Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\sc-869f49fc91e50a8f\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (869f49fc91e50a8f)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe" "?e=Access...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (869f49fc91e50a8f)] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe' "RunRole" "760f566a-0b58-48d2-a391-51c9beefe5dc" "User"
- '%ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=instance-bwos3k-relay.screenconnect.com&p=443&s=342c0386-c035-4512-8d1c-1269b3df1796&k=BgIAAACkAABSU0ExAAgAAAEAAQARXq0IXuJskyAUJvs%2b2B5iJgJ3t1P%2fDbvo7KrurQL6eDBBjS2YufRSo...
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_145921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' -Embedding F1D9C93385814729710E85CDA456241B
- '<SYSTEM32>\msiexec.exe' -Embedding 539FAD030B17052400A5F8495289C270 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 8671DEE95124F3124DC1D0C086679991 C
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Windows.dll
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Core.dll
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.dll
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.ClientService.exe
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\ScreenConnect.Client.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\Config.Msi\243b8.rbs
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\35e4kz44.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\hlzhvach.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\vepz2hu1.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\uuan3loo.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\wl4yyrbu.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\4gl5n5me.newcfg
- %TEMP%\~DF7432.tmp
- %WINDIR%\Installer\MSI7.tmp
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\Client.resources
- %ProgramFiles%\ScreenConnect Client (869f49fc91e50a8f)\Client.en-US.resources
- %WINDIR%\Installer\{C9D91423-1628-40E2-A8DD-46F3B200476B}\DefaultIcon
- %WINDIR%\Installer\243b9.msi
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\MSI1.tmp
- %TEMP%\22b9a.msi
- %TEMP%\setup.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\243b6.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %TEMP%\~DFEAFB.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %WINDIR%\Installer\243b7.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
Deletes the following files:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\243b8.rbs
- %TEMP%\22b9a.msi
- %WINDIR%\Installer\243b7.ipi
- %WINDIR%\Installer\243b6.msi
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI1.tmp
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\4gl5n5me.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\wl4yyrbu.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\uuan3loo.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\vepz2hu1.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\hlzhvach.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\35e4kz44.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (869f49fc91e50a8f)\user.config
Network activity:
Connects to:
- 'wp#d':80
- 'in#########os3k-relay.screenconnect.com':443
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK in#########os3k-relay.screenconnect.com
