78fa92bfeef7328387ff3d276112ea4cffbda6358dcec76a5d0b46260c835302

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/02/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.exe
Size 12.0MB
Sample260202-h71shaav5e
SHA256 78fa92bfeef7328387ff3d276112ea4cffbda6358dcec76a5d0b46260c835302
MD5 378d66eaf4c131036a6f8d98dd73c6d2
SHA1 f7e5725ba3a2f71ce8c12bc48b26eb039ca784d2
SHA512 9fc1f85bbf9c235f5d3b5e56e713a8e60412b5d9196a87ac1f6048fec417b172b197679c61d514c947cc32439de3f6bc361bf0d1c3c698251e526c37b0d986d3
SSDEEP 196608:81pfefPLiZJbjFd29WxmgZJbjFd29jZJbjFd29ZZJbjFd299:8l3b29Wwg3b29j3b29Z3b299
TLSH
T177C61201B3E685B9D0BF0638E87A92666B757C045722D6BF1794792D2E33B808E31377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (d62e9df9c58bd4a2)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (d62e9df9c58bd4a2)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-f81h64-relay.screenconnect.com&p=443&s=719b22e5-30ac-4485-809c-1ff3bbed3e33&k=BgIAAACkAABSU0ExAAgAAAEAAQCxZHqXKLOQMiCgMIAUTQ8krZa%2ft1RlwDaVb7t2ZjPU%2fmNR7yCt9vZAr8WC0wbay2fMwnqV4DM3%2f57LZIWktOYrnxAZToC4raehpLPv0crbi2JEK6tqIc56%2bY6rbb9OtJjVSd3ZR%2bkw6499H7zyMNUSiD6Vee1EBntyovelF71n%2fEC4PaZBDkIiksOihKSSmOqQpsamh%2fh%2fcAKIe8weQ%2b387XpZwABENmfRAFDxR%2b%2f%2bGECPtBAm%2bbllrpD9kDILTpqP9%2bQ%2fYE%2bXAWNHCunIuGHjHb%2bL3gY1OA2jPa%2bCrb2TXnYk9SRvawQ8BDbE1e79qV40j8vaNbpymh3puS3mW07o&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAC3myx4csrk6e61283TSMPwAAAAACAAAAAAAQZgAAAAEAACAAAAC8ymHmwS9k5CyTMadWDRFBKrrWbZkOdBINfro1nyFwBwAAAAAOgAAAAAIAACAAAAAJx21Ev%2fHoJHQYRaosrbPrjP9LUM%2bkNkt2Lvslf7H346AEAAACQPKq5icwcxE0hxqCY9nB%2bfVmTg76JriyJoSj8INdR3MsUxQKZfyQxydrA%2bw9CS9XbylCmLY%2fpXzYEmeHKohyC9a2pqeDKAJuU3jbLqPv9Dy8cxpoeSHDcw%2fK5qLkFUihGEJ6%2f6hMsSbD8NnuTEA%2bkBk0oW9%2fcjHpNHvKvV%2bZEbzZnzUw3wUz9BmJAccLkvcsPwke60am9hLOlydMt2c0YtNSJ65EWBcZeBegrIyInKW5nhJadHVJqTjGk5Y9zvJR1dd9DqFqEKcjThPiqik3ssum88x24JCdayDExSmHO%2fQ6FGLctKzhYmskcigYGH0UKZyiH6Dm7H84LPIbdvR5tJu0Uumn5kFnWiPC2Lw5NTMSM3qf5a8IhlBAxz9TdUNEaS%2fbvVMO6c%2bOg1ypOV59%2bmP4VKJwN5YfMIvnElH5yX9ZrjnvkqucZ3N5i3aiZegg01B3PSh4WVvXX0KWCmyk%2fFkraqy%2fdT28nvP%2bovyrP%2fOSWWcTC6BPRTN6Y2bd2helkRyePyOL3z%2fLVnoUHTxr36PKWplhlLWLvpGDUFuTe01vPT%2frLL7rG1B32tAV0ZWwFR5CYTITxOo3e3nXVyeh6M5hl%2fF1V5oQFVR95JHJ8RhtH%2bjAM1HIQ%2bIffKQhnopRZRhRdN3lGl4iySwdo6g63FJNpRYQsp4lJJNxcJ%2bCNPPOrcZOMXZD%2fgHcejNqQryAca%2f2ceRETo7cHM%2fGpeC4T7x7NcPZGeDe1bnk6Cq8DcsyX8qdeUNzS12SWiZkoBVUrqsg2D7IOA8OwjqQ25J425ObMBpgsDtb4niamM84Tzp3qYEJWgiqkNVa2DQseTbcv08QMZqcEHAzJvPYKdW%2bdFH00%2bliJ%2fK%2f%2bxWZ9tkqOOcSwDnCzr2sU41EnV%2bM6L13udI6AwA6ZIOFd7Vtmx0t9ubpCbD7AIbvkYeKXoH73LlSi9LlzWua7rBeIpY5IEzhPY%2bvlbpGwqR1eIu5enzmhgIQA2dAt8HFDJ5mpUk2d2ys3rSge2e9oitFINXP%2bo2N1%2f1l32RCa675M9b7HOp2%2flJJCAAI4mhmBzKpmPNh9nk4FxKvMzloe1xLU%2bnpwRstS%2bUmibw%2fpkcprhDAUHq3CfOYwMucH1j468Gv%2bXyJ0A1uq6RBJ4O5M8AC4mVSFtsT8oss2GJ%2bgdJnImiw1IYCm0y88xBCFsjue7SyzNoEME8g7reHlNBL3FMCQE9HBlL4dlrg8n7wiYxp8W5BOhQHhq%2f8LcKWTIjAoxtsv5N3Tqt7rJ7IK5bFg1gLJYNSbuSMCRPZLwTvA9BOJddGrvf2hGvmcmZRJ8X8W2SO1FmC9XkwHUvx1TyRGh9IujuvQNVemU4HCpfQ%2fnUxPBkWNBJR9dqTAEqmryNPlSia6s6OW6xiQ%2bRyiiu%2fZmJYH5B2DkTy6%2bKghAirs1OIb5iRUEsylFMKtL09VZiQTelw18j0kq8HQSUl%2b7HHAxQRVxFOrJ1Teothy3pYBLVmX3%2byj8tksfwjT3ieb5uvQ6aM3bWTwLArIg6UXdtK05n97Zy360GwbzM%2ffWUtFOHXqxO%2bykd%2bBbEAEBhx%2bzZJF7MawglFOkAAAAD5Xnz0MsTtBgPkMJhWJ8wWlz7qDfhoZi2OMgrIaRte4j2yPaHxb%2fxLoFiAYChrFH4isuKPWpM1PmCw2ohOBwku\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5080	msiexec.exe
3	5080	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800640036003200650039006400660039006300350038006200640034006100320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d62e9df9c58bd4a2)\wunpjl5i.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d62e9df9c58bd4a2)\wunpjl5i.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI75B8.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{D596FD75-2C44-C1C0-E3CF-F409C83983EC}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{D596FD75-2C44-C1C0-E3CF-F409C83983EC}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5874be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D596FD75-2C44-C1C0-E3CF-F409C83983EC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8627415E36E81D72.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF87570455C26E3B3C.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF78CB41D25A02F237.TMP	msiexec.exe
File created	C:\Windows\Installer\e5874be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7675.tmp	msiexec.exe
File created	C:\Windows\Installer\e5874c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{D596FD75-2C44-C1C0-E3CF-F409C83983EC}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB1F6E673935A9E0A.TMP	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
5792	ScreenConnect.ClientService.exe
1848	ScreenConnect.WindowsClient.exe
2572	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
2504	MsiExec.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
652	rundll32.exe
5864	MsiExec.exe
4584	MsiExec.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e689d3d397d010a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e689d3d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e689d3d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae689d3d3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de689d3d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57DF695D44C20C1C3EFC4F908C9338CE\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\PackageCode = "57DF695D44C20C1C3EFC4F908C9338CE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE23D0911E3CA4EF6DE2D99F5CB84D2A\57DF695D44C20C1C3EFC4F908C9338CE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.8.9518\\d62e9df9c58bd4a2\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8EEB-E9A2EE1FA13F}\ = "ScreenConnect Client (d62e9df9c58bd4a2) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57DF695D44C20C1C3EFC4F908C9338CE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8EEB-E9A2EE1FA13F}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\Version = "420020232"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8EEB-E9A2EE1FA13F}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (d62e9df9c58bd4a2)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (d62e9df9c58bd4a2)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-8EEB-E9A2EE1FA13F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\ProductIcon = "C:\\Windows\\Installer\\{D596FD75-2C44-C1C0-E3CF-F409C83983EC}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE23D0911E3CA4EF6DE2D99F5CB84D2A	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-8EEB-E9A2EE1FA13F}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-d62e9df9c58bd4a2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-d62e9df9c58bd4a2\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\ProductName = "ScreenConnect Client (d62e9df9c58bd4a2)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.8.9518\\d62e9df9c58bd4a2\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d62e9df9c58bd4a2\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57DF695D44C20C1C3EFC4F908C9338CE\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2404	msiexec.exe
2404	msiexec.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	5080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5080	msiexec.exe
Token: SeSecurityPrivilege	2404	msiexec.exe
Token: SeCreateTokenPrivilege	5080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5080	msiexec.exe
Token: SeLockMemoryPrivilege	5080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5080	msiexec.exe
Token: SeMachineAccountPrivilege	5080	msiexec.exe
Token: SeTcbPrivilege	5080	msiexec.exe
Token: SeSecurityPrivilege	5080	msiexec.exe
Token: SeTakeOwnershipPrivilege	5080	msiexec.exe
Token: SeLoadDriverPrivilege	5080	msiexec.exe
Token: SeSystemProfilePrivilege	5080	msiexec.exe
Token: SeSystemtimePrivilege	5080	msiexec.exe
Token: SeProfSingleProcessPrivilege	5080	msiexec.exe
Token: SeIncBasePriorityPrivilege	5080	msiexec.exe
Token: SeCreatePagefilePrivilege	5080	msiexec.exe
Token: SeCreatePermanentPrivilege	5080	msiexec.exe
Token: SeBackupPrivilege	5080	msiexec.exe
Token: SeRestorePrivilege	5080	msiexec.exe
Token: SeShutdownPrivilege	5080	msiexec.exe
Token: SeDebugPrivilege	5080	msiexec.exe
Token: SeAuditPrivilege	5080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5080	msiexec.exe
Token: SeChangeNotifyPrivilege	5080	msiexec.exe
Token: SeRemoteShutdownPrivilege	5080	msiexec.exe
Token: SeUndockPrivilege	5080	msiexec.exe
Token: SeSyncAgentPrivilege	5080	msiexec.exe
Token: SeEnableDelegationPrivilege	5080	msiexec.exe
Token: SeManageVolumePrivilege	5080	msiexec.exe
Token: SeImpersonatePrivilege	5080	msiexec.exe
Token: SeCreateGlobalPrivilege	5080	msiexec.exe
Token: SeCreateTokenPrivilege	5080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5080	msiexec.exe
Token: SeLockMemoryPrivilege	5080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5080	msiexec.exe
Token: SeMachineAccountPrivilege	5080	msiexec.exe
Token: SeTcbPrivilege	5080	msiexec.exe
Token: SeSecurityPrivilege	5080	msiexec.exe
Token: SeTakeOwnershipPrivilege	5080	msiexec.exe
Token: SeLoadDriverPrivilege	5080	msiexec.exe
Token: SeSystemProfilePrivilege	5080	msiexec.exe
Token: SeSystemtimePrivilege	5080	msiexec.exe
Token: SeProfSingleProcessPrivilege	5080	msiexec.exe
Token: SeIncBasePriorityPrivilege	5080	msiexec.exe
Token: SeCreatePagefilePrivilege	5080	msiexec.exe
Token: SeCreatePermanentPrivilege	5080	msiexec.exe
Token: SeBackupPrivilege	5080	msiexec.exe
Token: SeRestorePrivilege	5080	msiexec.exe
Token: SeShutdownPrivilege	5080	msiexec.exe
Token: SeDebugPrivilege	5080	msiexec.exe
Token: SeAuditPrivilege	5080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5080	msiexec.exe
Token: SeChangeNotifyPrivilege	5080	msiexec.exe
Token: SeRemoteShutdownPrivilege	5080	msiexec.exe
Token: SeUndockPrivilege	5080	msiexec.exe
Token: SeSyncAgentPrivilege	5080	msiexec.exe
Token: SeEnableDelegationPrivilege	5080	msiexec.exe
Token: SeManageVolumePrivilege	5080	msiexec.exe
Token: SeImpersonatePrivilege	5080	msiexec.exe
Token: SeCreateGlobalPrivilege	5080	msiexec.exe
Token: SeCreateTokenPrivilege	5080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5080	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5080	msiexec.exe
5080	msiexec.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe
1848	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 5080	2480	ScreenConnect.ClientSetup.exe	79
PID 2404 wrote to memory of 2504	2404	msiexec.exe	81
PID 2504 wrote to memory of 652	2504	MsiExec.exe	82
PID 2404 wrote to memory of 5896	2404	msiexec.exe	86
PID 2404 wrote to memory of 5864	2404	msiexec.exe	88
PID 2404 wrote to memory of 4584	2404	msiexec.exe	89
PID 5792 wrote to memory of 1848	5792	ScreenConnect.ClientService.exe	91
PID 5792 wrote to memory of 2572	5792	ScreenConnect.ClientService.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.8.9518\d62e9df9c58bd4a2\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B56E607BC98A60376C29040A4DD68CBC C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667171 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:652
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DE95E8440AC549BA69D09D00BEE7C9C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5864
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 508618D55E3CCA77AC9208CE14818DC9 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5836

C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f81h64-relay.screenconnect.com&p=443&s=719b22e5-30ac-4485-809c-1ff3bbed3e33&k=BgIAAACkAABSU0ExAAgAAAEAAQCxZHqXKLOQMiCgMIAUTQ8krZa%2ft1RlwDaVb7t2ZjPU%2fmNR7yCt9vZAr8WC0wbay2fMwnqV4DM3%2f57LZIWktOYrnxAZToC4raehpLPv0crbi2JEK6tqIc56%2bY6rbb9OtJjVSd3ZR%2bkw6499H7zyMNUSiD6Vee1EBntyovelF71n%2fEC4PaZBDkIiksOihKSSmOqQpsamh%2fh%2fcAKIe8weQ%2b387XpZwABENmfRAFDxR%2b%2f%2bGECPtBAm%2bbllrpD9kDILTpqP9%2bQ%2fYE%2bXAWNHCunIuGHjHb%2bL3gY1OA2jPa%2bCrb2TXnYk9SRvawQ8BDbE1e79qV40j8vaNbpymh3puS3mW07o"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe" "RunRole" "70ea989a-3f7a-445b-a0a2-10a8fe74c854" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1848
- C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe" "RunRole" "8de9ea2f-eeed-41ca-917b-077171210266" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5874bf.rbs

Path C:\Config.Msi\e5874bf.rbs
Size 214KB
SHA256 ebfdbeaa5b71c3afcaec98fa73ac01adcaf1d85177bedd5f36b9e947ece89bda
MD5 33a9ce6f55149815261c7b2f54242f4e
SHA1 5cee59231a33b2ff443668b044afa3736aa93892
SHA512 b4976fe82f1b25b015330003a4e9ba125b25e3e6ee03b2e936952c1b92d672c542582403bf3300be4f4c8dbe40208931a43459649d63fd7e274d6b69f688032e
SSDEEP 3072:Wy9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGC:WyuH2aCGw1ST1wQLdqvC
TLSH
T149248D217484807EE7FA1A32D93F9A727E3DF6640760C59E83888C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Client.dll
Size 399KB
SHA256 1d1c8db8e0b387f244a0461fb6794af70ee88a17f71d8dcc6dd0874a0c8dab7f
MD5 376e2676392741ad688bc3bf3d83a26a
SHA1 2e0d280e3427db22a8697afe2e2dd557238f665a
SHA512 82058b5ac47dc3f30317acc2a3b59b119931d25409dc99e541669d4c89bf6c90e9f8ac0240e4cc6f094dc41010183131e423f3292ed1504a17c37b4ad2d35d0f
SSDEEP 6144:HMq4l+fvJNsZvD8ETEavHy+vd7JPYIYyqQni65/PGP:s5+U5DHTEavSW7OQni3P
TLSH
T17594BF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 29adce52ff944f421dddfc6516fac0e229656b57c1b12630e89d79e6f0ced806
MD5 e9a0de7488d34737c9e27fc67d2829ec
SHA1 b0d7b4e392f5fee30d6f4e2f37cc3eda4d803e39
SHA512 e4524ec2eb9d3ed84fa972f59945394ed4a22437b1b15654dded25a2f9a94608d1b3280200f6311e94895a70d4719103a148486c26e5594449f0d2f621fe5c50
SSDEEP 1536:a7xQmiDHn5f2yoI4vn3R0asV7k/QQV3lTSQmkbPqgW7e:a7xQmKH5eygf3R0T0QQVFFMgWa
TLSH
T1FE733C41E3AD5E26C9DF4F387465B0450F709A02A4A3FBD99D8EA4EA1B573C12A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1d99bcdff1dc1ed8032b43cc3a8e60efc36425662642aed62678244f3527460
MD5 2c4f0dfd0b5ec8d233d7e92513482789
SHA1 1c98e94c26d607a41fe441b5bd19b527f4db9092
SHA512 7edf0a16147257eed3f69954288614d183927552b10eb5ef2d4cccc6c66f78d5c06a97d56a2e884c8c8e12a51462581c9bb7ca181b1ad016b16a113345e971d7
SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcjU0HMJ7nf:xhbNDxZGXfdHrX7rAc6myJkgcjU0HsL
TLSH
T175935B13B9C28872D473093158E1DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Core.dll
Size 553KB
SHA256 cddbbd7794d1a2b4238625e8b84eb98df32abf63b29144fd5f9304728244b2d0
MD5 7180573587acc046905889e2d683aaa8
SHA1 3d0ea39fa488816e48ec62fc92c8dfb749dfadf3
SHA512 5e2347c34f96d9f87606ae6e2cc54a0ef637623f8f9d32710dfd6840f334b8e219276f5a65024af4258c40a22969d41486670995314a2478b8397bffe679bf98
SSDEEP 12288:A+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEt1bySX/fpd:A0QdxKAAr/fT
TLSH
T1A2C46D5233D88B36C5AF0B3AE860D6151B70E901B05AE75B29DEE4E91E837455E0C3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 78ecf3c5e30e91b3a6c0f19d0b70d054922e7fd94c94ab93a0a925d3d568ffb8
