PUP.OmniTweak

The detection of PUP.OmniTweak on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is PUP.OmniTweak?

PUP.OmniTweak is a type of malware that is classified as a potentially unwanted program. This means that it is not necessarily a virus or a trojan, but rather a program that may be installed on your system without your knowledge or consent. PUPs like PUP.OmniTweak can be bundled with other software, downloaded from the internet, or installed through exploited vulnerabilities. They often exhibit behaviors that are annoying, disruptive, or even malicious, such as displaying unwanted ads, collecting user data, or modifying system settings.

How PUP.OmniTweak Operates

Once installed, PUP.OmniTweak can operate in various ways to achieve its goals. It may use tactics like browser hijacking, where it modifies your browser's settings to display unwanted content or redirect you to suspicious websites. It may also employ techniques like data collection, where it gathers information about your browsing habits, search queries, or personal data. In some cases, PUPs like PUP.OmniTweak can even download and install additional malware or unwanted software on your system, leading to further complications and security risks.

Symptoms of Infection

The symptoms of a PUP.OmniTweak infection can vary, but common signs include unwanted ads or pop-ups, slower system performance, modified browser settings, and unfamiliar programs or toolbars installed on your system. You may also notice that your browser is being redirected to suspicious websites, or that your search results are being altered. In some cases, you may even receive fake alerts or warnings, claiming that your system is infected with malware or that you need to update your software.

How to Remove PUP.OmniTweak

1. Boot your system in Safe Mode with Networking to prevent PUP.OmniTweak from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious components related to PUP.OmniTweak.
3. Uninstall any suspicious programs or software that you don't recognize or that were installed without your consent.
4. Reset your browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by PUP.OmniTweak.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that all remnants of PUP.OmniTweak have been removed.

Conclusion

Removing PUP.OmniTweak from your system is crucial to prevent further damage and protect your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a healthy state. Remember to always be cautious when downloading software or clicking on links from unknown sources, and to keep your anti-malware tools and operating system up to date to prevent similar infections in the future.

Analysis Report

General information

Family Name:	PUP.OmniTweak
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: bf56c52618efdbe595dda65c2dbe0d47 SHA1: 1abc52074bf7c200b06ebb09b898328bb5c1faab SHA256: 051C8AEADD77990426BF0E17FAE4DF4465C3B714CC8005A6615D5092E3A2FFFA File Size: 5.88 MB, 5881016 bytes

MD5: 88b80e2436067f58e0689892cb9025b2 SHA1: 258427cd48565ec0b649105512368619968d9afe SHA256: E7B436E2AF217376A342D1E30341A4418D6DEB34CD926AB1215E9C8723FD4070 File Size: 3.53 MB, 3531136 bytes

MD5: b7340e3430f269626f39a3a7bd4a626b SHA1: 97a5b1b922c04b617f9dc14604983dcfd0462c51 SHA256: 6C7943D54A1C56A9D0B9486D1AA3F580DB40521CBA4609ED5690EB8B07DEE3CC File Size: 5.99 MB, 5986376 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup. This installation was built with InstallAware: http://www.installaware.com
File Description	DriverUpdaterPro Installation DriverUpdater Setup
File Version	10.1.0.31 10.0.0.0
Legal Copyright	All rights reserved
Product Name	DriverUpdater DriverUpdaterPro
Product Version	10.1.0.31 10.0.0.0 0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
oTweak Software, LLC	GlobalSign	Root Not Trusted
oTweak Software LLC	thawte Primary Root CA	Root Not Trusted

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-kcj8p.tmp\258427cd48565ec0b649105512368619968d9afe_0003531136.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\lang.loc	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mia.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mia1\installaware.png	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mia51e0.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\driverupdaterpro.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\driverupdaterpro.msi	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\192815f8	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\192815f8\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\192815f8\c34f8049\lsvgauge_d2009.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\192815f8\c34f8049\lsvgauge_d2009.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2a07891a	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2a07891a\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2a07891a\c34f8049\xmlrtl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2a07891a\c34f8049\xmlrtl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2aa630a	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2aa630a\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2aa630a\c34f8049\rtflabel_d7.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\2aa630a\c34f8049\rtflabel_d7.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35d6aa01	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35d6aa01\b13d7bc4	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35d6aa01\b13d7bc4\unzip32.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35d6aa01\b13d7bc4\unzip32.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35e820c1	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35e820c1\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35e820c1\c34f8049\rtl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\35e820c1\c34f8049\rtl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3897f479	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3897f479\71b86121	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3897f479\71b86121\ins64.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3897f479\71b86121\ins64.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3fdca6ce	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3fdca6ce\71b86121	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3fdca6ce\71b86121\ins32.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\3fdca6ce\71b86121\ins32.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\415f9294	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\415f9294\6373bd03	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\415f9294\6373bd03\driverupdaterpro.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\415f9294\6373bd03\driverupdaterpro.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\42804292	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\42804292\b13d7bc4	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\42804292\b13d7bc4\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\42804292\b13d7bc4\unzip.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\4fa164fc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\4fa164fc\5dd183bc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\4fa164fc\5dd183bc\segoeuib.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\4fa164fc\5dd183bc\segoeuib.ttf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\52726af2	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\52726af2\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\52726af2\c34f8049\aff.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\52726af2\c34f8049\aff.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8d3bb745	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8d3bb745\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8d3bb745\c34f8049\inet200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8d3bb745\c34f8049\inet200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8e2fe17d	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8e2fe17d\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8e2fe17d\c34f8049\vclimg200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\8e2fe17d\c34f8049\vclimg200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9b3ea70e	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9b3ea70e\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9b3ea70e\c34f8049\tbuttonlabel.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9b3ea70e\c34f8049\tbuttonlabel.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9c192fea	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9c192fea\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9c192fea\c34f8049\const.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\9c192fea\c34f8049\const.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a1267bf8	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a1267bf8\6373bd03	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a1267bf8\6373bd03\dupsys.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a1267bf8\6373bd03\dupsys.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a5ef998b	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a5ef998b\5dd183bc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a5ef998b\5dd183bc\segoeui.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\a5ef998b\5dd183bc\segoeui.ttf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\b89e9544	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\b89e9544\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\b89e9544\c34f8049\lang.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\b89e9544\c34f8049\lang.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\ba7ffb98	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\ba7ffb98\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\ba7ffb98\c34f8049\vclx200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\ba7ffb98\c34f8049\vclx200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\f5200477	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\f5200477\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\f5200477\c34f8049\vcl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\f5200477\c34f8049\vcl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\mmsi.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\mmsi.dll\mmsiexec.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\offline\mmsi.dll\mmsiexec.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\{5f207e73-153d-47f5-bf8f-6c4dc4575783}	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\data\{5f207e73-153d-47f5-bf8f-6c4dc4575783}	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.msi	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.res	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\driverupdaterpro.res	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\mia.lib	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia51e0.tmp\mia.lib	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\driverupdaterpro.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\driverupdaterpro.msi	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\192815f8	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\192815f8\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\192815f8\c34f8049\lsvgauge_d2009.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\192815f8\c34f8049\lsvgauge_d2009.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2a07891a	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2a07891a\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2a07891a\c34f8049\xmlrtl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2a07891a\c34f8049\xmlrtl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2aa630a	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2aa630a\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2aa630a\c34f8049\rtflabel_d7.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\2aa630a\c34f8049\rtflabel_d7.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35d6aa01	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35d6aa01\b13d7bc4	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35d6aa01\b13d7bc4\unzip32.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35d6aa01\b13d7bc4\unzip32.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35e820c1	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35e820c1\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35e820c1\c34f8049\rtl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\35e820c1\c34f8049\rtl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\3897f479	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\3897f479\71b86121	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\3897f479\71b86121\ins64.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\3897f479\71b86121\ins64.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\415f9294	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\415f9294\6373bd03	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\415f9294\6373bd03\driverupdaterpro.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\415f9294\6373bd03\driverupdaterpro.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\42804292	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\42804292\b13d7bc4	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\42804292\b13d7bc4\unzip.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\42804292\b13d7bc4\unzip.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\4fa164fc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\4fa164fc\5dd183bc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\4fa164fc\5dd183bc\segoeuib.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\4fa164fc\5dd183bc\segoeuib.ttf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8d3bb745	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8d3bb745\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8d3bb745\c34f8049\inet200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8d3bb745\c34f8049\inet200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8e2fe17d	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8e2fe17d\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8e2fe17d\c34f8049\vclimg200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\8e2fe17d\c34f8049\vclimg200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9b3ea70e	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9b3ea70e\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9b3ea70e\c34f8049\tbuttonlabel.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9b3ea70e\c34f8049\tbuttonlabel.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9c192fea	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9c192fea\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9c192fea\c34f8049\const.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\9c192fea\c34f8049\const.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a1267bf8	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a1267bf8\6373bd03	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a1267bf8\6373bd03\dupsys.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a1267bf8\6373bd03\dupsys.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a5ef998b	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a5ef998b\5dd183bc	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a5ef998b\5dd183bc\segoeui.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\a5ef998b\5dd183bc\segoeui.ttf	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\b89e9544	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\b89e9544\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\b89e9544\c34f8049\lang.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\b89e9544\c34f8049\lang.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\ba7ffb98	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\ba7ffb98\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\ba7ffb98\c34f8049\vclx200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\ba7ffb98\c34f8049\vclx200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\f5200477	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\f5200477\c34f8049	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\f5200477\c34f8049\vcl200.bpl	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\f5200477\c34f8049\vcl200.bpl	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\mmsi.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\mmsi.dll\mmsiexec.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\offline\mmsi.dll\mmsiexec.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\{5f207e73-153d-47f5-bf8f-6c4dc4575783}	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\data\{5f207e73-153d-47f5-bf8f-6c4dc4575783}	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.msi	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.msi	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.res	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\driverupdaterpro.res	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\mia.lib	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\mia561f.tmp\mia.lib	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\classes\applications\1abc52074bf7c200b06ebb09b898328bb5c1faab_0005881016::ishostapp		RegNtPreCreateKey
HKLM\software\classes\applications\driverupdaterpro.exe::ishostapp		RegNtPreCreateKey
HKLM\software\classes\applications\97a5b1b922c04b617f9dc14604983dcfd0462c51_0005986376::ishostapp		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Other Suspicious	AdjustTokenPrivileges
User Data Access	GetUserObjectInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

.\DriverUpdaterPro.exe /m="c:\users\user\DOWNLO~1\1ABC52~1" /k=""

"C:\Users\Esflnlas\AppData\Local\Temp\is-KCJ8P.tmp\258427cd48565ec0b649105512368619968d9afe_0003531136.tmp" /SL5="$10272,3109499,72192,c:\users\user\downloads\258427cd48565ec0b649105512368619968d9afe_0003531136"

.\DriverUpdaterPro.exe /m="c:\users\user\DOWNLO~1\97A5B1~1" /k=""