Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PWRISOVM.EXE' = '%PROGRAM_FILES%\PowerISO\PWRISOVM.EXE -startup'
- [<HKLM>\SOFTWARE\Classes\PowerISO\shell\open\command] '' = '%PROGRAM_FILES%\PowerISO\PowerISO.exe "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\SCDEmu] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsvA.exe'
- '%PROGRAM_FILES%\PowerISO\PWRISOVM.EXE' 999
- '%TEMP%\SPIdentifier.exe'
- '%CommonProgramFiles%\Setup.exe' /S
- '%TEMP%\nsq6.tmp.exe' -setup0
- '%TEMP%\nsvA.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\PowerISO\PWRISOSH.DLL"
- '<SYSTEM32>\regsvr32.exe' /s /u "%PROGRAM_FILES%\PowerISO\PWRISOSH.DLL"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\PowerISO\Lang\Bosnian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Slovak.lng
- %PROGRAM_FILES%\PowerISO\Lang\Serbian(cyrl).lng
- %PROGRAM_FILES%\PowerISO\Lang\Malay.lng
- %PROGRAM_FILES%\PowerISO\Lang\Vietnamese.lng
- %PROGRAM_FILES%\PowerISO\Lang\Azerbaijani.lng
- %PROGRAM_FILES%\PowerISO\Lang\Urdu(Pakistan).lng
- %PROGRAM_FILES%\PowerISO\Lang\kazakh.lng
- %PROGRAM_FILES%\PowerISO\Lang\Indonesian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Thai.lng
- %PROGRAM_FILES%\PowerISO\Lang\danish.lng
- %PROGRAM_FILES%\PowerISO\Lang\Portuguese(Brazil).lng
- %PROGRAM_FILES%\PowerISO\Lang\Dutch.lng
- %PROGRAM_FILES%\PowerISO\Lang\Ukrainian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Belarusian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Armenian.lng
- %PROGRAM_FILES%\PowerISO\Lang\croatian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Farsi.lng
- %PROGRAM_FILES%\PowerISO\uninstall.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\PowerISO\Uninstall PowerISO.lnk
- %PROGRAM_FILES%\PowerISO\PWRISOSH.DLL
- %PROGRAM_FILES%\PowerISO\PWRISOVM.EXE
- %ALLUSERSPROFILE%\Start Menu\Programs\PowerISO\PowerISO Help.lnk
- %ALLUSERSPROFILE%\Desktop\PowerISO.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\thankyou[1].htm
- %ALLUSERSPROFILE%\Start Menu\Programs\PowerISO\PowerISO.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PowerISO\PowerISO Virtual Drive Manager.lnk
- %PROGRAM_FILES%\PowerISO\lame_enc.dll
- %PROGRAM_FILES%\PowerISO\libFLAC.dll
- %PROGRAM_FILES%\PowerISO\piso.exe
- %PROGRAM_FILES%\PowerISO\PowerISO.exe
- %PROGRAM_FILES%\PowerISO\MACDll.dll
- %PROGRAM_FILES%\PowerISO\License.txt
- %PROGRAM_FILES%\PowerISO\History.txt
- %PROGRAM_FILES%\PowerISO\PowerISO.chm
- %PROGRAM_FILES%\PowerISO\Readme.txt
- %TEMP%\PowerISO_Setup.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\SPIdentifierImpl[1].exe
- %TEMP%\nsa8.tmp
- %TEMP%\nsk9.tmp\inetc.dll
- %TEMP%\nsvA.exe
- %PROGRAM_FILES%\PowerISO\Lang\SimpChinese.lng
- %PROGRAM_FILES%\PowerISO\Lang\TradChinese.lng
- %TEMP%\nsq5.tmp\System.dll
- <DRIVERS>\scdemu.sys
- %TEMP%\aut2.tmp
- %CommonProgramFiles%\Setup.exe
- %TEMP%\aut1.tmp
- %TEMP%\cvdwwhz
- %TEMP%\nsq4.tmp
- %TEMP%\SPIdentifier.exe
- %TEMP%\sp-downloader.exe
- %TEMP%\nsq5.tmp\InstOpt.dll
- %TEMP%\nsq6.tmp.exe
- %PROGRAM_FILES%\PowerISO\Lang\Hungarian.lng
- %PROGRAM_FILES%\PowerISO\Lang\German.lng
- %PROGRAM_FILES%\PowerISO\Lang\Spanish.lng
- %PROGRAM_FILES%\PowerISO\Lang\Turkish.lng
- %PROGRAM_FILES%\PowerISO\Lang\Russian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Swedish.lng
- %PROGRAM_FILES%\PowerISO\Lang\Norsk.lng
- %PROGRAM_FILES%\PowerISO\Lang\Japanese.lng
- %PROGRAM_FILES%\PowerISO\Lang\Slovenian.lng
- %PROGRAM_FILES%\PowerISO\Lang\french.lng
- %PROGRAM_FILES%\PowerISO\Lang\Arabic.lng
- %PROGRAM_FILES%\PowerISO\Lang\italian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Polish.lng
- %PROGRAM_FILES%\PowerISO\Lang\Bulgarian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Lithuanian.lng
- %PROGRAM_FILES%\PowerISO\Lang\Greek.lng
- %PROGRAM_FILES%\PowerISO\Lang\Korean.lng
- %PROGRAM_FILES%\PowerISO\Lang\czech.lng
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\Setup.exe
Deletes the following files:
- %TEMP%\nsq5.tmp\InstOpt.dll
- %TEMP%\nsk9.tmp\inetc.dll
- %CommonProgramFiles%\Setup.exe
- %TEMP%\nsq5.tmp\System.dll
- %TEMP%\cvdwwhz
- %TEMP%\aut1.tmp
- %TEMP%\nsvA.exe
- %TEMP%\aut2.tmp
Network activity:
Connects to:
- 'localhost':1040
- 'sp#######e.conduit-services.com':80
- 'www.po###iso.com':80
TCP:
HTTP GET requests:
- www.po###iso.com/thankyou.htm
- sp#######e.conduit-services.com/spidentifier/SPIdentifierImpl.exe
- www.po###iso.com/getip.php
UDP:
- DNS ASK sp#######e.conduit-services.com
- DNS ASK www.po###iso.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'SCDEMUAPP_C2C80BFA WNDCLASS' WindowName: '(null)'
- ClassName: 'SCDEMUAPP_C2C80BFB WNDCLASS' WindowName: '(null)'
