Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\sc-869f49fc91e50a8f\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe" "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (869f49fc91e50a8f)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe" "?e=Access...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (869f49fc91e50a8f)] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe' "RunRole" "a03b49cb-760f-4db5-8f5a-fc5af2c4b18b" "User"
- '%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=instance-bwos3k-relay.screenconnect.com&p=443&s=b831ffdc-c042-4181-b04d-1cb7f1a1add9&k=BgIAAACkAABSU0ExAAgAAAEAAQARXq0IXuJskyAUJvs%2b2B5iJgJ3t1P%2fDbvo7KrurQL6eDBBjS2YufRSo...
Запускает на исполнение:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_143578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' -Embedding A7C7B71C31865077D9C93303CF9F9663
- '<SYSTEM32>\msiexec.exe' -Embedding 56E9C0034ECE4D26F8BA5385E9A7AD42 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 32C05781D0DC865FE1056E46F31827D9 C
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.dll
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Client.dll
- C:\Config.Msi\24946.rbs
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Windows.dll
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Core.dll
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe.config
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\40rblmdu.newcfg
- %TEMP%\~DF7FCB.tmp
- %WINDIR%\Installer\{216B431F-1A90-419C-94B6-2D70C7CACC3F}\DefaultIcon
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\s3wwwq2y.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\o0btp4lk.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\1niayvcd.newcfg
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\Client.resources
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\Client.en-US.resources
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe
- %WINDIR%\Installer\24947.msi
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\MSI1.tmp
- %TEMP%\20edb.msi
- %TEMP%\setup.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\24944.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %TEMP%\~DFF55F.tmp
- %WINDIR%\Installer\24945.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\24946.rbs
- %TEMP%\20edb.msi
- %WINDIR%\Installer\24945.ipi
- %WINDIR%\Installer\24944.msi
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI1.tmp
Перемещает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\o0btp4lk.newcfg в %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\s3wwwq2y.newcfg в %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\40rblmdu.newcfg в %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\1niayvcd.newcfg в %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'in#########os3k-relay.screenconnect.com':443
TCP:
Запросы HTTP GET:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK in#########os3k-relay.screenconnect.com
