Trojan.Siggen32.22132

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-3f3477f13e04d89e\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (3f3477f13e04d89e)\ScreenConnect.WindowsClient.exe" "%1"'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (3f3477f13e04d89e)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (3f3477f13e04d89e)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (3f3477f13e04d89e)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (3f3477f13e04d89e)' %ProgramFiles(x86)%\ScreenConnect Client (3f3477f13e04d89e)\ScreenConnect.ClientService.exe" "?e=Access&h=instance-jo4tdt-relay.screenconnect.com&p=443&s=c3118928-d5ae-4fbe-a7cb-236aa6fe62dc&k=...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
%TEMP%\msi8d96.tmp
%TEMP%\msi8d96.tmp-\screenconnect.installeractions.dll
%TEMP%\msi8d96.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi8d96.tmp-\screenconnect.core.dll
%TEMP%\msi8d96.tmp-\screenconnect.windows.dll
%TEMP%\msi8d96.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df5c1766c876706813.tmp
%WINDIR%\installer\sourcehash{5764026a-bd68-4b99-b97f-60804941c57f}
%WINDIR%\temp\~df214bb42c2dde5048.tmp
%WINDIR%\temp\~df9b2de4d74e3f1376.tmp
%WINDIR%\temp\~dfeaf8d6a6b3ebb657.tmp
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\app.config
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\client.resources
%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\system.config
%WINDIR%\installer\{5764026a-bd68-4b99-b97f-60804941c57f}\defaulticon
%WINDIR%\temp\~df5b2bd5d9276cd1fa.tmp
%WINDIR%\temp\~dfbb69a3846174d4b5.tmp
%WINDIR%\temp\~dfb4abb101ba14ce71.tmp
%WINDIR%\temp\~df497e53b35496be2f.tmp
%WINDIR%\temp\~df93b1f9c67c806a64.tmp
%WINDIR%\temp\~dfd4723e15f489a9e9.tmp
%WINDIR%\temp\~df9c598a9706e6bcbe.tmp
%WINDIR%\temp\~df16ae47da1405238f.tmp
%TEMP%\content\4404-4164-screenconnect.windowsclient.exe-02-20-48-405.dump

Удаляет файлы, которые сам же создал

%TEMP%\msi8d96.tmp-\customaction.config
%TEMP%\msi8d96.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi8d96.tmp-\screenconnect.core.dll
%TEMP%\msi8d96.tmp-\screenconnect.installeractions.dll
%TEMP%\msi8d96.tmp-\screenconnect.windows.dll
%TEMP%\msi8d96.tmp

Сетевая активность

UDP

DNS ASK in#########4tdt-relay.screenconnect.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.clientservice.exe' "?e=Access&h=instance-jo4tdt-relay.screenconnect.com&p=443&s=c3118928-d5ae-4fbe-a7cb-236aa6fe62dc&k=BgIAAACkAABSU0ExAAgAAAEAAQCBdSKvKMJO0V4fk2vUx0JhMQY2sRDvgh%2bkfm0mwm3cRj3ARHUpNVyrTlCWPj1IZOw...
'%ProgramFiles(x86)%\screenconnect client (3f3477f13e04d89e)\screenconnect.windowsclient.exe' "RunRole" "41f40613-9b59-4eee-93d2-2430950d5342" "User"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI8D96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_954281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments