Trojan.Siggen19.41857

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-usm3s.tmp\<File name>.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\unins000.dat
%ProgramFiles(x86)%\wshareaf\disk manager\order.url
%ProgramFiles(x86)%\wshareaf\disk manager\homepage.url
%ProgramFiles(x86)%\wshareaf\disk manager\is-rcded.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-03gfo.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-tk5is.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-u3ero.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-o4dic.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-li4lu.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-dc9qa.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-h7tqk.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-j1ogb.tmp
%WINDIR%\syswow64\drivers\is-fqmhb.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-j4vsc.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-c4her.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-pfp2j.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-qg076.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-usbdb.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-ap2fk.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-u0c7b.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-tevgn.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-thn5f.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\is-d7u88.tmp
%TEMP%\is-ibj0s.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ibj0s.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ibj0s.tmp\_isetup\_setup64.tmp
%TEMP%\is-ibj0s.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\wshareaf\disk manager\diskmanagergui.exe
%TEMP%\version.txt

Moves the following files

from %ProgramFiles(x86)%\wshareaf\disk manager\is-d7u88.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\unins000.exe
from %ProgramFiles(x86)%\wshareaf\disk manager\is-tk5is.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\wsconfig.ini
from %ProgramFiles(x86)%\wshareaf\disk manager\is-u3ero.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\liveupdate.exe
from %ProgramFiles(x86)%\wshareaf\disk manager\is-o4dic.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\outproc.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-li4lu.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\qtstartup.ini
from %ProgramFiles(x86)%\wshareaf\disk manager\is-dc9qa.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\diskmanagergui.exe
from %ProgramFiles(x86)%\wshareaf\disk manager\is-h7tqk.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\turbosearch.exe
from %ProgramFiles(x86)%\wshareaf\disk manager\is-j1ogb.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\wsdiskmanagerlib.dll
from %WINDIR%\syswow64\drivers\is-fqmhb.tmp to %WINDIR%\syswow64\drivers\sfilter.inf
from %ProgramFiles(x86)%\wshareaf\disk manager\is-j4vsc.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\ws_saleprocess.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-c4her.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\ws_log.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-pfp2j.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\ws_agentprocess.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-qg076.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\qtgui4.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-usbdb.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\qtcore4.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-ap2fk.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\msvcr90.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-u0c7b.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\msvcp90.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-tevgn.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\msvcm90.dll
from %ProgramFiles(x86)%\wshareaf\disk manager\is-thn5f.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\microsoft.vc90.crt.manifest
from %ProgramFiles(x86)%\wshareaf\disk manager\is-03gfo.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\liveupdate.ini
from %ProgramFiles(x86)%\wshareaf\disk manager\is-rcded.tmp to %ProgramFiles(x86)%\wshareaf\disk manager\language_en.qm

Network activity

Connects to

'jo####rdmust.sbs':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########

HTTP POST requests

http://jo####rdmust.sbs/new/net_api

UDP

DNS ASK jo####rdmust.sbs

Miscellaneous

Searches for the following windows

ClassName: '{7e1265422a733618bbe81452A6c793b6}' WindowName: ''

Creates and executes the following

'%TEMP%\is-usm3s.tmp\<File name>.tmp' /SL5="$D00F4,8589241,54272,<Full path to file>"
'%ProgramFiles(x86)%\wshareaf\disk manager\diskmanagergui.exe'
'%ProgramFiles(x86)%\wshareaf\disk manager\diskmanagergui.exe' eae8c7cea8c1a3116e52c53b21616c97

Executes the following