Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\DriverNavigator Scheduled Scan.job
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe DriverNavigator en
- %APPDATA%\doctorsilent.blogspot.com\driver\DoctoR.exe
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.CheckScheduledScan.exe -create "DriverNavigator Scheduled Scan" "%PROGRAM_FILES%\Easeware\DriverNavigator\DriverNavigator.exe"
- %APPDATA%\doctorsilent.blogspot.com\driver\DriverNavigator_Setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- %TEMP%\is-Q5UVS.tmp\DriverNavigator_Setup.tmp /SL5="$1013E,977809,140800,%APPDATA%\doctorsilent.blogspot.com\driver\DriverNavigator_Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- <SYSTEM32>\cmd.exe /c ""%APPDATA%\doctorsilent.blogspot.com\driver\kur.cmd" "
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab1.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab3.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %ALLUSERSPROFILE%\Start Menu\Programs\DriverNavigator\DriverNavigator.lnk
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-9SBLJ.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-BCJ87.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\DriverNavigator\Uninstall DriverNavigator.lnk
- %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.dat
- %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.msg
- %ALLUSERSPROFILE%\Desktop\DriverNavigator.lnk
- %TEMP%\Cab9.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab1D.tmp
- %TEMP%\Cab1B.tmp
- %TEMP%\Cab21.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Core.dll
- %TEMP%\Cab25.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\CabF.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\Cab13.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-JJS6J.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-TQ7IE.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-QO05U.tmp
- %TEMP%\is-1D4DG.tmp\isxdl.dll
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-LR3C4.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-IMAV7.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-DJE9G.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-VF8KQ.tmp
- %TEMP%\is-1D4DG.tmp\_isetup\_shfoldr.dll
- %APPDATA%\doctorsilent.blogspot.com\driver\Easeware.Driver.Core.dll
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %APPDATA%\doctorsilent.blogspot.com\driver\DoctoR.exe
- %TEMP%\is-Q5UVS.tmp\DriverNavigator_Setup.tmp
- %APPDATA%\doctorsilent.blogspot.com\driver\DriverNavigator_Setup.exe
- %APPDATA%\doctorsilent.blogspot.com\driver\kur.cmd
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-N14J2.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\is-RGVF6.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-T2M2T.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-BQIK3.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\is-QVENR.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-C5KTH.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-P7C6P.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\is-RU4RF.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-LQSQ6.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-L053P.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-FENL1.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\is-8JVQH.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-6400R.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-U7VDR.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-M7PB7.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-5I4IB.tmp
Deletes the following files:
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\Cab1B.tmp
- %TEMP%\Cab1D.tmp
- %TEMP%\is-1D4DG.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-Q5UVS.tmp\DriverNavigator_Setup.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Core.dll
- %TEMP%\Cab25.tmp
- %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe
- %TEMP%\is-1D4DG.tmp\isxdl.dll
- %TEMP%\Cab17.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabF.tmp
Moves the following files:
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-T2M2T.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.DriverInstall.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\is-RGVF6.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\de\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\is-QVENR.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\fr\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-U7VDR.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\DriverNavigator.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\is-LQSQ6.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\es-AR\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-BQIK3.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.ConfigLanguageFromSetup.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-JJS6J.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.Driver.Core.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-BCJ87.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Interop.WUApiLib.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-9SBLJ.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Interop.Shell32.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\is-RU4RF.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\es-AR\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-P7C6P.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.DriverInstall.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\x64\is-C5KTH.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\x64\Easeware.Driver.Backup.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-M7PB7.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\fr\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-VF8KQ.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.CheckScheduledScan.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-DJE9G.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\UnRAR.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-IMAV7.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\UnRAR_license.txt
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-QO05U.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\unins000.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-TQ7IE.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\DriverNavigator.exe
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-LR3C4.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Core.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-L053P.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\de\DriverNavigator.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\de\is-6400R.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\de\Easeware.DriverInstall.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\fr\is-5I4IB.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\fr\DriverNavigator.resources.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-N14J2.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Interop.Shell32.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-8JVQH.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Interop.WUApiLib.dll
- from %PROGRAM_FILES%\Easeware\DriverNavigator\is-FENL1.tmp to %PROGRAM_FILES%\Easeware\DriverNavigator\Easeware.Driver.Backup.dll
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''