Trojan.Siggen31.49482

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\installshieldВ® update service scheduler
<SYSTEM32>\tasks\optimize thumbnail cache files

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "ISUSPM.exe"

Modifies file system

Creates the following files

%TEMP%\is-fp5ct.tmp\<File name>.tmp
%TEMP%\is-orfvd.tmp\_isetup\_setup64.tmp
%TEMP%\is-orfvd.tmp\idp.dll
%TEMP%\is-r5d87.tmp\<File name>.tmp
%TEMP%\is-2umaf.tmp\_isetup\_setup64.tmp
%TEMP%\is-2umaf.tmp\idp.dll
%CommonProgramFiles(x86)%\installshield\update\is-glcao.tmp
%ALLUSERSPROFILE%\installshield\update\is-ot1ec.tmp
%TEMP%\is-2umaf.tmp\is-1smbo.tmp
%TEMP%\is-51si9.tmp\_setup.tmp
%TEMP%\setup log 2025-08-13 #001.txt
%TEMP%\is-a8b3n.tmp\_isetup\_setup64.tmp
%TEMP%\is-a8b3n.tmp\_isetup\_shfoldr.dll

Deletes the following files

%TEMP%\is-orfvd.tmp\idp.dll
%TEMP%\is-orfvd.tmp\_isetup\_setup64.tmp
%TEMP%\is-fp5ct.tmp\<File name>.tmp
<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723415083
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows defender\mpidletask
<SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask

Moves the following files

from %CommonProgramFiles(x86)%\installshield\update\is-glcao.tmp to %CommonProgramFiles(x86)%\installshield\update\isuspm.exe
from %ALLUSERSPROFILE%\installshield\update\is-ot1ec.tmp to %ALLUSERSPROFILE%\installshield\update\isuspm.ini
from %TEMP%\is-2umaf.tmp\is-1smbo.tmp to %TEMP%\is-2umaf.tmp\_setup.exe

Network activity

Connects to

'go.microsoft.com':80
'go.microsoft.com':443

TCP

HTTP GET requests

http://go.microsoft.com/fwlink/?Li###########

Other

'go.microsoft.com':443
'34.##9.100.209':443

UDP

DNS ASK go.microsoft.com
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\is-fp5ct.tmp\<File name>.tmp' /SL5="$50248,3598500,122880,<Full path to file>"
'%TEMP%\is-r5d87.tmp\<File name>.tmp' /SL5="$70196,3598500,122880,<Full path to file>" /VERYSILENT
'%TEMP%\is-2umaf.tmp\_setup.exe'
'%TEMP%\is-51si9.tmp\_setup.tmp' /SL5="$40284,2952592,69120,%TEMP%\is-2UMAF.tmp\_setup.exe"

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn * /f
'%WINDIR%\syswow64\sc.exe' delete isupdate.exe
'%WINDIR%\syswow64\sc.exe' delete ISUSPM.exe
'%WINDIR%\syswow64\sc.exe' delete msiupd.exe
'%WINDIR%\syswow64\sc.exe' delete router.exe
'%WINDIR%\syswow64\sc.exe' delete Updater.exe
'%WINDIR%\syswow64\sc.exe' delete updatesvc.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "InstallShieldÐÂ® Update Service Scheduler" /TR "'%CommonProgramFiles(x86)%\InstallShield\Update\ISUSPM.exe'"
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC WEEKLY /D WED,SUN /ST 12:00 /RL HIGHEST /TN "Optimize Thumbnail Cache Files" /TR "wscript.exe //nologo //E:jscript //B %ALLUSERSPROFILE%\InstallShield\Update\isuspm.ini"
'%WINDIR%\syswow64\taskkill.exe' /f /im "ISUSPM.exe"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn * /f' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete isupdate.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete ISUSPM.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete msiupd.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete router.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete Updater.exe' (with hidden window)
'%WINDIR%\syswow64\sc.exe' delete updatesvc.exe' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "InstallShieldÐÂ® Update Service Scheduler" /TR "'%CommonProgramFiles(x86)%\InstallShield\Update\ISUSPM.exe'"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /Create /F /SC WEEKLY /D WED,SUN /ST 12:00 /RL HIGHEST /TN "Optimize Thumbnail Cache Files" /TR "wscript.exe //nologo //E:jscript //B %ALLUSERSPROFILE%\InstallShield\Update\isuspm.ini"' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial