Trojan.Siggen18.31399

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\UltraISO\shell\open\command] '' = '"%ProgramFiles(x86)%\UltraISO\UltraISO.exe" "%1"'
[<HKLM>\Software\Classes\binimage\shell\open\command] '' = '"%ProgramFiles(x86)%\UltraISO\UltraISO.exe" "%1"'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ISODrive] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\ISODrive] 'ImagePath' = '%ProgramFiles(x86)%\UltraISO\drivers\ISODrv64.sys'

Creates the following services

'ISODrive' %ProgramFiles(x86)%\UltraISO\drivers\ISODrv64.sys

Modifies file system

Creates the following files

%TEMP%\rarsfx0\ultraiso.exe
%ProgramFiles(x86)%\ultraiso\lang\is-g5vcg.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-7mhf7.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-akq83.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-9olsk.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-3amsk.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-svlqr.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-qkq93.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-mr94l.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-s7mjm.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-dfhp6.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-99onu.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6mv1q.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-d3o4f.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-6n7k5.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-4po60.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-cit83.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-9959b.tmp
%HOMEPATH%\desktop\ultraiso.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\uninstall ultraiso.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso revision history.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso readme.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso web site.url
%ProgramFiles(x86)%\ultraiso\lang\is-d2010.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso online order.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso.lnk
%ProgramFiles(x86)%\ultraiso\lang\is-ofh24.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-1n2uh.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-7gk62.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-e4497.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-4niln.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-73trr.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-bdisl.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-efu4j.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-pqu11.tmp
%TEMP%\rarsfx0\hidcon.exe
%TEMP%\rarsfx0\install.cmd
%TEMP%\is-lo4r9.tmp\ultraiso.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_regdll.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_setup64.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_shfoldr.dll
%ProgramFiles(x86)%\ultraiso\is-6ndrj.tmp
%ProgramFiles(x86)%\ultraiso\is-q5kvb.tmp
%ProgramFiles(x86)%\ultraiso\is-rkbgf.tmp
%ProgramFiles(x86)%\ultraiso\is-pa2t8.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-fj1hf.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-a9irq.tmp
%ProgramFiles(x86)%\ultraiso\drivers\is-poa9n.tmp
%CommonProgramFiles(x86)%\ezb systems\is-nqbif.tmp
%TEMP%\rarsfx0\ultraiso.reg
%ProgramFiles(x86)%\ultraiso\is-59meg.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-lsa0i.tmp
%ProgramFiles(x86)%\ultraiso\is-l8bbv.tmp
%ProgramFiles(x86)%\ultraiso\is-7kklf.tmp
%ProgramFiles(x86)%\ultraiso\is-bfek8.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-kvhqe.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-5mgmi.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-vetlg.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultraiso\ultraiso help.lnk
%ProgramFiles(x86)%\ultraiso\lang\is-7v3bc.tmp
%ProgramFiles(x86)%\ultraiso\unins000.dat
%ProgramFiles(x86)%\ultraiso\lang\is-arafh.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-4brki.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-riihu.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-f4iq4.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-5e0da.tmp
%ProgramFiles(x86)%\ultraiso\lang\is-nqomc.tmp
%WINDIR%\temp\uddaa33.tmp

Deletes the following files

%WINDIR%\temp\uddaa33.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_regdll.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_setup64.tmp
%TEMP%\is-7jhvs.tmp\_isetup\_shfoldr.dll
%TEMP%\is-lo4r9.tmp\ultraiso.tmp
%TEMP%\rarsfx0\hidcon.exe
%TEMP%\rarsfx0\install.cmd
%TEMP%\rarsfx0\ultraiso.exe
%TEMP%\rarsfx0\ultraiso.reg

Moves the following files

from %ProgramFiles(x86)%\ultraiso\is-6ndrj.tmp to %ProgramFiles(x86)%\ultraiso\unins000.exe
from %ProgramFiles(x86)%\ultraiso\lang\is-4po60.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_yu.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-g5vcg.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_by.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-7mhf7.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_he.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-akq83.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_br.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-9olsk.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_dk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-3amsk.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_no.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-svlqr.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_lv.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-qkq93.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ar.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-mr94l.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_si.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-kvhqe.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_de.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-s7mjm.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_cn.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-99onu.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_et.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6mv1q.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_sk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-d3o4f.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ct.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-cit83.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_fi.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-9959b.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_mk.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-73trr.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_hr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-4niln.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ro.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-e4497.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_lt.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-7gk62.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_sr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-bdisl.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_kr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-6n7k5.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_gr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-efu4j.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_tr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-pqu11.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_bg.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-lsa0i.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ua.dll
from %ProgramFiles(x86)%\ultraiso\is-rkbgf.tmp to %ProgramFiles(x86)%\ultraiso\ultraiso.ico
from %ProgramFiles(x86)%\ultraiso\is-pa2t8.tmp to %ProgramFiles(x86)%\ultraiso\isoshl64.dll
from %ProgramFiles(x86)%\ultraiso\drivers\is-fj1hf.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isodrive.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-a9irq.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isodrv64.sys
from %ProgramFiles(x86)%\ultraiso\drivers\is-poa9n.tmp to %ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe
from %CommonProgramFiles(x86)%\ezb systems\is-nqbif.tmp to %CommonProgramFiles(x86)%\ezb systems\lame_enc.dll
from %ProgramFiles(x86)%\ultraiso\is-59meg.tmp to %ProgramFiles(x86)%\ultraiso\ultraiso.chm
from %ProgramFiles(x86)%\ultraiso\is-l8bbv.tmp to %ProgramFiles(x86)%\ultraiso\license.txt
from %ProgramFiles(x86)%\ultraiso\is-7kklf.tmp to %ProgramFiles(x86)%\ultraiso\readme.txt
from %ProgramFiles(x86)%\ultraiso\lang\is-1n2uh.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ir.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-dfhp6.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_tw.dll
from %ProgramFiles(x86)%\ultraiso\is-bfek8.tmp to %ProgramFiles(x86)%\ultraiso\history.txt
from %ProgramFiles(x86)%\ultraiso\lang\is-vetlg.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_it.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-7v3bc.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_es.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-d2010.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_pt.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-nqomc.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_nl.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-arafh.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_se.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-4brki.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_pl.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-riihu.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_cz.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-f4iq4.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_hu.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-5e0da.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_ru.dll
from %ProgramFiles(x86)%\ultraiso\is-q5kvb.tmp to %ProgramFiles(x86)%\ultraiso\ultraiso.exe
from %ProgramFiles(x86)%\ultraiso\lang\is-5mgmi.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_fr.dll
from %ProgramFiles(x86)%\ultraiso\lang\is-ofh24.tmp to %ProgramFiles(x86)%\ultraiso\lang\lang_jp.dll

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\hidcon.exe' install.cmd
'%TEMP%\rarsfx0\ultraiso.exe' /VERYSILENT
'%TEMP%\is-lo4r9.tmp\ultraiso.tmp' /SL5="$3023C,3135085,53248,%TEMP%\RarSFX0\UltraISO.exe" /VERYSILENT
'%ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe' -i
'%ProgramFiles(x86)%\ultraiso\drivers\isocmd.exe' -i' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c install.cmd
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\UltraISO\isoshl64.dll"
'%WINDIR%\syswow64\regedit.exe' /S ULTRAISO.reg

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial