Analysis
-
max time kernel
1192s -
max time network
1200s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14-05-2024 19:13
General
-
Target
ScreenConnect.ClientSetup.exe
-
Size
5.2MB
-
MD5
5100c35ddc2ca0709857fa1b93e2fd6d
-
SHA1
d71cbdb3e8729cc071f20b86f3cdc534da93a880
-
SHA256
585af37e89555cdf0398a491a67f0c501f97c1d9f1ca47569f134b2a4aa6f614
-
SHA512
a50e2211e83d920e08e2c5030e2ff35e90905a7039b513a0ddd26b8eb8b19de0da5ee0c71da159c78ca082b4758926726257b8d5ce6fc505e4e6ef79d59d3202
-
SSDEEP
98304:3ps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:ZfefPJws3V+a
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 13 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 20 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 13 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\160ef0a635c283d2\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB22223EAEF80EEC93699C5A2E103B97 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI51C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240603765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6BAA549A349F98FC6E39B042860252C32⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2AE3E0FA938C0921C746F22686A2D4FA E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-olqdnn-relay.screenconnect.com&p=443&s=479d90a1-a5f9-41b9-9383-175907ab0ef8&k=BgIAAACkAABSU0ExAAgAAAEAAQDxFdEYsmqXizFg065Z9Wpb4PGj7JGIJVMU9f5p8lZaqjRiwsJ11J6%2fnftEZ%2fPT6F6tRBn45PzzIZkFeFXT0WPmpxH%2f%2fZk3UydaKxGk3WsiaXaKTlVrZFf6o662vMEYDkUkJGo2MtLyhMrY%2f8Afuai5h2QSMlNWgiNTKn9YlsC%2bjZ3jVfOS4Q0knYijY8sRUXXor8%2bCKgu%2fZYTZG78BpEJOlXHd%2bFxCLb4cgcN%2fGirqlEI46kYddMlUZFn9GBFscFldti6DTNfiKtMiLhSqqPuBZ061NDA%2bN5tcKPmYQyYXH2HLbi1pDfkpGhLPKAFK2CiXeu%2bzhtb5lgs3Sljf5R65"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.WindowsClient.exe" "RunRole" "051bd6d8-e8f0-4bd9-892e-125a12b0935a" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (160ef0a635c283d2)\ScreenConnect.WindowsClient.exe" "RunRole" "6d475231-d92d-489f-b1e3-73a0e5bb6e3c" "System"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD58a21cd1e43d3c1ea2dba47290919eed5
SHA14dc1205121a0fbb69c86ba6541dfdc49a665cbe7
SHA256f6f8698db34b6514c3eadd430fe25a95be0b1d522e377f79bcc3b99590648cc6
SHA512e24dfd048b7d7e8791ce99464ffe226b209d5ef26d9b17e32c7badf18b4de8eb6da1c164b4d5fbfd78d871902c8705a935ebe090c557163a94cca66fd704ed2b
-
Filesize
47KB
MD53e83a3aa62c5ff54ed98e27b3fbecf90
SHA196d8927c870a74a478864240b3ace94ad543dfb8
SHA2562d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90
SHA512ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956
-
Filesize
45KB
MD5cbcd812e3b342bb634c6917f0943965b
SHA1f918d7f6f0bfcbe641ac5a02db873eda75231ea9
SHA256182e6523208dfab4e9fa14a233d404cecd3c8a3dcf5bc246ed40c349d468ddc3
SHA51222442a73bd44028c4fb4ec63856b916bb47b0c195223c15830e44358160211663a61c544cf9e857a4a62bead4865f7e5e00e8d413df961246a392646df6070e0
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
188KB
MD56bc9611d5b6cee698149a18d986547a8
SHA1f36ab74e4e502fdaf81e101836b94c91d80cb8ea
SHA25617377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed
SHA5123f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea
-
Filesize
60KB
MD522af3a23bd30484514cdacf67c5b3810
SHA1e92a4eaee9d896964de541ce2f01c2404b638258
SHA2567c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9
SHA51295e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936
-
Filesize
93KB
MD5dc615e9d8ec81cbf2e2452516373e5a0
SHA1ec83d37a4f45caeb07b1605324d0315f959452e9
SHA256e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc
SHA51282fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f
-
Filesize
1.6MB
MD529454a0cb83f28c24805e9a70e53444a
SHA1334202965b07ab69f08b16fed0ee6c7274463556
SHA256998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14
SHA51262790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895
-
Filesize
573KB
MD55dec65c4047de914c78816b8663e3602
SHA18807695ee8345e37efec43cbc0874277ed9b0a66
SHA25671602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e
SHA51227b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1
-
Filesize
266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
Filesize
746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
968B
MD5008d3eb50e95dfb757f40b0025fa16e5
SHA1f6de0f81795b596e7eac5fbace62c6d7dac17d2a
SHA256ae1757ccd652540a1d879b6bdb8ec45ba48f3e8b27770b6113fd4bd4ddc775ef
SHA512e23d01669967aba5666bad3db5119141bc507654c618930cdf6ef78e8a3e7677da34f6c17b06d1cac529b3090ef268c4be406fcb6d04b3556e23a7b22bba1f7c
-
Filesize
1017KB
MD58d94c9f4c07b76b4e32daffcc51109da
SHA162e31a89c488d6745abb72a3071f688fd6180d33
SHA2562b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7
SHA5120092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
519KB
MD5b319407e807be1a49e366f7f8ea7ee2a
SHA1b12197a877fb7e33b1cb5ba11b0da5ca706581ba
SHA256761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742
SHA512dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f
-
Filesize
21KB
MD5b0585159161d50e330b7f8eda50a2770
SHA18636fab3ce6c21a42d3e5fbd495c2ddad4279162
SHA256ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8
SHA512e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad
-
Filesize
9.1MB
MD59b8540f756f5a981640973e47e53f8b6
SHA1118a1bc14cfe957fae0e40583392eeb59e321ab1
SHA256a27b6784ba35d71e8772a429c3b241a43cbcab783ed9a28eaafd56fefd9f8d28
SHA51223524b0aa30cb1259ca20ea467bedbc9ae522077e8d9452c4d5bba1150a33468cc10122ba9912684a1b256c76e18fc60ca45597fb6d5640d449afe98af33652d
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
23.7MB
MD5983b040d00645514bbb8f9efde4eaa8c
SHA103ad9b3af2dbad56da6bd5d04c04f4fc95f746e6
SHA2569910ee8d83b086dc7b202ab6ae2d9c5b911d64a74422945e3af920f45ded5c03
SHA5128afc4a480b95fcbc14495c6de207570e05621840c747141ddf206e11bc4719d6bdf4f83857d1920fc5261418d7834680c252b73b8b4ce57a32fbd178fe8ba8d5
-
Filesize
6KB
MD535991545065b56ca909f99753056d6ec
SHA1d5bbc06294da1dd93b862406f61c498d4788746c
SHA2568023784a82dab7e12ddb0877ecf53fed6df816fe87cfb97dd0c36ca5f69a1d1c
SHA5124537bb7559a063b892f5ffede9a5d84f27fefee3a7acc755b1bb144cf928f8452d94caa90b4f2048f3483609bb768c157c39f112145a3523a09a2e8ebd59a726
-
Filesize
48KB
-
Filesize
184KB
-
Filesize
544KB
-
Filesize
1.5MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
544KB
-
Filesize
592KB
-
Filesize
1.7MB
-
Filesize
216KB
-
Filesize
1.7MB
-
Filesize
88KB
-
Filesize
1.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
544KB
-
Filesize
7.7MB
-
Filesize
2.8MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
584KB
-
Filesize
760KB
-
Filesize
216KB
-
Filesize
320KB
-
Filesize
5.6MB
-
Filesize
88KB