Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\sc-b1f5074d3c8efbff\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.WindowsClient.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (b1f5074d3c8efbff)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.ClientService.exe" "?e=Access...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (b1f5074d3c8efbff)] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.Core.dll
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.ClientService.dll
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.Client.dll
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.Windows.dll
- C:\Config.Msi\3ea15.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\{A435A4CE-F26E-45DD-B0D7-7AAEA8918E81}\DefaultIcon
- %WINDIR%\Installer\3ea16.msi
- %WINDIR%\Installer\MSI8.tmp
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\touhkpvq.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\hbcql525.newcfg
- %TEMP%\~DF7FE7.tmp
- %WINDIR%\Installer\MSI7.tmp
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\Client.en-US.resources
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\app.config
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.ClientService.exe
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\Client.resources
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\Client.Override.resources
- %ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\Client.Override.en-US.resources
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\MSI1.tmp
- %TEMP%\3bbee.msi
- %TEMP%\setup.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\3ea13.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %TEMP%\~DF878D.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %WINDIR%\Installer\3ea14.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
Deletes the following files:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\3ea15.rbs
- %TEMP%\3bbee.msi
- %WINDIR%\Installer\3ea14.ipi
- %WINDIR%\Installer\3ea13.msi
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI1.tmp
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\touhkpvq.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\hbcql525.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (b1f5074d3c8efbff)\user.config
Network activity:
Connects to:
- 'wp#d':80
- 'su####t.isttinc.com':8041
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK su####t.isttinc.com
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.WindowsClient.exe' "RunRole" "1892f0b3-fbfd-4b1b-b4d7-2ab006204edc" "User"
- '%ProgramFiles%\ScreenConnect Client (b1f5074d3c8efbff)\ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=support.isttinc.com&p=8041&s=271794be-f6f4-4ac8-9efa-85d5da0c6331&k=BgIAAACkAABSU0ExAAgAAAEAAQD7jjdcu2326dVOlDGToDhFLJnN%2brwmqsp8VZKRSf1s0endeltbCfCv92thiLdknk9K7agCZKYY%2...
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_251296 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' -Embedding 34C515ADDB295EC24203C52433960F1B
- '<SYSTEM32>\msiexec.exe' -Embedding 32CFF8D7095E911705240024F3DC4385 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding CEB6717D548EC92E5E06418927D9C1D0 C
