Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\sc-889498e81de65574\shell\open\command] '' = '"%ProgramFiles(x86)%\ScreenConnect Client (889498e81de65574)\ScreenConnect.WindowsClient.exe" "%1"'
- [HKLM\SYSTEM\CurrentControlSet\Control\Lsa] 'Authentication Packages' = 'msv1_0\n%ProgramFiles(x86)%\ScreenConnect Client (889498e81de65574)\ScreenConnect.WindowsAuthenticationPackage.dll'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (889498e81de65574)] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\ScreenConnect Client (889498e81de65574)] 'ImagePath' = '"%ProgramFiles(x86)%\ScreenConnect Client (889498e81de65574)\ScreenConnect.ClientService.exe" "?e...
Creates the following services
- 'ScreenConnect Client (889498e81de65574)' "%ProgramFiles(x86)%\ScreenConnect Client (889498e81de65574)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-lr7xse-relay.screenconnect.com&p=443&s=c57b46ca-7653-4f3e-a118-483924...
Modifies file system
Creates the following files
- %TEMP%\screenconnect\24.4.2.9083\889498e81de65574\screenconnect.clientsetup.msi
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\system.config
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\client.resources
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\client.en-us.resources
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.clientservice.exe
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsfilemanager.exe.config
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsfilemanager.exe
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowscredentialprovider.dll
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsclient.exe.config
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsclient.exe
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsbackstageshell.exe.config
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsbackstageshell.exe
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsauthenticationpackage.dll
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windows.dll
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.core.dll
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.clientservice.dll
- %ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.client.dll
- %TEMP%\msi2cd.tmp-\customaction.config
- %TEMP%\msi2cd.tmp-\microsoft.deployment.compression.cab.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.compression.dll
- %TEMP%\msi2cd.tmp-\screenconnect.windows.dll
- %TEMP%\msi2cd.tmp-\screenconnect.core.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi2cd.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi2cd.tmp
- %WINDIR%\installer\{aa581b3b-0dea-819f-3635-efabc84575ba}\defaulticon
- %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (889498e81de65574)\s4nejzmu.newcfg
Deletes the following files
- %TEMP%\msi2cd.tmp-\customaction.config
- %TEMP%\msi2cd.tmp-\microsoft.deployment.compression.cab.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.compression.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.windowsinstaller.dll
- %TEMP%\msi2cd.tmp-\microsoft.deployment.windowsinstaller.package.dll
- %TEMP%\msi2cd.tmp-\screenconnect.core.dll
- %TEMP%\msi2cd.tmp-\screenconnect.installeractions.dll
- %TEMP%\msi2cd.tmp-\screenconnect.windows.dll
- %TEMP%\msi2cd.tmp
Moves the following files
- from %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (889498e81de65574)\s4nejzmu.newcfg to %WINDIR%\syswow64\config\systemprofile\appdata\local\screenconnect client (889498e81de65574)\user.config
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Network activity
Connects to
- 'in#########7xse-relay.screenconnect.com':443
TCP
Other
- 'in#########7xse-relay.screenconnect.com':443
UDP
- DNS ASK in#########7xse-relay.screenconnect.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.clientservice.exe' "?e=Access&y=Guest&h=instance-lr7xse-relay.screenconnect.com&p=443&s=c57b46ca-7653-4f3e-a118-4839249965fa&k=BgIAAACkAABSU0ExAAgAAAEAAQCFombNuJswrtXPgUl0qB%2fzxT1ELRgXc8hVEzF47nYuczeAKgh6EToIsPZ...
- '%ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsclient.exe' "RunRole" "b7e1f59e-8b17-4a9d-87c7-1ddcd3fe3ebf" "User"
- '%ProgramFiles(x86)%\screenconnect client (889498e81de65574)\screenconnect.windowsclient.exe' "RunRole" "28e32be2-713c-4e9d-a87a-9f7681a54b67" "System"
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\ScreenConnect\24.4.2.9083\889498e81de65574\ScreenConnect.ClientSetup.msi"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\MSI2CD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_984600 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
