Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Driver Easy Scheduled Scan.job
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\Eas...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\E...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe" name="Driver Easy" mode=ENABLE profile=ALL
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\is-H1VIV.tmp\icon_custom_up.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom_up_hover.bmp
- %ProgramFiles%\Easeware\DriverEasy\is-GAV53.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-5AE0U.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-FDLID.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-F9L8V.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-UNTLV.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-6F148.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-C6PDS.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-HSU98.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-5RNAF.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-1CG4B.tmp
- %ProgramFiles%\Easeware\DriverEasy\unins000.dat
- %ProgramFiles%\Easeware\DriverEasy\is-CIM0K.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-SDD2B.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-KQ8G6.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-UC2FJ.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-AV0FR.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-DAB1C.tmp
- %TEMP%\is-H1VIV.tmp\is-IQEAB.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Driver Easy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Uninstall Driver Easy.lnk
- %ALLUSERSPROFILE%\Desktop\Driver Easy.lnk
- %ProgramFiles%\Easeware\DriverEasy\unins000.msg
- %TEMP%\is-H1VIV.tmp\icon_custom_down_hover.bmp
- %ProgramFiles%\Easeware\DriverEasy\is-S609N.tmp
- %TEMP%\is-H1VIV.tmp\icon_custom_down.bmp
- %TEMP%\is-H1VIV.tmp\button_browse.png
- %CommonProgramFiles%\~fplpjxl.ibo
- %TEMP%\is-OA2AK.tmp\~fplpjxl.tmp
- %TEMP%\is-H1VIV.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-H1VIV.tmp\botva2.dll
- %TEMP%\is-H1VIV.tmp\innocallback.dll
- %TEMP%\is-H1VIV.tmp\isxdl.dll
- %TEMP%\is-H1VIV.tmp\icon_custom.png
- %TEMP%\is-H1VIV.tmp\icon_uncustom.png
- %TEMP%\is-H1VIV.tmp\button_setup_or_next.png
- %TEMP%\is-H1VIV.tmp\background_welcome.png
- %TEMP%\is-H1VIV.tmp\background_welcome_more.png
- %TEMP%\is-H1VIV.tmp\progressbar_background.png
- %TEMP%\is-H1VIV.tmp\btn_browse.bmp
- %TEMP%\is-H1VIV.tmp\progressbar_foreground.png
- %TEMP%\is-H1VIV.tmp\checkbox_license.png
- %TEMP%\is-H1VIV.tmp\background_installing.png
- %TEMP%\is-H1VIV.tmp\background_finish.png
- %TEMP%\is-H1VIV.tmp\button_close.png
- %TEMP%\is-H1VIV.tmp\button_minimize.png
- %TEMP%\is-H1VIV.tmp\background_messagebox.png
- %TEMP%\is-H1VIV.tmp\icon-info_60x60.png
- %TEMP%\is-H1VIV.tmp\btn_install.bmp
- %TEMP%\is-H1VIV.tmp\btn_install_hover.bmp
- %TEMP%\is-H1VIV.tmp\btn_install_notclick.bmp
- %TEMP%\is-H1VIV.tmp\btn_browse_hover.bmp
- %APPDATA%\Easeware\DriverEasy\settings.dat
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~fplpjxl.ibo
- %TEMP%\is-H1VIV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom_down.bmp
- %TEMP%\is-H1VIV.tmp\btn_browse_hover.bmp
- %TEMP%\is-H1VIV.tmp\btn_browse.bmp
- %TEMP%\is-H1VIV.tmp\btn_install_notclick.bmp
- %TEMP%\is-H1VIV.tmp\btn_install_hover.bmp
- %TEMP%\is-H1VIV.tmp\btn_install.bmp
- %TEMP%\is-H1VIV.tmp\icon-info_60x60.png
- %TEMP%\is-H1VIV.tmp\background_messagebox.png
- %TEMP%\is-H1VIV.tmp\button_minimize.png
- %TEMP%\is-H1VIV.tmp\button_close.png
- %TEMP%\is-H1VIV.tmp\icon_custom_up.bmp
- %TEMP%\is-H1VIV.tmp\background_finish.png
- %TEMP%\is-H1VIV.tmp\checkbox_license.png
- %TEMP%\is-H1VIV.tmp\progressbar_foreground.png
- %TEMP%\is-H1VIV.tmp\progressbar_background.png
- %TEMP%\is-H1VIV.tmp\button_browse.png
- %TEMP%\is-H1VIV.tmp\background_welcome_more.png
- %TEMP%\is-H1VIV.tmp\background_welcome.png
- %TEMP%\is-H1VIV.tmp\button_setup_or_next.png
- %TEMP%\is-H1VIV.tmp\icon_uncustom.png
- %TEMP%\is-H1VIV.tmp\icon_custom.png
- %TEMP%\is-H1VIV.tmp\innocallback.dll
- %TEMP%\is-H1VIV.tmp\botva2.dll
- %TEMP%\is-H1VIV.tmp\background_installing.png
- %TEMP%\is-H1VIV.tmp\icon_custom_up_hover.bmp
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\is-H1VIV.tmp\progressbar_foreground.png
- %TEMP%\is-H1VIV.tmp\progressbar_background.png
- %TEMP%\is-H1VIV.tmp\isxdl.dll
- %TEMP%\is-H1VIV.tmp\innocallback.dll
- %TEMP%\is-H1VIV.tmp\icon_uncustom.png
- %TEMP%\is-H1VIV.tmp\icon_custom_up_hover.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom_up.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom_down.bmp
- %TEMP%\is-H1VIV.tmp\icon_custom.png
- %TEMP%\is-H1VIV.tmp\icon-info_60x60.png
- %TEMP%\is-H1VIV.tmp\checkbox_license.png
- %TEMP%\is-H1VIV.tmp\button_setup_or_next.png
- %TEMP%\is-H1VIV.tmp\button_minimize.png
- %TEMP%\is-H1VIV.tmp\button_close.png
- %TEMP%\is-H1VIV.tmp\button_browse.png
- %TEMP%\is-H1VIV.tmp\btn_install_notclick.bmp
- %TEMP%\is-H1VIV.tmp\btn_install_hover.bmp
- %TEMP%\is-H1VIV.tmp\btn_install.bmp
- %TEMP%\is-H1VIV.tmp\btn_browse_hover.bmp
- %TEMP%\is-H1VIV.tmp\btn_browse.bmp
- %TEMP%\is-H1VIV.tmp\botva2.dll
- %TEMP%\is-H1VIV.tmp\background_welcome_more.png
- %TEMP%\is-H1VIV.tmp\background_welcome.png
- %TEMP%\is-H1VIV.tmp\background_messagebox.png
- %TEMP%\is-H1VIV.tmp\background_installing.png
- %TEMP%\is-H1VIV.tmp\background_finish.png
- %TEMP%\is-H1VIV.tmp\InstallDotNet.bat
- <SYSTEM32>\d3d9caps.dat
- %TEMP%\is-H1VIV.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-OA2AK.tmp\~fplpjxl.tmp
Moves the following files:
- from %ProgramFiles%\Easeware\DriverEasy\is-GAV53.tmp to %ProgramFiles%\Easeware\DriverEasy\unins000.exe
- from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-AV0FR.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo.dll
- from %ProgramFiles%\Easeware\DriverEasy\7z\is-UC2FJ.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z86.dll
- from %ProgramFiles%\Easeware\DriverEasy\7z\is-KQ8G6.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-SDD2B.tmp to %ProgramFiles%\Easeware\DriverEasy\SevenZipSharp.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-CIM0K.tmp to %ProgramFiles%\Easeware\DriverEasy\Map.xml
- from %ProgramFiles%\Easeware\DriverEasy\is-1CG4B.tmp to %ProgramFiles%\Easeware\DriverEasy\Interop.WUApiLib.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-S609N.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-5RNAF.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Backup.dll
- from %ProgramFiles%\Easeware\DriverEasy\is-HSU98.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-C6PDS.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-6F148.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-UNTLV.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-F9L8V.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe.config
- from %ProgramFiles%\Easeware\DriverEasy\is-FDLID.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe
- from %ProgramFiles%\Easeware\DriverEasy\is-5AE0U.tmp to %ProgramFiles%\Easeware\DriverEasy\7zip_license.txt
- from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-DAB1C.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo64.dll
- from %TEMP%\is-H1VIV.tmp\is-IQEAB.tmp to %TEMP%\is-H1VIV.tmp\InstallDotNet.bat
Substitutes the following files:
- <SYSTEM32>\d3d9caps.dat
Network activity:
Connects to:
- 'wp#d':80
- 'go#####analytics.com':443
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK www.go#####analytics.com
Miscellaneous:
Creates and executes the following:
- '%CommonProgramFiles%\~fplpjxl.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-OA2AK.tmp\~fplpjxl.tmp' /SL5="$100E0,3673161,395264,%CommonProgramFiles%\~fplpjxl.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe' -create "Driver Easy Scheduled Scan" "%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe"
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe' DriverEasy en
- '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe'