The user-space program loads the driver and then pops up an advertisement every 30 seconds. The driver hides the process by unlinking the Process Environment Block (PEB) from the system’s linked list.
Once this program is running, there is no easy way to stop it without rebooting.
The kernel component responds to any
request by unlinking the process that made the request from the linked list of processes in order to
hide the process from the user.
We begin with some basic static analysis on the files. When we analyze the driver file, we see the following imports:
IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink RtlInitUnicodeString IoGetCurrentProcess IoCreateSymbolicLink IoCreateDevice ...