Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 07:03
General
-
Target
setup.msi
-
Size
10.2MB
-
MD5
617299f27fdc8b8484abd9967a707cce
-
SHA1
31118c3a74526862f727e41b30997289661ef634
-
SHA256
caca9bf2a15da2e26fae327668e175279d57b26556a01b7b71beae4233a2849f
-
SHA512
5a77b4fcc25f9f94bef60c32e42bfb421a909c7d6ba86e057620cddc347b4927c46329f6b116a0ad8d15508fb7c01816b5678d808b8109781fbbb457050b5cd1
-
SSDEEP
98304:XAMvSQwxDnl2dYds9GLIeDT3OF6zbAMvSQwxDnl2dYds7AMvSQwxDnl2dYdsVAMf:LnEPDT3wonnnJntnbn
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 13 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 20 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 13 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 399EA8B4558392A44333E98B3497ABCE C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI784D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240614031 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ED20A598D70D9CA201E2F78AE2D80DA22⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 90EF95AB37A324290EB12C0AF6A99381 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-b5lwpw-relay.screenconnect.com&p=443&s=14a2dd62-5a12-4976-9f2d-572ca360ab47&k=BgIAAACkAABSU0ExAAgAAAEAAQCBEXpmMGm1D3InXFr1sRAQDkVGxS4TfvYimB7%2bHbP7MUHYpv81VqYsC9Q90NO3qQYG3HGJYy06gKx8dPxvqYRI4D06hQ%2fCHgXxWAHFaeUNVKnm7xcfXSKTFBJDBGCs%2bqzjphqOPkCp21mfzyBr1FMXznaCREVxcPD%2bLMN1p82LKW5mGif6U2Q1DqW8PsRn0h7kVD1Kd2cPCwVE5bgD7HQkEPHOCIKUfalSM%2fBYU17aXZ5NVt%2bNx4auXbg4xVuj9y60BYU1bZQli9hGhFbr%2byRh%2filGb%2bDvpECnbseW8IXPWphuLJgXAtGRC%2bME3%2fOV29Az6f6OjlZHCRWFSSAZFWKb"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe" "RunRole" "2c16b0b9-bdb2-41e2-968f-abc6068a12cf" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (0a1cfe17eac896bf)\ScreenConnect.WindowsClient.exe" "RunRole" "5397a9bb-c85a-40ce-9572-2d1e1018024d" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5ff1b19c0be8d8f176dcdbefdab0ae2e0
SHA1887f455dfccd6b03f94c03368c6a395b7fd2a79f
SHA256d3f1fa2e436c711669b2e2acd8d0ff255656a1fc9b4cee1922475a83c41d7b46
SHA5124438fd10663d34414f31a9e8220447b2b259e7d629347fd0e4eaa487e4f23e3e4402b0ea6f696142ac9d949ad778761a7d42ca5530b8f5228589637b4b6a51f6
-
Filesize
251B
MD57857331bd82d84f45630bffc739ddfa6
SHA191f74b971b2c66efebf2495fdff3c5f7c707a7c3
SHA256f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
SHA5127b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
-
Filesize
47KB
MD526f4eb71380f8e033c74ed8c57d0ad9d
SHA1d94252e86215a4a2e29f081cecd335d48bbd7a9c
SHA256179b6d08519b3e56dce0cc0096f31e9751d74b7875e030a3b2d01c189be0108d
SHA5128d36cad523e6847d055caa35535388008633187078c55625f32548016ffd2ba9f5528fe2df2c97d6c9e3e08ac432f8156d59da334acfec4142a44b4a4421a897
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
188KB
MD5ca2857bac072baec93fbf23e5fcff956
SHA1049f21dfe97f5dc247b0c7a29e22111dc4c63aad
SHA25604a6ba13d7f014c6650a05c55f7fef2d465903ab900bc37a2a28f4bf08a658c0
SHA51296bdfe18334b9837223da8ebb7f671abde9559f6e5150854025315bcccc09133c50939cb0e62ff16219d45b77711baa3c3c278edacda4584960e9c06e63e20f1
-
Filesize
59KB
MD5a9d86db5d9c735d6dcc83e979ab64a7d
SHA1e4f945e799d9bf5fc103f65d8ca832290b5ab03c
SHA256083eb9b90e04e39514c50e296593c3652f05cf3fe3ba41cb7adeed82930e4ddf
SHA512ceceeea84b266ca389562fcbbc4fa24bb4b44093289b0a67e60bf4506c2a554087fb2ee9ee607e29efb8912a26ce65c3457a14c23c4d742181b3795a3a6338b4
-
Filesize
93KB
MD589d3d099b6d8731bd1b7f5a68b5bf17c
SHA1c6aed886840aafd08796207e2646d8805d012b81
SHA256bcaa3d8dcba6ba08bf20077eadd0b31f58a1334b7b9c629e475694c4eeafd924
SHA5126cb52828006ef2d41b9acc2a8a8e84b2d5f0bee0304cc8762d5945a1e21023373371893a261d089599799ebe89cbe0da5327ee80d5db07a936727ea21fb0951a
-
Filesize
832KB
MD554eaa5f0f64a9d103ab002191f64c51f
SHA18c7567e1b96c04c3c01bc8d19ee9280ae66bc10c
SHA256e5a6b40ebb298064d8772376089649f8123ba7e62a491ac72f79ce7e3155bbf2
SHA512d98839abb5c9c8dfe54d407a47d2f798d3f24be63d5df838ba6bb8171f400dc1896c1bb40fd17898ef60ac1f3452e84f9ecf1b2aa8fc7b7068c91d13355ba830
-
Filesize
704KB
MD50720436943d4b8d928bbdb9b4d58c2e1
SHA1ed11724eefe621f91f1b3bcf43272a269b38cd3f
SHA256b389e89c1f2aef402010f2df4323ed030c6d6ce15163ddaaa51c759a9e1d9152
SHA512e8f8a5689526c6a8b13d4ffc078f1f2a043fae8318224acd2b2eeb7c16758f98830cac9dc9a8636ac009b0c98aa46dfede38b3f262198f446e0b1130a29f3e0f
-
Filesize
572KB
MD519e093bc974d1ed6399f50b7fa3be1f8
SHA111e0b01858dc2ed0d1b5854ebeb09a332a36ed93
SHA256ea38cff329692f6b4c8ade15970b742a9a8bb62a44f59227c510cb2882fa436f
SHA512d2e4c543ddf850b5c54d2de5dea03de77fdb4a852a377b0e35146e733cfd1cb198a8afc88cb55fed20e87ac6ae7ed8ea0198f0049a0fc400615ac32bb153cc6a
-
Filesize
266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
Filesize
746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
1KB
MD5fb5648fb1b03436a3bc2d7976e303958
SHA14f2d86e66085c0376f088784280f116434be478e
SHA2568019b1ef68f4566f805dc9891a93f3b290f2c8a3d57cbc3263923479ad7f19d1
SHA51273fbb65fd7d2c6eb93a41676ba566f610a7dd60ecd827dd7c0e7436288636ee60c92e8aad5c61ca08b04e7d51b50adb0c66c91bd3b59a96b61b1683b40bf5b1e
-
Filesize
966B
MD53a44259b9ca701fa74ffb8269deffbfe
SHA1e83a9d139e2fc745e21d59ce5d3ad0087f9fdbb6
SHA25608f903e4d90e51cd06b11d7c13f9119f5d0589894cc39c99e612baa963418e41
SHA51218a96daf044c53725622e817ac382fcde24e074b1fdc8da3294c54896c863442bd3f47317a7861469249a923ed557d8b405c3404d927ef0e880cb96107c9f8b3
-
Filesize
1015KB
MD55c1b123df7123061ca1f1cdb31ce36cb
SHA11421db694e8c2a3af066d6317282157d2c05e3b6
SHA256d40ae98a7d18c2c35c0355984340b0517be47257c000931093a4fc3ccc90c226
SHA512866979a543ac413dbeadce82e9ab35ffe5f4d0f69fc61ef2c4f8761030a126abfab4db053669df7e7a602e3753842a7315c17881d2a333d0abea51d8ef3041e8
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
518KB
MD5469a702d0861e2c63e6e6e575c58e399
SHA106cf299c7dc7867c9584647f5ba681aec6c469d4
SHA256affb342d2dce754b4ddbeeb4ed344806fda531d68346df12629b7bd8c0fa753c
SHA51290fa0f0bbb3076f770354fc6f870c302c2c3a7e2ea010dc451cbd4dd0d417aa360f57ddfe003ea634efa38a7e34b63236ffe1addb4738fac16cff798c940b016
-
Filesize
21KB
MD541e8c80a7f1bf4911fce55c0de249302
SHA121d6f8ddc242a55c4894127bbef0479fea1d6847
SHA256569b267d8c4cef1b26c9337f5a355f0040ad4d7e9610f28784e4af05efa3e4e9
SHA512d2f375e9956d46db0fc4e0162ea894ad8598512a3de93537579ddcd8872fc8160751a4ada37bbc9f61b78414e5d241dfb2e036f2200bff4de70ac1a417aaa240
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
10.2MB
MD5617299f27fdc8b8484abd9967a707cce
SHA131118c3a74526862f727e41b30997289661ef634
SHA256caca9bf2a15da2e26fae327668e175279d57b26556a01b7b71beae4233a2849f
SHA5125a77b4fcc25f9f94bef60c32e42bfb421a909c7d6ba86e057620cddc347b4927c46329f6b116a0ad8d15508fb7c01816b5678d808b8109781fbbb457050b5cd1
-
Filesize
12.3MB
MD55971051fcd9edcd217fd391eb4b615cd
SHA11b51f283d00ee49440f36994c2f4ef10648687ea
SHA2560f14c297ac6dac0cc9ad953fb950c174063f0db0695d4b8b1d818583a2dae828
SHA512814f3761b1112d3693838fa9fe1b8a861eb56135e5aa22b0e4efd975917c7a492be7dae2da8584ccf91d6f3bd4fb30a317014e05748b2fc7770e1cf7d6e2cb87
-
Filesize
6KB
MD5fbc2ebd164cf569403d48a2c9eda215a
SHA1631e879bf577c21ecd007d3469b44da5eaa12098
SHA2561849ee11345a5996225459e3954a368df79fb583f20df4570c6bc5a5cbf262a9
SHA512079b3640c8613e220ad4fa4de5998d0e4554e1074721736e808c3a98d7d3df74f481f426a2ac39213b5d0db01831402180dd15567664e36099b3e6e94cfd1625
-
Filesize
1.5MB
-
Filesize
592KB
-
Filesize
10.8MB
-
Filesize
216KB
-
Filesize
544KB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
544KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
184KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
760KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
1.7MB
-
Filesize
64KB