Technical Information
Malicious functions:
Executes the following:
- '<Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe'
- '<Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe'
Modifies file system:
Creates the following files:
- <Current directory>\Data\roaming\modified\@APPDATACOMMON@\ReviverSoft\Driver Reviver\S-1-5-21-2052111302-484763869-725345543-1003\AppSettings.xml
- <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci
- <Current directory>\Data\roaming\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci.__meta__.__tmp__
- <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe.manifest.__tmp__
- <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe
- <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe.__meta__.__tmp__
- <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe.__tmp__
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- <Current directory>\Data\roaming\modified\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\license[1].htm
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- <Current directory>\Data\roaming\modified\@APPDATACOMMON@\ReviverSoft\Driver Reviver\S-1-5-21-2052111302-484763869-725345543-1003\app_log.log
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll.__meta__.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviverUpdater.exe_0x5380e27300e910dcc051dc647ee61a46.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoft Smart Monitor Service.exe_0xe7227cac5fda9fa20e5e8d889686fe7f.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoftSmartMonitor.exe_0x617d08c49cade226e403fedad0e5da0a.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviver.exe_0x24283ceb94d1a200a7aa2ccbf9055aab.1.manifest.__tmp__
- <Current directory>\Data\xsandbox.bin.__tmp__
- <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe.__tmp__
- <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest.__tmp__
- <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x4618c4f8b9880aa776df25ff7dec8d0c.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\SystemInfo-vc100-mt.dll_0x6cb3432dff1aed692bab879534fc9afa.2.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\tray.exe_0x3333b6c073a28490f25aa8fe2c27cb4d.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x310553443e2010b2fc36deb8a6c91083.1.manifest.__tmp__
Sets the 'hidden' attribute to the following files:
- <Current directory>\Data\roaming\modified\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci
Deletes the following files:
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab5.tmp
Moves the following files:
- from <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll.__meta__.__tmp__ to <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll.__meta__
- from <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe to <Current directory>\Data\local\modified\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe
- from <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll to <Current directory>\Data\local\modified\@PROGRAMFILESX86@\ReviverSoft\Smart Monitor\SystemInfo-vc100-mt.dll
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest
- from <Current directory>\Data\local\temp\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci to <Current directory>\Data\roaming\modified\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci
- from <Current directory>\Data\roaming\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci.__meta__.__tmp__ to <Current directory>\Data\roaming\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\lci.lci.__meta__
- from <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe.manifest.__tmp__ to <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe.manifest
- from <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe.__meta__.__tmp__ to <Current directory>\Data\local\meta\@PROGRAMFILESX86@\ReviverSoft\Driver Reviver\DriverReviver.exe.__meta__
- from <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe.__tmp__ to <Current directory>\Data\local\stubexe\0xB15287F69D0E386A\DriverReviver.exe
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x4618c4f8b9880aa776df25ff7dec8d0c.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x4618c4f8b9880aa776df25ff7dec8d0c.1.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviver.exe_0x24283ceb94d1a200a7aa2ccbf9055aab.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviver.exe_0x24283ceb94d1a200a7aa2ccbf9055aab.1.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviverUpdater.exe_0x5380e27300e910dcc051dc647ee61a46.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\DriverReviverUpdater.exe_0x5380e27300e910dcc051dc647ee61a46.1.manifest
- from <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe.manifest.__tmp__ to <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe.manifest
- from <Current directory>\Data\xsandbox.bin.__tmp__ to <Current directory>\Data\xsandbox.bin
- from <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe.__tmp__ to <Current directory>\Data\local\stubexe\0x746AB57E9E99B150\ReviverSoft Smart Monitor Service.exe
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\tray.exe_0x3333b6c073a28490f25aa8fe2c27cb4d.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\tray.exe_0x3333b6c073a28490f25aa8fe2c27cb4d.1.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x310553443e2010b2fc36deb8a6c91083.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\Uninstall.exe_0x310553443e2010b2fc36deb8a6c91083.1.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\SystemInfo-vc100-mt.dll_0x6cb3432dff1aed692bab879534fc9afa.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\SystemInfo-vc100-mt.dll_0x6cb3432dff1aed692bab879534fc9afa.2.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoft Smart Monitor Service.exe_0xe7227cac5fda9fa20e5e8d889686fe7f.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoft Smart Monitor Service.exe_0xe7227cac5fda9fa20e5e8d889686fe7f.1.manifest
- from %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoftSmartMonitor.exe_0x617d08c49cade226e403fedad0e5da0a.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x056B6DD7C6D89185\sxs\Manifests\ReviverSoftSmartMonitor.exe_0x617d08c49cade226e403fedad0e5da0a.1.manifest
Network activity:
Connects to:
- 'sv.##mcb.com':80
- 'ap#.##viversoft.com':80
- 'ss#.####le-analytics.com':443
- 'st###.spoon.net':443
- 'wp#d':80
- 'www.download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://sv.##mcb.com/sv.crt
- http://11#.#11.111.2/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
HTTP POST requests:
- http://ap#.##viversoft.com/license
UDP:
- DNS ASK sv.##mcb.com
- DNS ASK ap#.##viversoft.com
- DNS ASK ss#.####le-analytics.com
- DNS ASK st###.spoon.net
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MainWnd' WindowName: 'Driver Reviver'
