Trojan.Siggen28.25630

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-7f358218a7119e7e\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (7f358218a7119e7e)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (7f358218a7119e7e)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (7f358218a7119e7e)] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (7f358218a7119e7e)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (7f358218a7119e7e)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (7f358218a7119e7e)' "%ProgramFiles(x86)%\ScreenConnect Client (7f358218a7119e7e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-m7s15v-relay.screenconnect.com&p=443&s=c0c180f5-3415-41c5-a9fb-15a5ab...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\screenconnect\7f358218a7119e7e\setup.msi
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\client.resources
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\system.config
%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.client.dll
%WINDIR%\installer\{28a68a5d-1dca-7233-ba50-89dd587995b4}\defaulticon
%TEMP%\msif009.tmp-\transformwebconfig.xsl
%TEMP%\msif009.tmp-\transformsessioneventtriggerxml.xsl
%TEMP%\msif009.tmp
%TEMP%\msif009.tmp-\screenconnect.installeractions.dll
%TEMP%\msif009.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif009.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msif009.tmp-\screenconnect.core.dll
%TEMP%\msif009.tmp-\screenconnect.windows.dll
%TEMP%\msif009.tmp-\microsoft.deployment.compression.dll
%TEMP%\msif009.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msif009.tmp-\customaction.config
%TEMP%\msif009.tmp-\transformappconfigxml.xsl
%TEMP%\msif009.tmp-\transformclientoverrideresx.xsl
%TEMP%\msif009.tmp-\transformlicensexml.xsl
%TEMP%\msif009.tmp-\transformoverriddenkeys.xsl
%TEMP%\msif009.tmp-\transformrolexml.xsl
%TEMP%\msif009.tmp-\transformsecurityeventtriggerxml.xsl
%TEMP%\msif009.tmp-\transformsessiongroupxml.xsl
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (7f358218a7119e7e)\d4caybn0.newcfg

Удаляет следующие файлы

%TEMP%\msif009.tmp-\customaction.config
%TEMP%\msif009.tmp-\transformsessiongroupxml.xsl
%TEMP%\msif009.tmp-\transformsessioneventtriggerxml.xsl
%TEMP%\msif009.tmp-\transformsecurityeventtriggerxml.xsl
%TEMP%\msif009.tmp-\transformrolexml.xsl
%TEMP%\msif009.tmp-\transformoverriddenkeys.xsl
%TEMP%\msif009.tmp-\transformlicensexml.xsl
%TEMP%\msif009.tmp-\transformclientoverrideresx.xsl
%TEMP%\msif009.tmp-\transformappconfigxml.xsl
%TEMP%\msif009.tmp-\screenconnect.windows.dll
%TEMP%\msif009.tmp-\screenconnect.installeractions.dll
%TEMP%\msif009.tmp-\screenconnect.core.dll
%TEMP%\msif009.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msif009.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif009.tmp-\microsoft.deployment.compression.dll
%TEMP%\msif009.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msif009.tmp-\transformwebconfig.xsl
%TEMP%\msif009.tmp

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (7f358218a7119e7e)\d4caybn0.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (7f358218a7119e7e)\user.config

Сетевая активность

Подключается к

'in#########s15v-relay.screenconnect.com':443

TCP

Другие

'in#########s15v-relay.screenconnect.com':443

UDP

DNS ASK in#########s15v-relay.screenconnect.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=instance-m7s15v-relay.screenconnect.com&p=443&s=c0c180f5-3415-41c5-a9fb-15a5ab3c12f1&k=BgIAAACkAABSU0ExAAgAAAEAAQAJkC5mbl2JYGwQqyvIfvArJyQ0yIuSpLi2XLYYV%2bmjTH6x%2b3J%2f%2b...
'%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsclient.exe' "RunRole" "7e546f76-2254-438f-af35-33d1c865f194" "User"
'%ProgramFiles(x86)%\screenconnect client (7f358218a7119e7e)\screenconnect.windowsclient.exe' "RunRole" "4db03c29-aa6f-4426-9f36-89a930ef9e5d" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\ScreenConnect\7f358218a7119e7e\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIF009.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_979577 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments