Trojan.Siggen31.33668

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-7e28db0aad2c44a3\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (7e28db0aad2c44a3)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (7e28db0aad2c44a3)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (7e28db0aad2c44a3)] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ScreenConnect Client (7e28db0aad2c44a3)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (7e28db0aad2c44a3)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (7e28db0aad2c44a3)' "%ProgramFiles(x86)%\ScreenConnect Client (7e28db0aad2c44a3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.adobeconfi.com&p=8041&s=7444409e-7b06-4d64-aabc-70cb53f913cf&k=BgIAAACkA...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\screenconnect\25.3.2.9270\7e28db0aad2c44a3\screenconnect.clientsetup.msi
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsbackstageshell.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsclient.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsauthenticationpackage.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsfilemanager.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\app.config
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\client.resources
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windows.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windows.dll
%TEMP%\msi49bc.tmp-\screenconnect.installeractions.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi49bc.tmp-\screenconnect.core.dll
%TEMP%\msi49bc.tmp-\screenconnect.windows.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi49bc.tmp
%TEMP%\msi49bc.tmp-\microsoft.deployment.compression.cab.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.client.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.clientservice.pdb
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.core.pdb
%TEMP%\msi49bc.tmp-\customaction.config
%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\system.config
%WINDIR%\installer\{84fc7ff8-8e87-763b-9a7f-1f3f677b5e42}\defaulticon

Удаляет следующие файлы

%TEMP%\msi49bc.tmp-\customaction.config
%TEMP%\msi49bc.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi49bc.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi49bc.tmp-\screenconnect.core.dll
%TEMP%\msi49bc.tmp-\screenconnect.installeractions.dll
%TEMP%\msi49bc.tmp-\screenconnect.windows.dll
%TEMP%\msi49bc.tmp

Сетевая активность

UDP

DNS ASK re###.#dobeconfi.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=relay.adobeconfi.com&p=8041&s=7444409e-7b06-4d64-aabc-70cb53f913cf&k=BgIAAACkAABSU0ExAAgAAAEAAQDJxg8RZLbMm1XSH3oFikC79gNmyLnVaaSQND8okLWngZcbFyfjqgL2%2fYEcO3orcugigzoTUOWUa...
'%ProgramFiles(x86)%\screenconnect client (7e28db0aad2c44a3)\screenconnect.windowsclient.exe' "RunRole" "ade4bd6e-8731-4266-9ea6-49609fc42a91" "User"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\ScreenConnect\25.3.2.9270\7e28db0aad2c44a3\ScreenConnect.ClientSetup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI49BC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1333122 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments