Trojan.Siggen22.20713

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\SpaceRacesEX] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\SpaceRacesEX] 'ImagePath' = '%ALLUSERSPROFILE%\SpaceRacesEX\SpaceRacesEX.exe'

Creates the following services

'SpaceRacesEX' %ALLUSERSPROFILE%\SpaceRacesEX\SpaceRacesEX.exe

Modifies file system

Creates the following files

%TEMP%\is-vbtb0.tmp\<File name>.tmp
%ALLUSERSPROFILE%\spaceracesex\spaceracesex.exe
%CommonProgramFiles(x86)%\qt5opengl\qt5opengl.exe
%CommonProgramFiles(x86)%\qt5opengl\unins000.dat
%CommonProgramFiles(x86)%\qt5opengl\is-j09mb.tmp
%CommonProgramFiles(x86)%\qt5opengl\uitext\is-devof.tmp
%CommonProgramFiles(x86)%\qt5opengl\uitext\is-re0ko.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-jka18.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-6436d.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-q8mpt.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-44ggr.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-276g9.tmp
%ALLUSERSPROFILE%\ts.dat
%CommonProgramFiles(x86)%\qt5opengl\is-pv3mq.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-8goac.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-tcbl6.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-ma5eq.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-punkp.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-n2jak.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-ga3o8.tmp
%TEMP%\is-ovf9k.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ovf9k.tmp\_isetup\_isdecmp.dll
%TEMP%\is-ovf9k.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ovf9k.tmp\_isetup\_setup64.tmp
%TEMP%\is-ovf9k.tmp\_isetup\_regdll.tmp
%CommonProgramFiles(x86)%\qt5opengl\is-u33ui.tmp
%ALLUSERSPROFILE%\resource.dat

Deletes the following files

%CommonProgramFiles(x86)%\qt5opengl\vorbis1.dll

Moves the following files

from %CommonProgramFiles(x86)%\qt5opengl\is-ga3o8.tmp to %CommonProgramFiles(x86)%\qt5opengl\unins000.exe
from %CommonProgramFiles(x86)%\qt5opengl\is-n2jak.tmp to %CommonProgramFiles(x86)%\qt5opengl\flac.dll
from %CommonProgramFiles(x86)%\qt5opengl\is-punkp.tmp to %CommonProgramFiles(x86)%\qt5opengl\ogg.dll
from %CommonProgramFiles(x86)%\qt5opengl\is-ma5eq.tmp to %CommonProgramFiles(x86)%\qt5opengl\opus1.dll
from %CommonProgramFiles(x86)%\qt5opengl\is-tcbl6.tmp to %CommonProgramFiles(x86)%\qt5opengl\vorbis1.dll
from %CommonProgramFiles(x86)%\qt5opengl\is-u33ui.tmp to %CommonProgramFiles(x86)%\qt5opengl\nami.ini
from %CommonProgramFiles(x86)%\qt5opengl\is-pv3mq.tmp to %CommonProgramFiles(x86)%\qt5opengl\nami.preset
from %CommonProgramFiles(x86)%\qt5opengl\is-276g9.tmp to %CommonProgramFiles(x86)%\qt5opengl\readme.txt
from %CommonProgramFiles(x86)%\qt5opengl\is-44ggr.tmp to %CommonProgramFiles(x86)%\qt5opengl\nami.chm
from %CommonProgramFiles(x86)%\qt5opengl\is-q8mpt.tmp to %CommonProgramFiles(x86)%\qt5opengl\volctl.dll
from %CommonProgramFiles(x86)%\qt5opengl\is-6436d.tmp to %CommonProgramFiles(x86)%\qt5opengl\volctl.exe
from %CommonProgramFiles(x86)%\qt5opengl\is-jka18.tmp to %CommonProgramFiles(x86)%\qt5opengl\uninst.dll
from %CommonProgramFiles(x86)%\qt5opengl\uitext\is-re0ko.tmp to %CommonProgramFiles(x86)%\qt5opengl\uitext\en.txt
from %CommonProgramFiles(x86)%\qt5opengl\uitext\is-devof.tmp to %CommonProgramFiles(x86)%\qt5opengl\uitext\ja.txt
from %CommonProgramFiles(x86)%\qt5opengl\is-j09mb.tmp to %CommonProgramFiles(x86)%\qt5opengl\qt5opengl.exe

Substitutes the following files

%CommonProgramFiles(x86)%\qt5opengl\vorbis1.dll

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'fa7c79_QT11302FlashFixClass_fa7c79'

Creates and executes the following

'%TEMP%\is-vbtb0.tmp\<File name>.tmp' /SL5="$9024A,3099853,54272,<Full path to file>"
'%CommonProgramFiles(x86)%\qt5opengl\qt5opengl.exe' -i
'%CommonProgramFiles(x86)%\qt5opengl\qt5opengl.exe' -s

Executes the following