Analysis
- max time kernel
91s - max time network
137s - platform
windows7_x64 - resource
win7v20210410 - submitted
05/08/2021, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
Mosef.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Mosef.msi
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target Mosef.msi
- Size 1.8MB
- Sample210805-byap2d2mj2
- SHA256 ed4544f9e5b144199882d21bf0fd0aeed19f3277b2f1a4c0e3be785cf4397d41
- MD5 8dfe116e4f82d6a6a69a25327091470f
- SHA1 0bafcf344679e3113db922a92e4f70fee90350cd
- SHA512 786a50d15619cfe770e3a2f5afe4d04daa9431ca19c2f8552611c12d93a5c57a9e4cc352b4d13ff162a00b648d7b25689dd362df5825bb51696bbf07453c4c4a
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 808 ScreenConnect.ClientService.exe 2192 ScreenConnect.WindowsClient.exe 2304 ScreenConnect.WindowsClient.exe - Loads dropped DLL 28 IoCs
pid Process 460 MsiExec.exe 412 rundll32.exe 412 rundll32.exe 412 rundll32.exe 412 rundll32.exe 412 rundll32.exe 412 rundll32.exe 412 rundll32.exe 1868 MsiExec.exe 1868 MsiExec.exe 1868 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.Core.dll msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\f742f5b.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI30FF.tmp msiexec.exe File created C:\Windows\Installer\{D0BFA4A5-DC8D-4E86-8402-A8DBEB769B0F}\DefaultIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f742f5a.msi msiexec.exe File created C:\Windows\Installer\wix{D0BFA4A5-DC8D-4E86-8402-A8DBEB769B0F}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\f742f5d.msi msiexec.exe File opened for modification C:\Windows\Installer\{D0BFA4A5-DC8D-4E86-8402-A8DBEB769B0F}\DefaultIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3288.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3258.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3577.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3874.tmp msiexec.exe File opened for modification C:\Windows\Installer\f742f5b.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f742f5a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3100.tmp msiexec.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 53 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ScreenConnect.WindowsClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (610bb2498d20c72a)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A4AFB0DD8CD68E448208ABDBE67B9F0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\PackageCode = "5F256775B6DFB0344B7685827CF55A3D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8E6F9BF3C5734FF16B02B94D8027CA2 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A4AFB0DD8CD68E448208ABDBE67B9F0\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\ProductName = "ScreenConnect Client (610bb2498d20c72a)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\Version = "352915367" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\ProductIcon = "C:\\Windows\\Installer\\{D0BFA4A5-DC8D-4E86-8402-A8DBEB769B0F}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\PackageName = "Mosef.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-610bb2498d20c72a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8E6F9BF3C5734FF16B02B94D8027CA2\5A4AFB0DD8CD68E448208ABDBE67B9F0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-610bb2498d20c72a\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-610bb2498d20c72a\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4AFB0DD8CD68E448208ABDBE67B9F0\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2008 msiexec.exe 2008 msiexec.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe 808 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 2008 msiexec.exe Token: SeTakeOwnershipPrivilege 2008 msiexec.exe Token: SeSecurityPrivilege 2008 msiexec.exe Token: SeCreateTokenPrivilege 1964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1964 msiexec.exe Token: SeLockMemoryPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeMachineAccountPrivilege 1964 msiexec.exe Token: SeTcbPrivilege 1964 msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeLoadDriverPrivilege 1964 msiexec.exe Token: SeSystemProfilePrivilege 1964 msiexec.exe Token: SeSystemtimePrivilege 1964 msiexec.exe Token: SeProfSingleProcessPrivilege 1964 msiexec.exe Token: SeIncBasePriorityPrivilege 1964 msiexec.exe Token: SeCreatePagefilePrivilege 1964 msiexec.exe Token: SeCreatePermanentPrivilege 1964 msiexec.exe Token: SeBackupPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeDebugPrivilege 1964 msiexec.exe Token: SeAuditPrivilege 1964 msiexec.exe Token: SeSystemEnvironmentPrivilege 1964 msiexec.exe Token: SeChangeNotifyPrivilege 1964 msiexec.exe Token: SeRemoteShutdownPrivilege 1964 msiexec.exe Token: SeUndockPrivilege 1964 msiexec.exe Token: SeSyncAgentPrivilege 1964 msiexec.exe Token: SeEnableDelegationPrivilege 1964 msiexec.exe Token: SeManageVolumePrivilege 1964 msiexec.exe Token: SeImpersonatePrivilege 1964 msiexec.exe Token: SeCreateGlobalPrivilege 1964 msiexec.exe Token: SeCreateTokenPrivilege 1964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1964 msiexec.exe Token: SeLockMemoryPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeMachineAccountPrivilege 1964 msiexec.exe Token: SeTcbPrivilege 1964 msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeLoadDriverPrivilege 1964 msiexec.exe Token: SeSystemProfilePrivilege 1964 msiexec.exe Token: SeSystemtimePrivilege 1964 msiexec.exe Token: SeProfSingleProcessPrivilege 1964 msiexec.exe Token: SeIncBasePriorityPrivilege 1964 msiexec.exe Token: SeCreatePagefilePrivilege 1964 msiexec.exe Token: SeCreatePermanentPrivilege 1964 msiexec.exe Token: SeBackupPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeDebugPrivilege 1964 msiexec.exe Token: SeAuditPrivilege 1964 msiexec.exe Token: SeSystemEnvironmentPrivilege 1964 msiexec.exe Token: SeChangeNotifyPrivilege 1964 msiexec.exe Token: SeRemoteShutdownPrivilege 1964 msiexec.exe Token: SeUndockPrivilege 1964 msiexec.exe Token: SeSyncAgentPrivilege 1964 msiexec.exe Token: SeEnableDelegationPrivilege 1964 msiexec.exe Token: SeManageVolumePrivilege 1964 msiexec.exe Token: SeImpersonatePrivilege 1964 msiexec.exe Token: SeCreateGlobalPrivilege 1964 msiexec.exe Token: SeCreateTokenPrivilege 1964 msiexec.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1964 msiexec.exe 1964 msiexec.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe 2192 ScreenConnect.WindowsClient.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 2008 wrote to memory of 460 2008 msiexec.exe 30 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 460 wrote to memory of 412 460 MsiExec.exe 31 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1868 2008 msiexec.exe 36 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 2008 wrote to memory of 1904 2008 msiexec.exe 37 PID 808 wrote to memory of 2192 808 ScreenConnect.ClientService.exe 39 PID 808 wrote to memory of 2192 808 ScreenConnect.ClientService.exe 39 PID 808 wrote to memory of 2192 808 ScreenConnect.ClientService.exe 39 PID 808 wrote to memory of 2192 808 ScreenConnect.ClientService.exe 39 PID 808 wrote to memory of 2304 808 ScreenConnect.ClientService.exe 40 PID 808 wrote to memory of 2304 808 ScreenConnect.ClientService.exe 40 PID 808 wrote to memory of 2304 808 ScreenConnect.ClientService.exe 40 PID 808 wrote to memory of 2304 808 ScreenConnect.ClientService.exe 40
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Mosef.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56864333BB5138F8B2D9ADC0520EC8A4 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1B8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259267811 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:412
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD1729A3D0F5DB03AA2285985E17C4492⤵
- Loads dropped DLL
PID:1868
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 710C2EB6DFDC24DB0EF17DA703B1053A M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1904
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:972
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "0000000000000398" "00000000000005AC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:368
-
C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-is1nzn-relay.screenconnect.com&p=443&s=a752621b-9284-41c6-b0bc-6cb2a77c1235&k=BgIAAACkAABSU0ExAAgAAAEAAQBlkNEsf%2fWOhTpMjWFUyUY%2f%2bIvnGSFaxC1KZBc%2bszEV6uLMKnJTIRJJ18rzBbnTEbsDtc7UsZ96BrRZWRqnvbdYtkft9l1jBJpv7k%2fQIuVTiDC8HK7jcZXXIHZrryW1uFdKaMDAhDzGSe8wua007tbeyhjBU%2b2M7Aadvgk8Lrf9rrqXyGvfA7F3BBC9SEq8msMDHtz8g8AlXcShfIzhuRcRfbB8t7zm%2bCSKWS8ZuTf%2fxZ0USuft9SURqE45BHP0tZT4CsDxUXlmoJoQgH3Q8XYGOqWE2RbV09a2iUVN4Yx3fZohWHc%2bWgZzz6BKsgfphiWU%2fPPwles961xrHD42ABWx&t=&c=stc&c=khaled&c=stc&c=pc&c=&c=&c=&c="1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe" "RunRole" "43478e5f-e4c7-46ad-b434-3b48d3b48d44" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192
-
-
C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (610bb2498d20c72a)\ScreenConnect.WindowsClient.exe" "RunRole" "ba4ad066-8d48-42e1-8d48-e3a9af3f18b8" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2304
-