Trojan.Muldrop8.45196

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\sc-2ca5dc95101453ee\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (2ca5dc95101453ee)\ScreenConnect.WindowsClient.exe" "%1"'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (2ca5dc95101453ee)] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (2ca5dc95101453ee)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (2ca5dc95101453ee)\ScreenConnect.ClientService.exe" "?e=Ac...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%WINDIR%\temp\perflib_perfdata_f08.dat
%WINDIR%\installer\{a2c7c589-7475-465e-9df4-04322bef7b68}\defaulticon
%WINDIR%\installer\13f0c6.msi
%ALLUSERSPROFILE%\application data\screenconnect client (2ca5dc95101453ee)\pvf2bqmx.newcfg
%WINDIR%\installer\msi8.tmp
%WINDIR%\installer\msi7.tmp
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\client.resources
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\client.en-us.resources
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.clientservice.exe
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.windowsclient.exe.config
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.windowsclient.exe
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.windows.dll
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.core.dll
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.clientservice.dll
%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.client.dll
C:\config.msi\13f0c5.rbs
%WINDIR%\installer\msi5.tmp
%WINDIR%\installer\msi4.tmp
%WINDIR%\installer\msi3.tmp
%WINDIR%\installer\msi2.tmp
%WINDIR%\installer\13f0c4.ipi
%WINDIR%\installer\13f0c3.msi
%TEMP%\msi1.tmp-\customaction.config
%TEMP%\msi1.tmp-\screenconnect.core.dll
%TEMP%\msi1.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi1.tmp-\screenconnect.installeractions.dll
%TEMP%\msi1.tmp
%WINDIR%\installer\13f0ca.ipi
%WINDIR%\temp\~dfb051.tmp

Удаляет следующие файлы

Перемещает следующие файлы

%ALLUSERSPROFILE%\application data\screenconnect client (2ca5dc95101453ee)\pvf2bqmx.newcfg в %ALLUSERSPROFILE%\application data\screenconnect client (2ca5dc95101453ee)\user.config

Сетевая активность

Подключается к

UDP

Другое

Создает и запускает на исполнение

'%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=instance-o5jibj-relay.screenconnect.com&p=443&s=c9dfd216-8333-4fa5-ba25-246fb00d16ab&k=BgIAAACkAABSU0ExAAgAAAEAAQDzlbEPpK7u8jhBKfN0beDhGoA5ZHuwtUOot%2bKSGiGlFAo4Nv2CwlHUlME...
'%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.windowsclient.exe' "RunRole" "d96688cf-6377-4eaf-914c-dfce9045a58d" "User"
'%ProgramFiles%\screenconnect client (2ca5dc95101453ee)\screenconnect.windowsclient.exe' "RunRole" "fd9ba437-5888-4b86-8cc1-5597e64bdf07" "System"

Запускает на исполнение

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
'<SYSTEM32>\msiexec.exe' -Embedding C7B232CFF8BA53A456E947D8D0F55CF1 C
'<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1305266 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
'<SYSTEM32>\msiexec.exe' -Embedding B7D099B9813FFB9FC2866EFC74A7EBED
'<SYSTEM32>\msiexec.exe' -Embedding 0355393C4EC592E715C063183429AF0E M Global\MSI0000
'<SYSTEM32>\verclsid.exe' /C {B5A7F190-DDA6-4420-B3BA-52453494E6CD} /I {00000000-0000-0000-C000-000000000046} /X 0x401
'<SYSTEM32>\msiexec.exe' /i "%WINDIR%\TEMP\setup.msi"
'<SYSTEM32>\msiexec.exe' -Embedding E951813D5EDD8147DD3E5F275EC9A73C M Global\MSI0000
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSIA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1390199 26 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments