Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\sc-804407612a5c368e\shell\open\command] '' = '"%ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.WindowsClient.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (804407612a5c368e)] 'ImagePath' = '"%ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.ClientService.exe" "...
- [<HKLM>\SYSTEM\ControlSet001\Services\ScreenConnect Client (804407612a5c368e)] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.ClientService.exe
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.Client.dll
- C:\Config.Msi\23706.rbs
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.ClientService.exe.config
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.WindowsClient.exe
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.Windows.dll
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.Core.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\5ipo3sts.newcfg
- %TEMP%\~DF2DC2.tmp
- %WINDIR%\Installer\{3E306860-9429-4BFD-87FF-C5A295AA8AA3}\DefaultIcon
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\a32ggksl.newcfg
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\c2kwh0lv.newcfg
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\fvftg3f2.newcfg
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\kwb5gqik.newcfg
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Client.Override.en-US.resources
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Client.en-US.resources
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.WindowsClient.exe.config
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Client.Override.resources
- %WINDIR%\Installer\23707.msi
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\0tny3frl.newcfg
- %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Client.resources
- %WINDIR%\Installer\23704.msi
- %TEMP%\MSI2.tmp-\CustomAction.config
- %TEMP%\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\setup.msi
- %TEMP%\VSD1.tmp\install.log
- %TEMP%\VSD1.tmp\DotNetFXCustom\dotnetchk.exe
- %TEMP%\21ed8.msi
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll
- %TEMP%\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %WINDIR%\Installer\23705.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %TEMP%\~DFB967.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
Deletes the following files:
- C:\Config.Msi\23706.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\23704.msi
- %TEMP%\21ed8.msi
- %WINDIR%\Installer\23705.ipi
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.Core.dll
- %TEMP%\MSI2.tmp-\CustomAction.config
- %TEMP%\MSI2.tmp-\Elsinore.ScreenConnect.InstallerActions.dll
- %TEMP%\MSI2.tmp
- %TEMP%\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Moves the following files:
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\kwb5gqik.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\fvftg3f2.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\c2kwh0lv.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\0tny3frl.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\5ipo3sts.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
- from %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\a32ggksl.newcfg to %ProgramFiles%\ScreenConnect Client (804407612a5c368e)\user.config
Network activity:
Connects to:
- 'wp#d':80
- '72.##.220.26':8041
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.WindowsClient.exe' "RunRole" "9b2b4b28-50b7-42fd-a9fa-857805f281bb" "User"
- '%ProgramFiles%\ScreenConnect Client (804407612a5c368e)\Elsinore.ScreenConnect.ClientService.exe' "?e=Access&y=Guest&h=72.15.220.26&p=8041&s=23c81ba2-4852-41e8-80e1-27cc5e735d8f&k=BgIAAACkAABSU0ExAAgAAAEAAQDrqNnasASuwqUCfrzcQh4yuSmCrsF9FliOyQgIC0qWsrVALA2V%2bfycgqwfIWf72m0P2C4x5Krpqo37AtcnK...
- '%TEMP%\VSD1.tmp\DotNetFXCustom\dotnetchk.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 275EFCAA1C42C9202481745E1512539F C
- '<SYSTEM32>\rundll32.exe' "%TEMP%\MSI2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_142109 1 Elsinore.ScreenConnect.InstallerActions!Elsinore.ScreenConnect.ClientInstallerActions.FixupServiceArguments
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\setup.msi"
- '<SYSTEM32>\msiexec.exe' /V
