caca9bf2a15da2e26fae327668e175279d57b26556a01b7b71beae4233a2849f

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (0a1cfe17eac896bf)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (0a1cfe17eac896bf)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-b5lwpw-relay.screenconnect.com&p=443&s=c66973a1-efcb-4721-8599-53fabeb4dfe0&k=BgIAAACkAABSU0ExAAgAAAEAAQCBEXpmMGm1D3InXFr1sRAQDkVGxS4TfvYimB7%2bHbP7MUHYpv81VqYsC9Q90NO3qQYG3HGJYy06gKx8dPxvqYRI4D06hQ%2fCHgXxWAHFaeUNVKnm7xcfXSKTFBJDBGCs%2bqzjphqOPkCp21mfzyBr1FMXznaCREVxcPD%2bLMN1p82LKW5mGif6U2Q1DqW8PsRn0h7kVD1Kd2cPCwVE5bgD7HQkEPHOCIKUfalSM%2fBYU17aXZ5NVt%2bNx4auXbg4xVuj9y60BYU1bZQli9hGhFbr%2byRh%2filGb%2bDvpECnbseW8IXPWphuLJgXAtGRC%2bME3%2fOV29Az6f6OjlZHCRWFSSAZFWKb&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAALTV30uwbNkaI9W2zs0ARMwAAAAACAAAAAAAQZgAAAAEAACAAAABYOGVCkrWZN7EMetk3tN6supkqpa3DjEJQVTulGglh0AAAAAAOgAAAAAIAACAAAABn6XWhwHzhTNXUbASdrOm5PfqhzzkUdD%2fGH4O1VhAgb6AEAACiCIBaPsK5EKENRFf2qMO78D7OV89rg%2f9%2fBgLRWhUHK9Pd%2b%2bIa14FbQ9UEklhKB5MmzL7AjJZXB8vrtHNWJtEBywoBflgyhiwhDXGpzLv1Xi1qCj8bFuBRshJaunE84IqBckFBjiU7W2i2%2b3OldKPU0ExSkyNtMf1CAZ9snfsLx13%2fw3Vq%2btYI1hwT%2bZLJ80QgRRBB1Tcv0HJg2F%2fWFibt56XyKs%2f1hkHZwhJjsE1S0QA1eykMVMY6EjyPwaTe4XiyfeMfQGtQBv003McMGfI1rDG6vzHVMqg%2bjnTd5H9jkvy4EDMC2IZcp2wIhvOtRkuHZya%2fEswKL0%2f9RmHDYgYMtzePDtrro%2f%2f1nLvfDNwDp7HGuGsyxN%2flEYldZxnxoLa2sC3QwOWrCIdAJS2jYgBwTUpv0ZFBo5cbr03mBaZ1DXBxZUhdSi1ngxto%2bxl9n1Dp5UEjuyR%2bt0PIMbTW3e1JneeDP7VyVukavnKRg6TQSiRma%2fNcUsqkVcZ8hjS9V3B%2fiQuXQdSfbZ4bDqG3knT6g15RxkE8rmk1PN0bkKgNea7TloQhGOV0F1MN4U5OanpRREQSsq7RbCpUnq8pC34iUgLt%2fVPVCpWoj1upYjkGL3DIZdjs8jnwTOfMc1CWFzo9bqzKoiWFxx41y50qby%2bzG9Kcw%2bNW6t5Za37k4Qj6zrPH%2boK5AM3VUVlco2t8gz2uXdyOzJpJhLHL%2bf%2b40ziiK8d1oLI06A0zDjXuC8HERvNZiU5Oi8hc5FEefhgbe%2fIq%2fbRrqlXoYauOrt8qjT275Aa0uiAsxkvsdsoqpO2sKRWsKrU1I55%2bRxiYk8pJwdF57Wuc6FTIaHxiLhwXVtHcAjCUsuqE93qXEgWa5XRvnfHKXCmGRgtUtL6ZLF1yVqrQRhlas2c8R2hkeNB8tp0Y8hF5ANM%2fEDnfytTm2wyMSKny32Ox%2fS9u7rZaHvn6r9SZmhts0i7adi2a%2fgInNqEQPHrYEmFZeB7x4MlJrNXQnH3z8VxiiVd6DaNKeC42gBCR9QQ2cti6yn1v8nX4tH9DC6lGCP3d0huj63vaXvKAQp3nLABsNlrpOfHZ7Egzy8d4HQlMCFKpr2yz4qnsHdErRwl9P5NbmTBR1p1Jwaqf7caHM5kNGE8Twj8erbEyS7hg5G0uMvr7NwhtHi33sEn4zZkvDzGEAkjJydy4cCO66Ljuycw8%2furjQ3EQhjqGKfBHQk5zReUfFD6gsk07uiO0YFdUjwDi7EUW6RohB8PhREFhYUBysPXM2IckBYPiWnvAwSRNItr1ojqipJNutEM4yS9AV94Ze3%2byExyYPvmadFw68PE4POAAYLGYG2%2b8f%2bmbLu8U7k5EBoJuBGtq2sIfDYJAXtWhULcjq%2bs4PdfhYaSaAKfBKBjtEe21N%2f%2ftHyYJm87oCEDTNC9279dbAyyvutlBFFCVDIWSczeliou27mM9y7OB18CHyTG5%2f6FXk2LdXit0caHvX97YkDmKuo%2b864E0UdfBseB9HeH04JJb3o04JggM%2fDIvVsrWjo207LCAH84TedJpU7h5SxgobrvSrE%2b%2b3%2bANRQpvj9vZ%2fBlrmUAAAABh3uz29Z0WV%2bO3GvFh%2fJNN%2bRwW5Fj2yvUY8h1ElN0fEczyC9O6T2UbFdBHSVdH6UQw7RBbaS3X7s1cDaDR8Rxz\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (0a1cfe17eac896bf)\eoa13bcy.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (0a1cfe17eac896bf)\eoa13bcy.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{14354D32-6A2D-6C80-8350-7287C064EA51}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\f763c0a.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f763c08.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E1C.tmp	msiexec.exe
File created	C:\Windows\Installer\f763c07.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f763c07.msi	msiexec.exe
File created	C:\Windows\Installer\{14354D32-6A2D-6C80-8350-7287C064EA51}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{14354D32-6A2D-6C80-8350-7287C064EA51}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3CA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f763c08.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
2600	ScreenConnect.ClientService.exe
1544	ScreenConnect.WindowsClient.exe
840	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

pid	Process
2664	MsiExec.exe
2828	rundll32.exe
2828	rundll32.exe
2828	rundll32.exe
2828	rundll32.exe
2828	rundll32.exe
2828	rundll32.exe
2828	rundll32.exe
2176	MsiExec.exe
2036	MsiExec.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (0a1cfe17eac896bf)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\ProductName = "ScreenConnect Client (0a1cfe17eac896bf)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\573FE40DB0CF054FA0C1EF71AE8C69FB\23D45341D2A608C6380527780C46AE15	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\ = "ScreenConnect Client (0a1cfe17eac896bf) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\PackageCode = "23D45341D2A608C6380527780C46AE15"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\ProductIcon = "C:\\Windows\\Installer\\{14354D32-6A2D-6C80-8350-7287C064EA51}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\23D45341D2A608C6380527780C46AE15\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-0a1cfe17eac896bf\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (0a1cfe17eac896bf)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\23D45341D2A608C6380527780C46AE15	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\Version = "386400261"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\573FE40DB0CF054FA0C1EF71AE8C69FB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-0a1cfe17eac896bf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-0a1cfe17eac896bf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9245-E33A7DE64699}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (0a1cfe17eac896bf)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23D45341D2A608C6380527780C46AE15\InstanceType = "0"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1544	ScreenConnect.WindowsClient.exe
840	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2796	msiexec.exe
2796	msiexec.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe
2600	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1940	msiexec.exe
Token: SeRestorePrivilege	2796	msiexec.exe
Token: SeTakeOwnershipPrivilege	2796	msiexec.exe
Token: SeSecurityPrivilege	2796	msiexec.exe
Token: SeCreateTokenPrivilege	1940	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1940	msiexec.exe
Token: SeLockMemoryPrivilege	1940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1940	msiexec.exe
Token: SeMachineAccountPrivilege	1940	msiexec.exe
Token: SeTcbPrivilege	1940	msiexec.exe
Token: SeSecurityPrivilege	1940	msiexec.exe
Token: SeTakeOwnershipPrivilege	1940	msiexec.exe
Token: SeLoadDriverPrivilege	1940	msiexec.exe
Token: SeSystemProfilePrivilege	1940	msiexec.exe
Token: SeSystemtimePrivilege	1940	msiexec.exe
Token: SeProfSingleProcessPrivilege	1940	msiexec.exe
Token: SeIncBasePriorityPrivilege	1940	msiexec.exe
Token: SeCreatePagefilePrivilege	1940	msiexec.exe
Token: SeCreatePermanentPrivilege	1940	msiexec.exe
Token: SeBackupPrivilege	1940	msiexec.exe
Token: SeRestorePrivilege	1940	msiexec.exe
Token: SeShutdownPrivilege	1940	msiexec.exe
Token: SeDebugPrivilege	1940	msiexec.exe
Token: SeAuditPrivilege	1940	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1940	msiexec.exe
Token: SeChangeNotifyPrivilege	1940	msiexec.exe
Token: SeRemoteShutdownPrivilege	1940	msiexec.exe
Token: SeUndockPrivilege	1940	msiexec.exe
Token: SeSyncAgentPrivilege	1940	msiexec.exe
Token: SeEnableDelegationPrivilege	1940	msiexec.exe
Token: SeManageVolumePrivilege	1940	msiexec.exe
Token: SeImpersonatePrivilege	1940	msiexec.exe
Token: SeCreateGlobalPrivilege	1940	msiexec.exe
Token: SeCreateTokenPrivilege	1940	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1940	msiexec.exe
Token: SeLockMemoryPrivilege	1940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1940	msiexec.exe
Token: SeMachineAccountPrivilege	1940	msiexec.exe
Token: SeTcbPrivilege	1940	msiexec.exe
Token: SeSecurityPrivilege	1940	msiexec.exe
Token: SeTakeOwnershipPrivilege	1940	msiexec.exe
Token: SeLoadDriverPrivilege	1940	msiexec.exe
Token: SeSystemProfilePrivilege	1940	msiexec.exe
Token: SeSystemtimePrivilege	1940	msiexec.exe
Token: SeProfSingleProcessPrivilege	1940	msiexec.exe
Token: SeIncBasePriorityPrivilege	1940	msiexec.exe
Token: SeCreatePagefilePrivilege	1940	msiexec.exe
Token: SeCreatePermanentPrivilege	1940	msiexec.exe
Token: SeBackupPrivilege	1940	msiexec.exe
Token: SeRestorePrivilege	1940	msiexec.exe
Token: SeShutdownPrivilege	1940	msiexec.exe
Token: SeDebugPrivilege	1940	msiexec.exe
Token: SeAuditPrivilege	1940	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1940	msiexec.exe
Token: SeChangeNotifyPrivilege	1940	msiexec.exe
Token: SeRemoteShutdownPrivilege	1940	msiexec.exe
Token: SeUndockPrivilege	1940	msiexec.exe
Token: SeSyncAgentPrivilege	1940	msiexec.exe
Token: SeEnableDelegationPrivilege	1940	msiexec.exe
Token: SeManageVolumePrivilege	1940	msiexec.exe
Token: SeImpersonatePrivilege	1940	msiexec.exe
Token: SeCreateGlobalPrivilege	1940	msiexec.exe
Token: SeCreateTokenPrivilege	1940	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1940	msiexec.exe
1940	msiexec.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2796 wrote to memory of 2664	2796	msiexec.exe	21
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2664 wrote to memory of 2828	2664	MsiExec.exe	25
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2176	2796	msiexec.exe	34
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2796 wrote to memory of 2036	2796	msiexec.exe	35
PID 2600 wrote to memory of 1544	2600	ScreenConnect.ClientService.exe	37
PID 2600 wrote to memory of 1544	2600	ScreenConnect.ClientService.exe	37
PID 2600 wrote to memory of 1544	2600	ScreenConnect.ClientService.exe	37
PID 2600 wrote to memory of 1544	2600	ScreenConnect.ClientService.exe	37
PID 2600 wrote to memory of 840	2600	ScreenConnect.ClientService.exe	38
PID 2600 wrote to memory of 840	2600	ScreenConnect.ClientService.exe	38
PID 2600 wrote to memory of 840	2600	ScreenConnect.ClientService.exe	38
PID 2600 wrote to memory of 840	2600	ScreenConnect.ClientService.exe	38

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7E1D733A385595EB1474E1B99DF1517 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2211.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259400287 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    PID:2828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F352DE56717456F8246EAAE9CE9F1381
  2⤵
  - Loads dropped DLL
  PID:2176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADDEA5562710D9BA85F117D0A4DB1842 M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:2036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2616

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A4" "000000000000058C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2864

C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-b5lwpw-relay.screenconnect.com&p=443&s=c66973a1-efcb-4721-8599-53fabeb4dfe0&k=BgIAAACkAABSU0ExAAgAAAEAAQCBEXpmMGm1D3InXFr1sRAQDkVGxS4TfvYimB7%2bHbP7MUHYpv81VqYsC9Q90NO3qQYG3HGJYy06gKx8dPxvqYRI4D06hQ%2fCHgXxWAHFaeUNVKnm7xcfXSKTFBJDBGCs%2bqzjphqOPkCp21mfzyBr1FMXznaCREVxcPD%2bLMN1p82LKW5mGif6U2Q1DqW8PsRn0h7kVD1Kd2cPCwVE5bgD7HQkEPHOCIKUfalSM%2fBYU17aXZ5NVt%2bNx4auXbg4xVuj9y60BYU1bZQli9hGhFbr%2byRh%2filGb%2bDvpECnbseW8IXPWphuLJgXAtGRC%2bME3%2fOV29Az6f6OjlZHCRWFSSAZFWKb"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe" "RunRole" "ff4cd665-11d9-4687-a5d9-e4331c3b513d" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:1544
- C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe" "RunRole" "527c7991-4465-4edd-a9a4-6e56595e3c9f" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery