Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (5e1cd3995a79510e)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.ClientService.exe" "...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (5e1cd3995a79510e)] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_180468 1 Elsinore.ScreenConnect.InstallerActions!Elsinore.ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '%ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=sc.ets1.net&p=8041&s=26d8c55c-572e-40bc-a32e-d10447c11c2e&k=BgIAAACkAABSU0ExAAgAAAEAAQBhak3yvNx6uCpv7Gr6bmrnh6bMo3y7Lyr8ChZcq2OWO3qdUIVEiY0c7FErWe6I%2bwsHl%2b3p%2bpvZ1YQu2r...
- '%ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.WindowsClient.exe' "RunRole" "42535e1d-9539-4152-b505-c1cddc4357eb" "User"
- '<SYSTEM32>\msiexec.exe' -Embedding 8671F4A45651A73CCEB6710E85E95C7A C
- '%TEMP%\VSD1.tmp\DotNetFXCustom\dotnetchk.exe'
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.ClientService.exe
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.Client.dll
- C:\Config.Msi\2cc12.rbs
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.Windows.dll
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.Core.dll
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.ClientService.exe.config
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\iisrwun2.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\lco0lnsb.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\ul01xm1q.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\tldin2pz.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\kiw0b2b5.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\bx511mhg.newcfg
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\app.config
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.WindowsClient.exe
- %WINDIR%\Installer\{49DECFB1-6C8B-4B33-BA5E-A1617102EA2D}\DefaultIcon
- %WINDIR%\Installer\2cc13.msi
- %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\Elsinore.ScreenConnect.Client.resources
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\2cc10.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll
- %TEMP%\VSD1.tmp\install.log
- %TEMP%\VSD1.tmp\DotNetFXCustom\dotnetchk.exe
- %TEMP%\MSI2.tmp-\CustomAction.config
- %TEMP%\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\2cc11.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
Deletes the following files:
- C:\Config.Msi\2cc12.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\2cc10.msi
- %TEMP%\2b433.msi
- %WINDIR%\Installer\2cc11.ipi
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
- %TEMP%\MSI2.tmp-\CustomAction.config
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll
- %TEMP%\MSI2.tmp
- %TEMP%\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Moves the following files:
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\bx511mhg.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\kiw0b2b5.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\tldin2pz.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\ul01xm1q.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\lco0lnsb.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
- from %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\iisrwun2.newcfg to %ProgramFiles%\ScreenConnect Client (5e1cd3995a79510e)\user.config
Network activity:
Connects to:
- 'wp#d':80
- 'sc.#ts1.net':8041
TCP:
HTTP GET requests:
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK sc.#ts1.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
