Trojan.Siggen20.55875

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-e87c57009ea7d723\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (e87c57009ea7d723)\ScreenConnect.WindowsClient.exe" "%1"'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (a41699c3-d47d-4410-9861-d45ae9355bc3)] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (a41699c3-d47d-4410-9861-d45ae9355bc3)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (e87c57009ea7d723)\ScreenConnect.Cl...

Создает следующие сервисы

'ScreenConnect Client (a41699c3-d47d-4410-9861-d45ae9355bc3)' "%ProgramFiles(x86)%\ScreenConnect Client (e87c57009ea7d723)\ScreenConnect.ClientService.exe" "?y=Guest&h=instance-v4mrv7-relay.screenconnect.com&p=443&s=a41699c3-d47d-4410-9861-d45ae9355bc3&k=...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%WINDIR%\temp\cabbff4.tmp
%WINDIR%\temp\tarbff5.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
%WINDIR%\temp\cabd74d.tmp
%WINDIR%\temp\tard74e.tmp
%WINDIR%\temp\taredbd.tmp
%WINDIR%\temp\cab1b39.tmp
%WINDIR%\temp\cabee1b.tmp
%WINDIR%\temp\taree1c.tmp
%WINDIR%\temp\cab44c.tmp
%WINDIR%\temp\tar44d.tmp
%WINDIR%\temp\cab4cb.tmp
%WINDIR%\temp\tar4cc.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\74fbf93595cfc8459196065ce54ad928
%WINDIR%\temp\cabedbc.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\74fbf93595cfc8459196065ce54ad928
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.clientservice.dll
%TEMP%\msi36b9.tmp
%TEMP%\msi36b9.tmp-\screenconnect.installeractions.dll
%TEMP%\msi36b9.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi36b9.tmp-\screenconnect.core.dll
%TEMP%\msi36b9.tmp-\customaction.config
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\client.resources
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\app.config
%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\client.en-us.resources
%WINDIR%\installer\{04090e0c-d66a-4dff-b6a3-8524b1e64b73}\defaulticon
%WINDIR%\temp\tar1b3a.tmp

Удаляет следующие файлы

%TEMP%\msi36b9.tmp-\customaction.config
%WINDIR%\temp\tar4cc.tmp
%WINDIR%\temp\cab4cb.tmp
%WINDIR%\temp\tar44d.tmp
%WINDIR%\temp\cab44c.tmp
%WINDIR%\temp\taree1c.tmp
%WINDIR%\temp\cabee1b.tmp
%WINDIR%\temp\taredbd.tmp
%WINDIR%\temp\cab1b39.tmp
%WINDIR%\temp\cabedbc.tmp
%WINDIR%\temp\cabd74d.tmp
%WINDIR%\temp\tarbff5.tmp
%WINDIR%\temp\cabbff4.tmp
%TEMP%\msi36b9.tmp
%TEMP%\msi36b9.tmp-\screenconnect.installeractions.dll
%TEMP%\msi36b9.tmp-\screenconnect.core.dll
%TEMP%\msi36b9.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\temp\tard74e.tmp
%WINDIR%\temp\tar1b3a.tmp

Сетевая активность

Подключается к

'microsoft.com':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

UDP

DNS ASK microsoft.com
DNS ASK in#########mrv7-relay.screenconnect.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windowsclient.exe' "Rerun" "?y=Guest&h=instance-v4mrv7-relay.screenconnect.com&p=443&s=a41699c3-d47d-4410-9861-d45ae9355bc3&k=BgIAAACkAABSU0ExAAgAAAEAAQDdRR4rhW4ZawRLpDSRj0bdDBESCHl7%2bdOQgFso76%2bPFiQTpUGem%2fiG...
'%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windowsclient.exe' "?y=Guest&h=instance-v4mrv7-relay.screenconnect.com&p=443&s=a41699c3-d47d-4410-9861-d45ae9355bc3&k=BgIAAACkAABSU0ExAAgAAAEAAQDdRR4rhW4ZawRLpDSRj0bdDBESCHl7%2bdOQgFso76%2bPFiQTpUGem%2fiGKjTUXpBD...
'%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.clientservice.exe' "?y=Guest&h=instance-v4mrv7-relay.screenconnect.com&p=443&s=a41699c3-d47d-4410-9861-d45ae9355bc3&k=BgIAAACkAABSU0ExAAgAAAEAAQDdRR4rhW4ZawRLpDSRj0bdDBESCHl7%2bdOQgFso76%2bPFiQTpUGem%2fiGKjTUXpBD...
'%ProgramFiles(x86)%\screenconnect client (e87c57009ea7d723)\screenconnect.windowsclient.exe' "RunRole" "2a11d4c8-f061-40cc-8524-737536cf043e" "User"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI36B9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_998219 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments