Trojan.Muldrop8.42228

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\sc-e881abbd198569ce\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (e881abbd198569ce)\ScreenConnect.WindowsClient.exe" "%1"'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (e881abbd198569ce)] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (e881abbd198569ce)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (e881abbd198569ce)\ScreenConnect.ClientService.exe" "...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\client.resources
%WINDIR%\installer\msi6ae.tmp
%WINDIR%\installer\msi76a.tmp
%WINDIR%\installer\1002d3.msi
%WINDIR%\installer\msi467.tmp
%WINDIR%\installer\{2d7af48e-0d6d-47d2-b799-bbb34a356753}\defaulticon
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\lzxdzgdf.newcfg
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\fwcrnph5.newcfg
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\t4jhpa4z.newcfg
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\jiexq1d4.newcfg
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\r1q1dt5f.newcfg
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.client.dll
C:\config.msi\1002d2.rbs
%WINDIR%\installer\msi583.tmp
%WINDIR%\installer\msi543.tmp
%WINDIR%\installer\msi477.tmp
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\ulvmga45.newcfg
%WINDIR%\installer\1002d1.ipi
%WINDIR%\installer\1002d0.msi
%TEMP%\msif97a.tmp-\customaction.config
%TEMP%\msif97a.tmp-\screenconnect.core.dll
%TEMP%\msif97a.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif97a.tmp-\screenconnect.installeractions.dll
%TEMP%\msif97a.tmp
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\d0kvvxej.newcfg
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\anovv2bf.newcfg

Удаляет следующие файлы

%TEMP%\msif97a.tmp-\customaction.config
%TEMP%\msif97a.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif97a.tmp-\screenconnect.core.dll
%TEMP%\msif97a.tmp-\screenconnect.installeractions.dll
%TEMP%\msif97a.tmp
%WINDIR%\installer\msi477.tmp
%WINDIR%\installer\msi543.tmp
%WINDIR%\installer\msi583.tmp
%WINDIR%\installer\msi6ae.tmp
%WINDIR%\installer\msi76a.tmp
%WINDIR%\installer\msi467.tmp
C:\config.msi\1002d2.rbs
%WINDIR%\installer\1002d0.msi
%WINDIR%\installer\1002d1.ipi

Перемещает следующие файлы

%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\ulvmga45.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\lzxdzgdf.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\fwcrnph5.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\t4jhpa4z.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\jiexq1d4.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\r1q1dt5f.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\d0kvvxej.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config
%PROGRAMDATA%\screenconnect client (e881abbd198569ce)\anovv2bf.newcfg в %PROGRAMDATA%\screenconnect client (e881abbd198569ce)\user.config

Сетевая активность

Подключается к

'co#####l.hostedrmm.com':8041

UDP

DNS ASK co#####l.hostedrmm.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=computol.hostedrmm.com&p=8041&s=61757c7d-80ec-478a-a8a1-66f33c8f0bb1&k=BgIAAACkAABSU0ExAAgAAAEAAQD%2f%2fvUODCgyGQ0ZZvJbksWe%2fjbZHEjkq9tqkb2YeTQyad20Vmb4JjRTBS5U1lGYFHa9uFz...
'%ProgramFiles(x86)%\screenconnect client (e881abbd198569ce)\screenconnect.windowsclient.exe' "RunRole" "da46e7b1-cc35-4da8-9a12-ce460d56d5fd" "User"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\msiexec.exe' -Embedding 742EFCD01BDB53293176A75C859927C0 C
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIF97A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1047125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
'%WINDIR%\syswow64\msiexec.exe' -Embedding 52892212B16ED034DCDCD327AD4E8C9F
'%WINDIR%\syswow64\msiexec.exe' -Embedding CFDCFC54C1B656A7DFF843C9E825D944 M Global\MSI0000