Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\sc event trigger test task
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SecureConnector] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SecureConnector] 'ImagePath' = '"%ProgramFiles%\ForeScout SecureConnector\SecureConnector.exe" -service'
Creates the following services
- 'SecureConnector' "%ProgramFiles%\ForeScout SecureConnector\SecureConnector.exe" -service
Modifies file system
Creates the following files
- <Current directory>\install.cmd
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\forescout secureconnector\uninstall.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\forescout secureconnector\secureconnector.lnk
- %ProgramFiles%\forescout secureconnector\uninstall.lnk
- %ProgramFiles%\forescout secureconnector\secureconnector.exe
- %ALLUSERSPROFILE%\forescout secureconnector\secureconnectorconfig.exe
- %ALLUSERSPROFILE%\forescout secureconnector\logs\sc.log
- %ALLUSERSPROFILE%\forescout secureconnector\secureconnectorlogconfig.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\agentscout\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe.lnk
- %ProgramFiles%\forescout secureconnector\secureconnector.ini.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\agentscout\32-bit\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe.lnk
- %ProgramFiles%\connect.inc\agentscout\32-bit\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe
- %ProgramFiles%\connect.inc\agentscout\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout1.cab
- %TEMP%\msi1f14.tmp
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout.x64.msi
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout.msi
- %WINDIR%\temp\install_forescout-11.0.03.10.13.log
- <Current directory>\agentscout.exe
- %WINDIR%\installer\{8a1a2d79-4353-4ec1-8e76-4511e32261b6}\scout1.exe
- %ProgramFiles%\forescout secureconnector\secureconnectorpassword.ini
Deletes the following files
- %TEMP%\msi1f14.tmp
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout.msi
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout.x64.msi
- %APPDATA%\connect.inc\agentscout 11.10.13\install\agentscout1.cab
Moves the following files
- from %ProgramFiles%\forescout secureconnector\secureconnector.ini.tmp to %ProgramFiles%\forescout secureconnector\secureconnector.ini
- from %ProgramFiles%\connect.inc\agentscout\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe to %TEMP%\fsa_tmp_
Network activity
Connects to
- '15#.#9.211.38':10003
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
Creates and executes the following
- '<Current directory>\agentscout.exe' /qn
- '%WINDIR%\installer\msi37f9.tmp' "%ProgramFiles%\Connect.Inc\AgentScout\SC-nWPTJicTNBwK2WAw8GkxuqhcM2G60rJ69zrNhCRjWtxdTbElzIwEAAE-.exe"
- '%ProgramFiles%\connect.inc\agentscout\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe'
- '%ProgramFiles%\connect.inc\agentscout\sc-nwptjictnbwk2waw8gkxuqhcm2g60rj69zrnhcrjwtxdtbelziweaae-.exe' -elev
- '%ProgramFiles%\forescout secureconnector\secureconnector.exe' -service
- '%ProgramFiles%\forescout secureconnector\secureconnector.exe' -agent -ip 157.99.211.38 -port 10003 -notify -event FSA_TMP_2812_623CBFE3_0001AGENT_CNTL -capi 0
- '%ProgramFiles%\forescout secureconnector\secureconnector.exe' -performer -id AA9790DB10BA4DDB9C28C97CA958E43A -ip 157.99.211.38 -port 10003 -sha256 341C0AD96030F06931BAA85C3361BAD2B27AF73ACD8424635ADC5D4DB125CC8C -event FSA_TMP_2812_623CBFE3_0002PERFORMER...
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\Install.cmd" "
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\Connect.Inc\AgentScout 11.10.13\install\AgentScout.x64.msi" /qn AI_SETUPEXEPATH=<Current directory>\AgentScout.exe SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /f...
