Trojan.Siggen32.60913

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-980f8db500f06587\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (980f8db500f06587)\ScreenConnect.WindowsClient.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<Имя файла>.exe.log
%TEMP%\msiff6f.tmp
%TEMP%\msiff6f.tmp-\screenconnect.installeractions.dll
%TEMP%\msiff6f.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msiff6f.tmp-\screenconnect.core.dll
%TEMP%\msiff6f.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df08ce32a33da97b03.tmp
%WINDIR%\installer\sourcehash{54f84215-e27f-4690-9737-5008630fc13e}
%WINDIR%\temp\~df9f75b6dd8ffac64a.tmp
%WINDIR%\temp\~df98e86ddc0dfb060d.tmp
%WINDIR%\temp\~df2d91e2b856d5a5a2.tmp
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\app.config
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\client.resources
%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\system.config
%WINDIR%\installer\{54f84215-e27f-4690-9737-5008630fc13e}\defaulticon
%WINDIR%\temp\~dfdb841a27c41453db.tmp
%WINDIR%\temp\~dfdf3574663af96f1a.tmp
%WINDIR%\temp\~df6a78af61392729a9.tmp
%WINDIR%\temp\~df80aeb3cea699f2e5.tmp
%WINDIR%\temp\~df23cde7ab77cd7b3c.tmp
%WINDIR%\temp\~df3cbfca684de80a99.tmp
%WINDIR%\temp\~dfdca4e70fc0997d90.tmp
%WINDIR%\temp\~df0f921dadc9fab213.tmp
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
%TEMP%\content\5244-5220-screenconnect.windowsclient.exe-13-16-38-724.dump
%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\uqovt414.newcfg
%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\i2g4invo.newcfg
%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\cnocbt1e.newcfg

Удаляет файлы, которые сам же создал

%TEMP%\msiff6f.tmp-\customaction.config
%TEMP%\msiff6f.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msiff6f.tmp-\screenconnect.core.dll
%TEMP%\msiff6f.tmp-\screenconnect.installeractions.dll
%TEMP%\msiff6f.tmp

Перемещает следующие файлы

%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\uqovt414.newcfg в %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config
%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\i2g4invo.newcfg в %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config
%ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\cnocbt1e.newcfg в %ALLUSERSPROFILE%\screenconnect client (980f8db500f06587)\user.config

Сетевая активность

Подключается к

'in#########rimu-relay.screenconnect.com':443

TCP

Другие

'in#########rimu-relay.screenconnect.com':443

UDP

DNS ASK in#########rimu-relay.screenconnect.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe' "Rerun" "?e=Access&y=Host&h=instance-uirimu-relay.screenconnect.com&p=443&s=d9127958-fd58-46b0-b0a8-ad48fb18391d&k=BgIAAACkAABSU0ExAAgAAAEAAQDNIdhmh9kOrKy58T6hCd1%2bEXhcJ6i43mSo3Vk5%2fB%2bbXZAr...
'%ProgramFiles(x86)%\screenconnect client (980f8db500f06587)\screenconnect.windowsclient.exe' "?e=Access&y=Host&h=instance-uirimu-relay.screenconnect.com&p=443&s=d9127958-fd58-46b0-b0a8-ad48fb18391d&k=BgIAAACkAABSU0ExAAgAAAEAAQDNIdhmh9kOrKy58T6hCd1%2bEXhcJ6i43mSo3Vk5%2fB%2bbXZAr%2bOXWw5...

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIFF6F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_918281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments