PUA.Win32.IfueFix.MG

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %User Temp%\bcdboot.exe → Genuine Microsoft Windows 8 Boot Configuration Data Boot Tool (v6.2.9200.16384) used for UEFI/BIOS boot environment initialization
• %User Temp%\bcdedit.exe → Genuine Microsoft Windows 8 Boot Configuration Data Editor (v6.2.9200.16384) used for modifying boot configuration stores
• %User Temp%\bootsect.exe → Genuine Microsoft Windows 8 Boot Sector Manipulation Tool (v6.2.9200.16384) used for updating volume boot codes
• %User Temp%\MountESP.exe → 32-bit administrative helper utility authored by clonecd @MoHong used to mount the hidden EFI System Partition (ESP) using DefineDosDeviceA
• %User Temp%\MountESP64.exe → 64-bit administrative helper utility authored by clonecd @MoHong used to mount the hidden EFI System Partition (ESP) on x64 systems
• %User Temp%\MSVFW32.DLL → Genuine Microsoft Windows Server 2003 SP2 Video for Windows system library (v5.2.3790.3959)
• %User Temp%\runuefix.exe → Primary 32-bit graphical orchestrator compiled with Easy Language (易语言) and packed with UPX that coordinates ESP mounting and BCD repair routines

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "{malware path}\{malware name}" → Initial 7-Zip SFX container executed to extract payload files
• "%User Temp%\runuefix.exe" → Main GUI process executed automatically by the 7-Zip SFX wrapper
• "%System%\cmd.exe" /k @ECHO 提示： 控制启动管理器:bcdedit 主启动代码更新:bootsect 启动文件修复：bcdboot → Interactive command prompt spawned when clicking the "命令提示符" button
• "%User Temp%\MountESP.EXE" → Helper process spawned when clicking the "挂载ESP分区" button to mount the EFI partition on 32-bit systems (or MountESP64.EXE on 64-bit systems)
• "%User Temp%\bcdboot.exe" C:\Windows /l {selected language} /s {Drive}: /f uefi → Boot repair command spawned when clicking the "开始修复" button

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Multimedia\DrawDib
{display_driver} {resolution}x{depth}(BGR 0) = `31,31,31,31`