Trojan.Siggen19.47362

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\PowerISO\shell\open\command] '' = '"%ProgramFiles%\PowerISO\PowerISO.exe" "%1"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'PWRISOVM.EXE' = '%ProgramFiles%\PowerISO\PWRISOVM.EXE -startup'

Sets the following service settings

[<HKLM>\SYSTEM\CurrentControlSet\Services\SCDEmu] 'Start' = '00000001'

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM PowerISO.exe
'<SYSTEM32>\taskkill.exe' /F /IM PWRISOVM.exe

Modifies file system

Creates the following files

%TEMP%\83a.tmp\898.bat
%ProgramFiles%\poweriso\piso.exe
%ProgramFiles%\poweriso\lang\burmese.lng
%ProgramFiles%\poweriso\lang\finnish.lng
%ProgramFiles%\poweriso\lang\romanian.lng
%ProgramFiles%\poweriso\lang\urdu(pakistan).lng
%ProgramFiles%\poweriso\lang\azerbaijani.lng
%ProgramFiles%\poweriso\lang\farsi.lng
%ProgramFiles%\poweriso\lang\indonesian.lng
%ProgramFiles%\poweriso\lang\vietnamese.lng
%ProgramFiles%\poweriso\lang\slovak.lng
%ProgramFiles%\poweriso\lang\bosnian.lng
%ProgramFiles%\poweriso\lang\malay.lng
%ProgramFiles%\poweriso\lang\serbian(cyrl).lng
%ProgramFiles%\poweriso\lang\armenian.lng
%ProgramFiles%\poweriso\lang\kazakh.lng
%ProgramFiles%\poweriso\lang\belarusian.lng
%ProgramFiles%\poweriso\poweriso.exe
%ProgramFiles%\poweriso\license.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\poweriso\poweriso virtual drive manager.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\poweriso\poweriso.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\poweriso\poweriso help.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\poweriso\uninstall poweriso.lnk
%ProgramFiles%\poweriso\uninstall.exe
%ProgramFiles%\poweriso\pwrisovm.exe
%ProgramFiles%\poweriso\libflac.dll
%ProgramFiles%\poweriso\lame_enc.dll
%ProgramFiles%\poweriso\readme.txt
%ProgramFiles%\poweriso\poweriso.chm
%ProgramFiles%\poweriso\7z-x64.dll
%ProgramFiles%\poweriso\unrar64.dll
%ProgramFiles%\poweriso\libvorbis.dll
%ProgramFiles%\poweriso\macdll.dll
%ProgramFiles%\poweriso\pwrisosh.dll
%ProgramFiles%\poweriso\lang\croatian.lng
%ProgramFiles%\poweriso\lang\ukrainian.lng
%ProgramFiles%\poweriso\lang\danish.lng
%ProgramFiles%\poweriso\lang\italian.lng
%ProgramFiles%\poweriso\lang\tradchinese.lng
%ProgramFiles%\poweriso\lang\simpchinese.lng
<DRIVERS>\scdemu.sys
%TEMP%\nsc2973.tmp
%ProgramFiles%\poweriso\lang\french.lng
%ProgramFiles%\poweriso\setup64.exe
%TEMP%\nsc1f16.tmp\instopt.dll
%TEMP%\nsc1f16.tmp\system.dll
%TEMP%\nsx1ef6.tmp
%TEMP%\83a.tmp\poweriso8-x64.exe
%TEMP%\83a.tmp\poweriso8.exe
%TEMP%\83a.tmp\1.reg
%ProgramFiles%\poweriso\devcon.exe
%ProgramFiles%\poweriso\lang\arabic.lng
%ProgramFiles%\poweriso\lang\polish.lng
%ProgramFiles%\poweriso\lang\bulgarian.lng
%ProgramFiles%\poweriso\lang\thai.lng
%ProgramFiles%\poweriso\lang\russian.lng
%ProgramFiles%\poweriso\lang\dutch.lng
%ProgramFiles%\poweriso\lang\portuguese(brazil).lng
%ProgramFiles%\poweriso\lang\norsk.lng
%ProgramFiles%\poweriso\lang\swedish.lng
%ProgramFiles%\poweriso\lang\slovenian.lng
%ProgramFiles%\poweriso\lang\japanese.lng
%ProgramFiles%\poweriso\lang\german.lng
%ProgramFiles%\poweriso\lang\korean.lng
%ProgramFiles%\poweriso\lang\hungarian.lng
%ProgramFiles%\poweriso\lang\turkish.lng
%ProgramFiles%\poweriso\lang\spanish.lng
%ProgramFiles%\poweriso\lang\greek.lng
%ProgramFiles%\poweriso\lang\lithuanian.lng
%ProgramFiles%\poweriso\lang\czech.lng
C:\users\public\desktop\poweriso.lnk
%WINDIR%\temp\udd3458.tmp

Deletes the following files

%TEMP%\nsc2973.tmp
%TEMP%\nsc1f16.tmp\instopt.dll
%TEMP%\nsc1f16.tmp\system.dll
%WINDIR%\temp\udd3458.tmp
%TEMP%\83a.tmp\1.reg
%TEMP%\83a.tmp\poweriso8.exe
%TEMP%\83a.tmp\poweriso8-x64.exe
%TEMP%\83a.tmp\898.bat

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'SCDEMUAPP_C2C80BFA WNDCLASS' WindowName: ''
ClassName: 'SCDEMUAPP_C2C80BFB WNDCLASS' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\83a.tmp\poweriso8-x64.exe' /S
'%ProgramFiles%\poweriso\devcon.exe' remove *scdbusDevice
'%ProgramFiles%\poweriso\setup64.exe' cp %TEMP%\nsc2973.tmp "<DRIVERS>\scdemu.sys"
'%ProgramFiles%\poweriso\pwrisovm.exe' 999
'<SYSTEM32>\cmd.exe' /c "%TEMP%\83A.tmp\898.bat <Full path to file>"' (with hidden window)

Executes the following