Trojan.Siggen12.31162

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\UltraISO\shell\open\command] '' = '"%ProgramFiles(x86)%\UltraISO\UltraISO.exe" "%1"'
[<HKLM>\Software\Classes\binimage\shell\open\command] '' = '"%ProgramFiles(x86)%\UltraISO\UltraISO.exe" "%1"'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ISODrive] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\ISODrive] 'ImagePath' = '%ProgramFiles(x86)%\UltraISO\drivers\ISODrv64.sys'

Creates the following services

'ISODrive' %ProgramFiles(x86)%\UltraISO\drivers\ISODrv64.sys

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\cw.reg
%ProgramFiles(x86)%\ultraiso\lang\is-51b5a.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-jvppv.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-chi1i.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-30mvu.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-gq36l.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-mt50e.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-55uk6.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-jovpr.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-u1cjm.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-ue962.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6qa1v.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-cbcp7.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-15epn.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-el672.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-0ecm6.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-hec2t.tmp
C:\users\public\desktop\ultraiso.lnk
%ProgramFiles(x86)%\ultraiso\lang\is-knamd.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\uninstall ultraiso.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso revision history.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso readme.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso web site.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso online order.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso help.lnk
%ProgramFiles(x86)%\ultraiso\lang\is-h18p6.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso.lnk
%ProgramFiles(x86)%\ultraiso\lang\is-0p3b5.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-h4k78.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-e4bkn.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-ekqdf.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-3vr7f.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-1tqkn.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-jbndr.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-o9gqd.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-pgqf8.tmp
%ProgramFiles(x86)%\ultraiso\is-942rl.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-ttg7o.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-r7di8.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-khof0.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-eqooq.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-2orve.tmp
%ProgramFiles(x86)%\ultraiso\is-v1nq0.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-4a3de.tmp
%ProgramFiles(x86)%\ultraiso\is-t06ao.tmp
%TEMP%\is-g1ma2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-g1ma2.tmp\_isetup\_setup64.tmp
%TEMP%\is-dgpha.tmp\ui3.tmp
%TEMP%\7zipsfx.000\ui3.exe
%TEMP%\7zipsfx.000\cwtips.exe
%TEMP%\7zipsfx.000\installtips.ini
%ProgramFiles(x86)%\ultraiso\is-k85iv.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-r344t.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-7073m.tmp
%ProgramFiles(x86)%\ultraiso\is-kimlp.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-n4sim.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-a612i.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6lr9i.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-5q407.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-p48lq.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-pj61c.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6m8pt.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-4lihu.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-gocto.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-o4qtv.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6ggg8.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-j2vtv.tmp
%ProgramFiles(x86)%\ultraiso\is-ravpo.tmp
%ProgramFiles(x86)%\ultraiso\is-mgfei.tmp
%CommonProgramFiles(x86)%\ezb systems\is-528d3.tmp
%ProgramFiles(x86)%\ultraiso\unins000.dat

Deletes the following files

%TEMP%\is-g1ma2.tmp\_isetup\_setup64.tmp
%TEMP%\is-g1ma2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-dgpha.tmp\ui3.tmp
%TEMP%\7zipsfx.000\cw.reg
%TEMP%\7zipsfx.000\cwtips.exe
%TEMP%\7zipsfx.000\installtips.ini
%TEMP%\7zipsfx.000\ui3.exe

Moves the following files

from %ProgramFiles(x86)%\ultraiso\is-k85iv.tmp to %ProgramFiles(x86)%\ultraiso\unins000.exe
from %ProgramFiles(x86)%\ultraiso\lang\is-h18p6.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_gr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-el672.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_yu.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-15epn.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_by.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-cbcp7.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_he.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6qa1v.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_br.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-ue962.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_dk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-u1cjm.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_no.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-0ecm6.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_lv.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-jovpr.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ar.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-mt50e.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_si.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-gq36l.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_cn.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-chi1i.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_et.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-0p3b5.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_my.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-jvppv.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_sk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-51b5a.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ct.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-55uk6.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_fi.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-jbndr.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_mk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-o9gqd.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_hr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-knamd.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ro.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-1tqkn.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_lt.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-3vr7f.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_sr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-ekqdf.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ir.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-e4bkn.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_jp.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-h4k78.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_vn.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-pgqf8.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_kr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-30mvu.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_tw.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6m8pt.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_tr.dll
from %ProgramFiles(x86)%\ultraiso\is-mgfei.tmp to %ProgramFiles(x86)%\ultraiso\readme.txt
from %ProgramFiles(x86)%\ultraiso\is-t06ao.tmp to %ProgramFiles(x86)%\ultraiso\ultraiso.exe
from %ProgramFiles(x86)%\ultraiso\is-v1nq0.tmp to %ProgramFiles(x86)%\ultraiso\isoshl64.dll
from %ProgramFiles(x86)%\ultraiso\drivers\is-2orve.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isodrive.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-eqooq.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isodrv64.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-khof0.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe
from %ProgramFiles(x86)%\ultraiso\drivers\is-r7di8.tmp to %ProgramFiles(x86)%\ultraiso\drivers\bootpart.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-ttg7o.tmp to %ProgramFiles(x86)%\ultraiso\drivers\bootpt64.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-4a3de.tmp to %ProgramFiles(x86)%\ultraiso\drivers\bootpart.exe
from %CommonProgramFiles(x86)%\ezb systems\is-528d3.tmp to %CommonProgramFiles(x86)%\ezb systems\lame_enc.dll
from %ProgramFiles(x86)%\ultraiso\is-942rl.tmp to %ProgramFiles(x86)%\ultraiso\ultraiso.chm
from %ProgramFiles(x86)%\ultraiso\is-kimlp.tmp to %ProgramFiles(x86)%\ultraiso\license.txt
from %ProgramFiles(x86)%\ultraiso\is-ravpo.tmp to %ProgramFiles(x86)%\ultraiso\history.txt
from %ProgramFiles(x86)%\ultraiso\lang\is-n4sim.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ua.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-j2vtv.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_de.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6ggg8.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_fr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-o4qtv.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_it.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-gocto.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_es.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-r344t.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_pt.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-4lihu.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_nl.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-pj61c.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_se.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-p48lq.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_pl.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-5q407.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_cz.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6lr9i.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_hu.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-a612i.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ru.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-7073m.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_bg.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-hec2t.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_id.dll

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\cwtips.exe' /S
'%TEMP%\7zipsfx.000\ui3.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-dgpha.tmp\ui3.tmp' /SL5="$C00CC,3893326,126976,%TEMP%\7ZipSfx.000\ui3.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe' -i
'%TEMP%\7zipsfx.000\ui3.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' (with hidden window)
'%ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe' -i' (with hidden window)
'%WINDIR%\syswow64\regedit.exe' /S "cw.reg"' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\UltraISO\isoshl64.dll"
'%WINDIR%\syswow64\regedit.exe' /S "cw.reg"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial