversHQ.DriverDetective.Client.exe_0x0acbeb267d2a4b1f354b9c7daa5f4318.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\DriversHQ.DriverDetective.Client.exe_0x0acbeb267d2a4b1f354b9c7daa5f4318.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\DriversHQ.DriverDetective.Client.Updater.exe_0xad9c86c668ac4627e452b62d0c1b15cc.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\DriversHQ.DriverDetective.Client.Updater.exe_0xad9c86c668ac4627e452b62d0c1b15cc.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\InstallAsk.exe_0xe8245fadab2278ad63c147ad6e1407b2.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\InstallAsk.exe_0xe8245fadab2278ad63c147ad6e1407b2.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\_MyApplication.app@1.0.0.0\MyApplication.app.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Agent.CPU.exe_0x749f8329b41835e74663455fd19cecda.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\Agent.CPU.exe_0x749f8329b41835e74663455fd19cecda.1.manifest
- from %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\cpuidsdk.dll_0x338edc7ac989b523d1e90ab7e7396855.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x0ED9630D684B3F90\sxs\Manifests\cpuidsdk.dll_0x338edc7ac989b523d1e90ab7e7396855.2.manifest
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'we######ces.drivershq.com':443
- 'st###.spoon.net':443
- 'wp#d':80
TCP:
HTTP GET requests:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK we######ces.drivershq.com
- DNS ASK st###.spoon.net
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
