Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\sc-9ccf382978053e00\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.WindowsClient.exe" "%1"'
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.ClientService.dll
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.Client.dll
- C:\Config.Msi\1e0a8.rbs
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.Core.dll
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.Windows.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\lb3xtfg2.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\cs431tdh.newcfg
- %TEMP%\~DF3527.tmp
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\pq2rf2rz.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\vjnm3tta.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\hjshlnir.newcfg
- %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\rm1vdoln.newcfg
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\Client.Override.resources
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\Client.en-US.resources
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.ClientService.exe
- %ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\Client.resources
- %WINDIR%\Installer\{A78791A1-F27D-4CCB-A591-DDBD8DF90DBD}\DefaultIcon
- %WINDIR%\Installer\1e0a9.msi
- %WINDIR%\Installer\MSI7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\1e0a6.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- %TEMP%\MSI1.tmp
- %TEMP%\1c9a4.msi
- %TEMP%\setup.msi
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %WINDIR%\Installer\1e0a7.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %TEMP%\~DFC711.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
Deletes the following files:
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\1e0a8.rbs
- %TEMP%\1c9a4.msi
- %WINDIR%\Installer\1e0a7.ipi
- %WINDIR%\Installer\1e0a6.msi
- %TEMP%\MSI1.tmp-\ScreenConnect.Core.dll
- %TEMP%\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI1.tmp-\CustomAction.config
- %TEMP%\MSI1.tmp-\ScreenConnect.InstallerActions.dll
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI1.tmp
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\rm1vdoln.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\hjshlnir.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\vjnm3tta.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\cs431tdh.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\lb3xtfg2.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
- from %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\pq2rf2rz.newcfg to %ALLUSERSPROFILE%\Application Data\ScreenConnect Client (9ccf382978053e00)\user.config
Network activity:
Connects to:
- 'wp#d':80
- 'in#########fb12-relay.screenconnect.com':443
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK in#########fb12-relay.screenconnect.com
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.WindowsClient.exe' "?e=Access&y=Host&h=instance-difb12-relay.screenconnect.com&p=443&s=ac833b25-8681-4b35-acd0-c7ae767da105&k=BgIAAACkAABSU0ExAAgAAAEAAQCxZbSgJIScp0eSiCDrToGj8%2b%2fOATKAPsAp8IczOARNzc647ww8NGqNrM...
- '%ProgramFiles%\ScreenConnect Client (9ccf382978053e00)\ScreenConnect.WindowsClient.exe' "Rerun" "?e=Access&y=Host&h=instance-difb12-relay.screenconnect.com&p=443&s=ac833b25-8681-4b35-acd0-c7ae767da105&k=BgIAAACkAABSU0ExAAgAAAEAAQCxZbSgJIScp0eSiCDrToGj8%2b%2fOATKAPsAp8IczOARNzc647w...
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_120578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' -Embedding 5F81C4991BC7B2151C3449FB69270E9E
- '<SYSTEM32>\msiexec.exe' -Embedding 76137DDC866E46979B311253BA8E9F96 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 24A0D9C920E93385F1D047F5B6ADDF15 C
