Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-8816a585953b9fee\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (8816a585953b9fee)\ScreenConnect.WindowsClient.exe" "%1"'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ee605387-841b-4755-9fe0-3948e6d07558)] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (ee605387-841b-4755-9fe0-3948e6d07558)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (8816a585953b9fee)\ScreenConnect.Cl...
Creates the following services
- 'ScreenConnect Client (ee605387-841b-4755-9fe0-3948e6d07558)' %ProgramFiles(x86)%\ScreenConnect Client (8816a585953b9fee)\ScreenConnect.ClientService.exe" "?y=Guest&h=instance-y153ku-relay.screenconnect.com&p=443&s=ee605387-841b-4755-9fe0-3948e6d07558&k=B...
Modifies file system
Creates the following files
- %TEMP%\setup.msi
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\msi7bd3.tmp
- %TEMP%\msi7bd3.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi7bd3.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi7bd3.tmp-\screenconnect.core.dll
- %TEMP%\msi7bd3.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~dfb2e3ce51cf95112e.tmp
- %WINDIR%\installer\sourcehash{9ab49b82-6181-4076-945d-5fce417f30d0}
- %WINDIR%\temp\~df47fe20993044be2f.tmp
- %WINDIR%\temp\~df8e57f40bde981b04.tmp
- %WINDIR%\temp\~df3a4fd570da32f4c3.tmp
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\app.config
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\client.resources
- %WINDIR%\installer\{9ab49b82-6181-4076-945d-5fce417f30d0}\defaulticon
- %WINDIR%\temp\~df61f9a989831bc0e2.tmp
- %WINDIR%\temp\~df2b2d64ed3ba234ab.tmp
- %WINDIR%\temp\~df9f43e7af80d6d6fb.tmp
- %WINDIR%\temp\~df90a4c8224680d132.tmp
- %WINDIR%\temp\~df38689aa606349a89.tmp
- %WINDIR%\temp\~dfee93e73862dfb08b.tmp
- %WINDIR%\temp\~dfa1805db6d8ea40e8.tmp
- %WINDIR%\temp\~df95e7a9863338db26.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\screenconnect.windowsclient.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\screenconnect.clientservice.exe.log
- %TEMP%\content\5544-1628-screenconnect.windowsclient.exe-13-34-30-270.dump
Deletes following files that it created itself
- %TEMP%\msi7bd3.tmp-\customaction.config
- %TEMP%\msi7bd3.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi7bd3.tmp-\screenconnect.core.dll
- %TEMP%\msi7bd3.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi7bd3.tmp
Network activity
UDP
- DNS ASK in#########53ku-relay.screenconnect.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windowsclient.exe' "Rerun" "?y=Guest&h=instance-y153ku-relay.screenconnect.com&p=443&s=ee605387-841b-4755-9fe0-3948e6d07558&k=BgIAAACkAABSU0ExAAgAAAEAAQAxg47hYZUVe364ymseJgLCmlT6k3YqL8j8uj3q9u1wlxlOR0ps%2bAHC0dcd...
- '%ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windowsclient.exe' "?y=Guest&h=instance-y153ku-relay.screenconnect.com&p=443&s=ee605387-841b-4755-9fe0-3948e6d07558&k=BgIAAACkAABSU0ExAAgAAAEAAQAxg47hYZUVe364ymseJgLCmlT6k3YqL8j8uj3q9u1wlxlOR0ps%2bAHC0dcd%2f7Jtxb...
- '%ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.clientservice.exe' "?y=Guest&h=instance-y153ku-relay.screenconnect.com&p=443&s=ee605387-841b-4755-9fe0-3948e6d07558&k=BgIAAACkAABSU0ExAAgAAAEAAQAxg47hYZUVe364ymseJgLCmlT6k3YqL8j8uj3q9u1wlxlOR0ps%2bAHC0dcd%2f7Jtxb...
- '%ProgramFiles(x86)%\screenconnect client (8816a585953b9fee)\screenconnect.windowsclient.exe' "RunRole" "79e996a3-7ad0-4963-8975-95922bc7111a" "User"
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI7BD3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_949828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
