Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\sc-a88898933d24d588\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (a88898933d24d588)\ScreenConnect.WindowsClient.exe" "%1"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (a88898933d24d588)] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (a88898933d24d588)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (a88898933d24d588)\ScreenConnect.ClientService.exe" "...
Creates the following services
- 'ScreenConnect Client (a88898933d24d588)' "%ProgramFiles(x86)%\ScreenConnect Client (a88898933d24d588)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=greeneit.com&p=8041&s=c972d948-b15c-4d98-8801-51512b1227c0&k=BgIAAACkAABSU0ExA...
Modifies file system
Creates the following files
- %TEMP%\setup.msi
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\client.resources
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.clientservice.exe.config
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.windowsclient.exe.config
- %ALLUSERSPROFILE%\screenconnect client (a88898933d24d588)\c0ex3xo0.newcfg
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.client.dll
- %TEMP%\msi1b8b.tmp-\customaction.config
- %TEMP%\msi1b8b.tmp-\screenconnect.core.dll
- %TEMP%\msi1b8b.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi1b8b.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi1b8b.tmp
- %ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.windows.dll
- %WINDIR%\installer\{036c487f-4113-4910-bb97-c193af5e5ed8}\defaulticon
Deletes the following files
- %TEMP%\msi1b8b.tmp-\customaction.config
- %TEMP%\msi1b8b.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi1b8b.tmp-\screenconnect.core.dll
- %TEMP%\msi1b8b.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi1b8b.tmp
Moves the following files
- from %ALLUSERSPROFILE%\screenconnect client (a88898933d24d588)\c0ex3xo0.newcfg to %ALLUSERSPROFILE%\screenconnect client (a88898933d24d588)\user.config
Network activity
Connects to
- 'gr###eit.com':8041
TCP
- 'gr###eit.com':8041
UDP
- DNS ASK gr###eit.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=greeneit.com&p=8041&s=c972d948-b15c-4d98-8801-51512b1227c0&k=BgIAAACkAABSU0ExAAgAABEAAACfj5OSbl7lsgvWuXYe1becWZOjMiFdrtj3oTN5%2fnI0ScBZuJKNnIEgmTt6eLElsAKBJ1b%2fAsC4zgBU36a...
- '%ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.windowsclient.exe' "RunRole" "c784008c-f221-4b98-8135-85f909f49317" "User"
- '%ProgramFiles(x86)%\screenconnect client (a88898933d24d588)\screenconnect.windowsclient.exe' "RunRole" "8515d5ad-3cc3-4457-9bd1-f552db25341f" "System"
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI1B8B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1056142 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
