Analysis
-
max time kernel
126s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 03:18
Static task
static1
Behavioral task
behavioral1
Sample
595838b7cdc0e394afcb3e486e05af90_NEAS.exe
Resource
win7-20240215-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
595838b7cdc0e394afcb3e486e05af90_NEAS.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
595838b7cdc0e394afcb3e486e05af90_NEAS.exe
-
Size
5.2MB
-
MD5
595838b7cdc0e394afcb3e486e05af90
-
SHA1
6f0945c7fe89fde93b8fad3026d269b2a49c1340
-
SHA256
8765013a5849321898e3f2aa322adafc03a8e77cf318c38460dca2c7d2ac97ae
-
SHA512
0d9904f5d5d7720d4daa231307b28c5230a146270650409164baec6101556b93d4666c9c340ee57ed392b58e3cda3556548b318c43cfa10248faf01c01716495
-
SSDEEP
98304:Kps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:sfefPJws3V+a
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (02aacd0ff7720c8e)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (02aacd0ff7720c8e)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-cjeh24-relay.screenconnect.com&p=443&s=81bf47ec-4092-48dd-9722-d79789524860&k=BgIAAACkAABSU0ExAAgAAAEAAQDZKTW%2f%2b%2f0HZmYMCXtdMD%2bn02Nt2VBCvuFrPfNtNBBCGc%2b0LcJ9P4u2z8uxREmtJoDrc%2bj7EMgJ8x7wyzgfLtNFDv41m%2bXSlDRjrSKKim%2fbNMv%2f9mkMtRamV478yX%2fc3VlECJEYHAFK%2fpDKpPZ1F%2fGbTFkenTsR7AdEv%2f61cW%2fRNTPaJ6Fmq8qBTkD6WZDPTBFVGuZ8d39SUtwUIEQ55FCbSiB3Bc1bTHHTUu%2fsa6e4yjeX14Z1%2bcVVui7%2f50qy1%2fEG18N%2b0p1HIv955Fk4DHPNMPeDIfd9x%2f5gakn0zF5jGtpd2iIpuuK2%2fuRIp86BX4AjwN%2bQNpm9QL8W0dBt0%2fbT&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAADcwZlCOXokiKyLFcRT%2fQhQAAAAACAAAAAAAQZgAAAAEAACAAAAA90p6Z9XRbYBw95gngG%2b11rURtvFw9F5fmPM%2fEoMzu%2bwAAAAAOgAAAAAIAACAAAABtbg5feqyduC1GbCDHIkCUAUWhrmAXeQLmwWcnMftta6AEAAByZ0LnZsw0Z9Bnm5e%2bHbkl7Uy59CXHOAICNAQUM8cVd%2bEA%2fo3ktDTXEWxp4wPY75xVD%2f1njICpj4GCV%2buyRtRwIRP6FQmrS2qAg%2fIu1CeAOY1EmWEhTzEjRpqbQj6ew5AzZBAZqXcQdC7InbNL%2bVNyLXi4HfWfD8ozNWxyiKJHpzdAd0HzfzoxNSWW%2fbMj3f6gEZm1hCa38fEsteryuTqpnaefdH41E%2bb3Aunlt6px0nkTmZLyKiTgY%2fBni8wDK1gdn2rJc3qYrjrkoTXTnUfBF%2bd0xCgZm3XqJW7ub65VypLp5gx952r4zq53kKdcfFUST%2bqUg2%2bJaoPZxDMpAvxWdqItt4AvVipijZc5W1O7e6K%2bTFzL6IBtmgwCfK9uXtkmOElz4Oq61yg3caEQd1bvsyw0nqZ0WkkSWCkzy7fdLxrCvUUl6OzJzLDxUXwk3YwkEeJWfLwnqAiz%2bhDqQJWoqXcgcZLeK2%2bJ8S0yQDO2xkwjzmDqUAyTf2U%2fOYEhBWbhf6HmqTRf%2b4GcPbIDObAjNFI8GGseLYe%2fu56tQP2gP31RtQt4xy9YGZEdgF1i7Uk0sLAQJKi8yoA1urJJ%2b9EUVizJtd%2bXHhB7iYc%2bdtfJ4N96prJzA5eNiX%2bSTse76mAjLbP1KtYWqAnQZYMEzieYU2xWLl9lVm%2f27B4fHKYob8JgM7%2bgkADT7iZmhafAOCEwUxNI6D2vxgQGUyYMMLmbWzPzaU5sS099KOdLSIxL3iu3XfCsgzLzzdOu77ZVEHA9KuWIGzsv%2fu4vrMur2exEVD2fD2Ri7ULThfam9xZm56dli8LYwMDUcRKtzYJMKK9dkWo%2b7jtMktDp0%2bVANsImGhnVJgOx%2fdDJLASsKNbGsJ%2b91znhBLWrQGlu2JOSZ%2bvFrooJZwqoMW4h0xhYWrzTUOHblcdbHOeRC121qaGoMvyso%2bJeMBD%2bWSvpUXWm6%2fxkCLr4SOpTgq7e5rn%2f6WBNleZr9pmeq2574%2fzxzlWsGdEOH4jey4rANETqd6a7VpWBcRceT%2fkTX1sT%2fGg6KsUs2C6j6PgHBmDgqx8sSzlySBTvNCIyDEIVwg8LnjHT0bWc2kf4j4ZTZ%2btGOS%2fKPyrs2g24bUDDsLQEdw3RAiUe7uAfBFIh8CAiQ55uym42RWVfC0RZMKGcu%2btvtVzJp%2fd8HEs4mNaFXSXP%2fIbQN66kVlnI6oCzF%2f6jdJCBT8T%2fqUtuBIpINuuh1SAlZaBsDaa%2fOBgdW9uEyvl7eKLHFISE%2blKT5441eZPLJpmsSOA0rN30U3uzJDl0w2hNqsdPGfQEoFIzQnX22NHPQNOSbavIHV997cgtmZ%2fnPfuF8oNhJKxru7YpOpgflnGS4gz%2bxudXb1UsVdooJyRg%2b0FNltgafqnxKFXpL9wnBZWG%2f6tpAKbO%2fZx5WswBOggBZ4bTClSI05bpHdqEkZLEDc%2bdufi3aOZdGJBv2%2bXfVNh3amAjTiJ461HqtGUrzIp6rfESYNwZeBN9M1o8eXDNlcU2jvOWv13D1YJ0m47rx8trwldLn36NjVsulk%2fIxUeN8NgYHXq9O3hGE4L6EbD77kHG9qS%2bcEAAAAA134bP467XHsj5BI8hEM0trZ%2bB2whEha%2bCdU13kNBGbbenx31GK8FBmf0qGLJuCPAP7Z5umriX1vkPOFnRNhda&c=845964277694137&c=&c=&c=&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\fzphi5fn.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lpsnxpzv.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\ovbqzeds.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lbozzj2p.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\dbhfmohk.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\dbhfmohk.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\ovbqzeds.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lbozzj2p.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\xgkx4pbt.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\xgkx4pbt.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\1g1zwzbf.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lpsnxpzv.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lbozzj2p.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\rv35mq2l.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\rv35mq2l.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\1g1zwzbf.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\hxb0zwkb.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\rv35mq2l.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\dbhfmohk.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\ovbqzeds.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\fzphi5fn.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\xgkx4pbt.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\hxb0zwkb.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\1g1zwzbf.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lpsnxpzv.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\hxb0zwkb.tmp ScreenConnect.ClientService.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.exe msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f762edd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2FA8.tmp msiexec.exe File created C:\Windows\Installer\{3549754C-559E-BCFF-B810-E59BDE920BEF}\DefaultIcon msiexec.exe File created C:\Windows\Installer\f762ede.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f762ee0.msi msiexec.exe File opened for modification C:\Windows\Installer\{3549754C-559E-BCFF-B810-E59BDE920BEF}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2FB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3102.tmp msiexec.exe File opened for modification C:\Windows\Installer\f762ede.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f762edd.msi msiexec.exe File created C:\Windows\Installer\wix{3549754C-559E-BCFF-B810-E59BDE920BEF}.SchedServiceConfig.rmi MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 2988 ScreenConnect.ClientService.exe 2412 ScreenConnect.WindowsClient.exe -
Loads dropped DLL 22 IoCs
pid Process 3016 MsiExec.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 2604 rundll32.exe 1792 MsiExec.exe 2796 MsiExec.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (02aacd0ff7720c8e)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-02aacd0ff7720c8e msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-02aacd0ff7720c8e\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\PackageCode = "C4579453E955FFCB8B015EB9ED29B0FE" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (02aacd0ff7720c8e)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9CF660A3C67A938820AADCF07F27C0E8\C4579453E955FFCB8B015EB9ED29B0FE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (02aacd0ff7720c8e)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\02aacd0ff7720c8e\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4579453E955FFCB8B015EB9ED29B0FE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\ProductName = "ScreenConnect Client (02aacd0ff7720c8e)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\ProductIcon = "C:\\Windows\\Installer\\{3549754C-559E-BCFF-B810-E59BDE920BEF}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9CF660A3C67A938820AADCF07F27C0E8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4A2A-95A5080F9AE0}\ = "ScreenConnect Client (02aacd0ff7720c8e) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4579453E955FFCB8B015EB9ED29B0FE\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\Version = "386465802" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-02aacd0ff7720c8e\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\PackageName = "setup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\02aacd0ff7720c8e\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4579453E955FFCB8B015EB9ED29B0FE\SourceList\Media msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2412 ScreenConnect.WindowsClient.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2908 msiexec.exe 2908 msiexec.exe 2988 ScreenConnect.ClientService.exe 2988 ScreenConnect.ClientService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe Token: SeShutdownPrivilege 2664 msiexec.exe Token: SeIncreaseQuotaPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2908 msiexec.exe Token: SeTakeOwnershipPrivilege 2908 msiexec.exe Token: SeSecurityPrivilege 2908 msiexec.exe Token: SeCreateTokenPrivilege 2664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2664 msiexec.exe Token: SeLockMemoryPrivilege 2664 msiexec.exe Token: SeIncreaseQuotaPrivilege 2664 msiexec.exe Token: SeMachineAccountPrivilege 2664 msiexec.exe Token: SeTcbPrivilege 2664 msiexec.exe Token: SeSecurityPrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeLoadDriverPrivilege 2664 msiexec.exe Token: SeSystemProfilePrivilege 2664 msiexec.exe Token: SeSystemtimePrivilege 2664 msiexec.exe Token: SeProfSingleProcessPrivilege 2664 msiexec.exe Token: SeIncBasePriorityPrivilege 2664 msiexec.exe Token: SeCreatePagefilePrivilege 2664 msiexec.exe Token: SeCreatePermanentPrivilege 2664 msiexec.exe Token: SeBackupPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeShutdownPrivilege 2664 msiexec.exe Token: SeDebugPrivilege 2664 msiexec.exe Token: SeAuditPrivilege 2664 msiexec.exe Token: SeSystemEnvironmentPrivilege 2664 msiexec.exe Token: SeChangeNotifyPrivilege 2664 msiexec.exe Token: SeRemoteShutdownPrivilege 2664 msiexec.exe Token: SeUndockPrivilege 2664 msiexec.exe Token: SeSyncAgentPrivilege 2664 msiexec.exe Token: SeEnableDelegationPrivilege 2664 msiexec.exe Token: SeManageVolumePrivilege 2664 msiexec.exe Token: SeImpersonatePrivilege 2664 msiexec.exe Token: SeCreateGlobalPrivilege 2664 msiexec.exe Token: SeCreateTokenPrivilege 2664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2664 msiexec.exe Token: SeLockMemoryPrivilege 2664 msiexec.exe Token: SeIncreaseQuotaPrivilege 2664 msiexec.exe Token: SeMachineAccountPrivilege 2664 msiexec.exe Token: SeTcbPrivilege 2664 msiexec.exe Token: SeSecurityPrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeLoadDriverPrivilege 2664 msiexec.exe Token: SeSystemProfilePrivilege 2664 msiexec.exe Token: SeSystemtimePrivilege 2664 msiexec.exe Token: SeProfSingleProcessPrivilege 2664 msiexec.exe Token: SeIncBasePriorityPrivilege 2664 msiexec.exe Token: SeCreatePagefilePrivilege 2664 msiexec.exe Token: SeCreatePermanentPrivilege 2664 msiexec.exe Token: SeBackupPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeShutdownPrivilege 2664 msiexec.exe Token: SeDebugPrivilege 2664 msiexec.exe Token: SeAuditPrivilege 2664 msiexec.exe Token: SeSystemEnvironmentPrivilege 2664 msiexec.exe Token: SeChangeNotifyPrivilege 2664 msiexec.exe Token: SeRemoteShutdownPrivilege 2664 msiexec.exe Token: SeUndockPrivilege 2664 msiexec.exe Token: SeSyncAgentPrivilege 2664 msiexec.exe Token: SeEnableDelegationPrivilege 2664 msiexec.exe Token: SeManageVolumePrivilege 2664 msiexec.exe Token: SeImpersonatePrivilege 2664 msiexec.exe Token: SeCreateGlobalPrivilege 2664 msiexec.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2664 msiexec.exe 2664 msiexec.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe 2412 ScreenConnect.WindowsClient.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2308 wrote to memory of 2664 2308 595838b7cdc0e394afcb3e486e05af90_NEAS.exe 28 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 2908 wrote to memory of 3016 2908 msiexec.exe 30 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 3016 wrote to memory of 2604 3016 MsiExec.exe 31 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 1792 2908 msiexec.exe 35 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2908 wrote to memory of 2796 2908 msiexec.exe 36 PID 2988 wrote to memory of 2412 2988 ScreenConnect.ClientService.exe 38 PID 2988 wrote to memory of 2412 2988 ScreenConnect.ClientService.exe 38 PID 2988 wrote to memory of 2412 2988 ScreenConnect.ClientService.exe 38 PID 2988 wrote to memory of 2412 2988 ScreenConnect.ClientService.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\595838b7cdc0e394afcb3e486e05af90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\595838b7cdc0e394afcb3e486e05af90_NEAS.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\02aacd0ff7720c8e\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2664
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A5E1FCF5B185C2205E27B6B29FF8DB17 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1101.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259395950 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:2604
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89AA86D7638E51DD4D96F78586209B522⤵
- Loads dropped DLL
PID:1792
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCED99DB445AF453571CA05F03D43143 M Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:2796
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2892
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000568" "00000000000005AC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1956
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-cjeh24-relay.screenconnect.com&p=443&s=81bf47ec-4092-48dd-9722-d79789524860&k=BgIAAACkAABSU0ExAAgAAAEAAQDZKTW%2f%2b%2f0HZmYMCXtdMD%2bn02Nt2VBCvuFrPfNtNBBCGc%2b0LcJ9P4u2z8uxREmtJoDrc%2bj7EMgJ8x7wyzgfLtNFDv41m%2bXSlDRjrSKKim%2fbNMv%2f9mkMtRamV478yX%2fc3VlECJEYHAFK%2fpDKpPZ1F%2fGbTFkenTsR7AdEv%2f61cW%2fRNTPaJ6Fmq8qBTkD6WZDPTBFVGuZ8d39SUtwUIEQ55FCbSiB3Bc1bTHHTUu%2fsa6e4yjeX14Z1%2bcVVui7%2f50qy1%2fEG18N%2b0p1HIv955Fk4DHPNMPeDIfd9x%2f5gakn0zF5jGtpd2iIpuuK2%2fuRIp86BX4AjwN%2bQNpm9QL8W0dBt0%2fbT&c=845964277694137&c=&c=&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe" "RunRole" "73701a40-3034-4ae3-9d6a-5b406cc120c6" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5a462fe7b472c19e208c90ef9328ea41b
SHA1cd751161330ac9dbcaced537b9ef5a10918dcccf
SHA2566c4448e3fe5660fb82924c747ed4270a6402041aba9ded4d13a2ae2bb0f1a961
SHA512457c381cd3c98899cacd8df0c2918053fb204fb774b9e3f1cb1ad0abf2533930250b4dca151fe327fab4c31f53b2fb6fefbeebefab79ded90ec40677668bd9e2
-
Filesize
47KB
MD53e83a3aa62c5ff54ed98e27b3fbecf90
SHA196d8927c870a74a478864240b3ace94ad543dfb8
SHA2562d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90
SHA512ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
188KB
MD56bc9611d5b6cee698149a18d986547a8
SHA1f36ab74e4e502fdaf81e101836b94c91d80cb8ea
SHA25617377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed
SHA5123f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea
-
Filesize
60KB
MD522af3a23bd30484514cdacf67c5b3810
SHA1e92a4eaee9d896964de541ce2f01c2404b638258
SHA2567c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9
SHA51295e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936
-
Filesize
93KB
MD5dc615e9d8ec81cbf2e2452516373e5a0
SHA1ec83d37a4f45caeb07b1605324d0315f959452e9
SHA256e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc
SHA51282fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f
-
Filesize
1.6MB
MD529454a0cb83f28c24805e9a70e53444a
SHA1334202965b07ab69f08b16fed0ee6c7274463556
SHA256998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14
SHA51262790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe.config
Filesize266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsCredentialProvider.dll
Filesize746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
990B
MD5ace48c542097f3b3ddad7684110e98c5
SHA129331db5ff5dd81ff8de659aaaf411ee873925d3
SHA2564c7e293aca2e3354a5192679a5f90a86804d97f9bcb95e3c9b252767587ca6d7
SHA5124c87c4971631ffee618db3325434fd908ba58fe8aa8c84fb479ed3cef839cfad21011f09a4eeda3e4ffa7eddf2f0bc81002e30b7aa9347cc5167c70704f94a8e
-
Filesize
1017KB
MD58d94c9f4c07b76b4e32daffcc51109da
SHA162e31a89c488d6745abb72a3071f688fd6180d33
SHA2562b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7
SHA5120092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac
-
Filesize
7.4MB
MD5098e68eec540f86a46ac70fd054ccdd2
SHA1a93f9b582e5748250df3bb34ed63b53f3b5b423e
SHA256c9cbc7830114e5fed7185688d26f6e810966f4c3d1e9dfeb1dd63322a4cb3b60
SHA512cf4c82edd5bf5142a124f2e21ffc350ed0f15cf172016db9f356b383aa217b49387d6adf55a9c1a15a84e563b654aead49a96481dc54d7239312e50af1027bb7
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\1g1zwzbf.newcfg
Filesize586B
MD5536336ded47677fdb15e3ee0aab24ab8
SHA1b46b9493b981fb4365151319087654a2cf5c572c
SHA25631101e32f74ca71db18c279d947e49a7eb71488188f8ebdec26e1f6835c9d1fe
SHA512994ad9aa278c64933e0a44def38a7bfd431a420383dece79623ebe466e973b5f3ee1f3c133f6555ab63016f7d238bf48d3a7df761fe177997bc5ad6e2babe6bb
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\lpsnxpzv.newcfg
Filesize586B
MD50aefc4217c83ebd4181b774e68a96501
SHA13056087089bbe6cb1997a9aa300c0a692d5777ca
SHA25644df54eab714612e122ae75e5148e40841c72c12642f5cd29e16051bf09f4ea0
SHA512aca43f0741db57a3947333f0b0fe955eec9333a2a5e78c71078c1dd5509ef8eb0f95bce104d465127a953a97336db3f491538c4544b235da978a99d86ab2cafd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\rv35mq2l.newcfg
Filesize586B
MD5529193f98cde9c589c5d875a1ab04eee
SHA11e46ea5c63c01da4ad7f0416ca991a9fe34ed8ae
SHA2563546c06b04d70c0f502fa6659e6236799691233c80851479be15ff367899cb90
SHA5123b8cbc3a1bbe616bbb92f25085d57009a50d94f9b9ff50c429ab940494244800ab48478486d3be1f90285154104983d0d5e81f47a501411d2d37754cc9bc05a2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config
Filesize586B
MD526d6e953bd6441b4d354c10da9152094
SHA14e352d8f34c85818bbe498310855faddb6595320
SHA256118570c474a393faef03c217f286146bc8e4da8fa040e64565084d7f6bd42411
SHA512914584948f5dd07eee29d9dfee4ef1c53732865a97bd742d782c46ed0c67d7f7a5b3e803fd9384ae4722998fa1b67a678000e5282d920fee03ef20ded28a29ad
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config
Filesize586B
MD51a552d72426f632270f06401f1f1cfc3
SHA11ec66b2e5c8f67d4e22fc79d351a048b72ccf171
SHA256516fb7ff5d50bbe3bff9383bbd9e69369feae734df11453d1815298bc8efb408
SHA512553b0f8890de1e5a78bc7c0b5a2d1c2d989af23b9e1696bfd6c74534c21919188fe19b84efbdf045611d46bdee9f0e8c9ad1168f1cc034d40830299657eeb273
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config
Filesize586B
MD544d3a1a6366afe71b89fc882d725e7f3
SHA11e740f9737d91392eb365d4d6051c4cbc22820b2
SHA2564ec3edce656da98d55994acec6137bed37d67c7b5e9080e060453aceec6eb5c8
SHA512ffc8c557c7a698e2b52050a048631395363bc4c48505f6b9b6ed468de844e8ca78fa245345a6edb470a8cc650d4506b315500ecb4dba248fca12a1af42b0dbe5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config
Filesize586B
MD59f275dd397b6a0616ddb9cbfcfe7c2ac
SHA1cbead867ab3b7af68de508b0d9c288670369c096
SHA25672a54fee929952600687d1f51196d4fb776b57d2f7d1ff4a08b96b39b69a0c8a
SHA5127928920c1d89eb10d67b1847debff7aa259ab40518b040fbf3d69606328aeb3c4b86c4032180d90144660de536870e00c488a2db68a35b57f7ed37630bdcaf98
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\user.config
Filesize586B
MD5f3ab4f2cc29bb8b9a2bd1a9d58f5a0b5
SHA15c111ab03d2dd14c3549425f4190c8467006691d
SHA25643cda31b01e921de4a19de5d538091cfdba5e2cc362c808038334abc9b3a186b
SHA512b2044442c9857a55420f3825c279257d2d626f6ae5dfde39ba37ba5b55632806edd372b729b06a1828abb9be6149efd482b8c5d69584df70e48da05fbc3f7a55
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (02aacd0ff7720c8e)\xgkx4pbt.newcfg
Filesize586B
MD5f92a60e742a23406fc7a1d055c99a8b4
SHA1597795ec05bdc9405c54d1ba70e9d7ead393b628
SHA2562a4540c03a6c4c1b324ba46a2fa645b6264185d56590dd419c5469c59c6a9779
SHA51238d26466399eabbd568cd2457b575b7dad0b1ede0aefd4865b76c774c594ee03e29e7b627de7ba9e4c5a203c7b54fd26229d5b71ba346f7ed4fff59041fecdf8
-
Filesize
573KB
MD55dec65c4047de914c78816b8663e3602
SHA18807695ee8345e37efec43cbc0874277ed9b0a66
SHA25671602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e
SHA51227b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
519KB
MD5b319407e807be1a49e366f7f8ea7ee2a
SHA1b12197a877fb7e33b1cb5ba11b0da5ca706581ba
SHA256761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742
SHA512dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f
-
Filesize
21KB
MD5b0585159161d50e330b7f8eda50a2770
SHA18636fab3ce6c21a42d3e5fbd495c2ddad4279162
SHA256ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8
SHA512e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad