Trojan.MulDrop11.54248

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Classes\PowerISO\shell\open\command] '' = '"%TEMP%\7ZipSfx.000\App\PowerISO64\PowerISO.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\app\appinfo\appicon.ico
%TEMP%\7zipsfx.000\app\poweriso64\lame_enc.dll
%TEMP%\7zipsfx.000\app\poweriso64\devcon.exe
%TEMP%\7zipsfx.000\app\poweriso64\7z-x64.dll
%TEMP%\7zipsfx.000\app\defaultdata\settings\scdemu64.sys
%TEMP%\7zipsfx.000\app\defaultdata\settings\scdemu.sys
%TEMP%\7zipsfx.000\powerisoportable.ini
%TEMP%\7zipsfx.000\data\settings\powerisoportablesettings.ini
%TEMP%\7zipsfx.000\data\settings\poweriso.reg
%TEMP%\7zipsfx.000\app\poweriso64\libflac.dll
%TEMP%\7zipsfx.000\app\poweriso64\poweriso.chm
%TEMP%\7zipsfx.000\app\poweriso64\lang\urdu(pakistan).lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\ukrainian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\turkish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\tradchinese.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\thai.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\swedish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\spanish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\slovenian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\vietnamese.lng
%TEMP%\nskb563.tmp
%TEMP%\nsvb5a3.tmp\stdutils.dll
%TEMP%\7zipsfx.000\app\poweriso64\piso.exe
%TEMP%\nsvb5a3.tmp\execdos.dll
%TEMP%\nsvb5a3.tmp\registry.dll
%TEMP%\nsvb5a3.tmp\runtimedata.ini
%TEMP%\7zipsfx.000\data\portableapps.comlauncherruntimedata-powerisoportable.ini
%TEMP%\7zipsfx.000\data\settings\poweriso.reg.oldreplaceinfile
%TEMP%\nsvb5a3.tmp\newtextreplace.dll
%APPDATA%\microsoft\windows\sendto\poweriso.lnk
%TEMP%\nsvb5a3.tmp\launcher.ini
%TEMP%\7zipsfx.000\app\poweriso64\lang\slovak.lng
%TEMP%\nsvb5a3.tmp\system.dll
%TEMP%\7zipsfx.000\pwrisovmportable.exe
%TEMP%\7zipsfx.000\powerisoportable.exe
%TEMP%\7zipsfx.000\app\poweriso64\unrar64.dll
%TEMP%\7zipsfx.000\app\poweriso64\setup64.exe
%TEMP%\7zipsfx.000\app\poweriso64\pwrisovm.exe
%TEMP%\7zipsfx.000\app\poweriso64\pwrisosh64.dll
%TEMP%\7zipsfx.000\app\poweriso64\pwrisosh.dll
%TEMP%\7zipsfx.000\app\poweriso64\poweriso.exe
%TEMP%\7zipsfx.000\app\poweriso64\libvorbis.dll
%TEMP%\7zipsfx.000\app\poweriso64\macdll.dll
%TEMP%\7zipsfx.000\app\poweriso64\lang\simpchinese.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\czech.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\bulgarian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\bosnian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\belarusian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\azerbaijani.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\armenian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\arabic.lng
%TEMP%\7zipsfx.000\app\poweriso64\$r0
%TEMP%\7zipsfx.000\app\defaultdata\settings\poweriso.reg
%TEMP%\7zipsfx.000\app\poweriso64\lang\burmese.lng
%TEMP%\7zipsfx.000\app\appinfo\launcher\powerisoportable.ini
%TEMP%\7zipsfx.000\app\appinfo\appinfo.ini
%TEMP%\7zipsfx.000\app\appinfo\appicon_32.png
%TEMP%\7zipsfx.000\app\appinfo\appicon_16.png
%TEMP%\7zipsfx.000\app\appinfo\appicon_128.png
%TEMP%\7zipsfx.000\app\appinfo\appicon2_32.png
%TEMP%\7zipsfx.000\app\appinfo\appicon2_16.png
%TEMP%\7zipsfx.000\app\appinfo\appicon2_128.png
%TEMP%\7zipsfx.000\app\appinfo\appicon2.ico
%TEMP%\7zipsfx.000\app\appinfo\launcher\custom.nsh
%TEMP%\7zipsfx.000\app\poweriso64\lang\italian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\russian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\danish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\romanian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\portuguese(brazil).lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\polish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\norsk.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\malay.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\lithuanian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\korean.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\kazakh.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\serbian(cyrl).lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\japanese.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\indonesian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\hungarian.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\greek.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\german.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\french.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\finnish.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\farsi.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\dutch.lng
%TEMP%\7zipsfx.000\app\poweriso64\lang\croatian.lng
%TEMP%\$poweriso$\edb8.tmp.ico

Deletes the following files

%TEMP%\7zipsfx.000\data\settings\poweriso.reg
%TEMP%\$poweriso$\edb8.tmp.ico

Substitutes the following files

%TEMP%\7zipsfx.000\data\settings\poweriso.reg

Miscellaneous

Searches for the following windows

ClassName: 'SCDEMUAPP_C2C80BFB WNDCLASS' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\powerisoportable.exe'
'%TEMP%\7zipsfx.000\app\poweriso64\poweriso.exe'
'%WINDIR%\syswow64\reg.exe' IMPORT "%TEMP%\7ZipSfx.000\Data\settings\PowerISO.reg"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\reg.exe' IMPORT "%TEMP%\7ZipSfx.000\Data\settings\PowerISO.reg"
'<SYSTEM32>\regsvr32.exe' /s /u "%TEMP%\7ZipSfx.000\App\PowerISO64\PWRISOSH.DLL"