MD5 363dd5b6964c171bbc1e39a34ffa9d00
SHA1 c91a34fa70b46ced5001419fe9112cc3963c3e2d
SHA512 6c4e41611d5e2d893c2cad32f7640feff7372250a5c6fce1426207895b3208266ab797c64abc779a626f83df7779c680a31d7c8b826fa267fa934a7e4de61191
SSDEEP 24576:TJpIFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTO:VpIJkGYYpT0+TFiH7efPj
TLSH
T1DE85AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 4f027dda50c064be1e2840c5b7d46a801162717416ca7889c2b164777942328a
MD5 e97ca14474db3107336a119fb45e0bda
SHA1 1a9b34dd4b3a764d242add089c412a3c51c3904d
SHA512 fd88bba40af12375551341fcb2ebe9101585c7cf270b77e2eb030a6cbcb032f0bf234e0fdad7f6a9e5c376af00e1470acd92bc17b18d68e7616374c2e0c0a2be
SSDEEP 6144:caEAH0RclKUyYHwjSPIDQj391lMKgrurWAcC1CCzP+JE6nUcoI2/Z4Is4zu2wAsc:cacSlKUy8wjSPIDQVrW/C1CE6+zQkYhy
TLSH
T1B3D46D2173BC8A3BC4BF077BA0A11E6857B0FC0291C5D79E5924A8E94EE73D649443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 98ba4d453ec6758132971444fd4bcf55a16433e76745eff18680b933cf78c155
MD5 dcf8563a0fa4ffb2f4652019dbfa255a
SHA1 64b9cfcada4eef07ec16ed99fe93e5d9daa8f2e6
SHA512 36c77c7864b54ccefe8f197fa1c7345d5eb32778ab959d981836218e505c3b9c44fe02871896d0a2345548167f0807525fcbec5c6b1f29f4411e1087951d6a60
SSDEEP 12288:yhUSQJg/+QShEMuu/gUD+FkoiS+upfHHu:ywNQrMuu/gUD+Son+2fnu
TLSH
T12F054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (d62e9df9c58bd4a2)\system.config
Size 980B
SHA256 82cf3e559c7b5de63ec46c48d3176ed1d508656873b8c0c72eb940da1efc754e
MD5 d118fae833a285a71bb8c50b1836bbb5
SHA1 40d57ef18c2dae62faa0d011b0b52b1d942c989f
SHA512 7ed2193666b29d4c2ce80123c1dc283be575a1791e3b8da228cf7056950fc06a3d4a644494186f666e659a7be31df3a35a839e9f3f728d015a1eaa79690bc66c
TLSH
T11311E1A135C0BD2A07632A21C7164645FA726E9B34110089755F22BE5F725CA07A32A9
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 727B
SHA256 6c09dc3efe5d5fef52c7b4a3f0a3e5f17f4374605610cca77d48d9201b68e5d5
MD5 b39389e18ffa504584c623d85023bd90
SHA1 a32121f5cd9c1278e8759c2e4797cc7331ae853f
SHA512 5b764506d5a0d3dca3fcafed59db6fe1ea049b4e178d7ff92ecfb04c0ccb39147523da3f54193517575e3c4664749e684a37a9547b49c0b11afe6be53a94dd11
TLSH
T1B001949B81FE990EB4A04D3E87B90BF0F7A2466A8D5F660F61CD1A55C6483402811370
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 408B
SHA256 effd1d954a1a89af5f00683dd01fc88023e4b793f8631cbd0476c7ceba2b4b64
MD5 17093dde791b68e2e42ab90552b86e9e
SHA1 2d2cb00561b63cb8ad82cdf9e0bfd57e69c7db40
SHA512 d59a950474b0f9175664b14955d2f10c38ea25dd7c96e406f5052819add7e957188c5dc046db77b7f434eb3172cd1dae7c99eb52ed87902cb93cd546fc732db8
TLSH
T11BE0C63432FA012EF1E9E0B80BFAFC328C89F34E686293A920806701FA20A000CD1231
MD5 SHA1 SHA512 TLSH

Submit Download

MSI49E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp
Size 1.1MB
SHA256 652f517056a6f237b376fde454d2f033594bf9e272b6c0ec7756d618b5685c09
MD5 62b62e6d30e0061fd15e86b32feb430a
SHA1 2d94398945545966a86f772be227eee7b52ac248
SHA512 5637f4e35b5593519efa3b6c706db115a5125cd4ace205a9b1685c3df798e00869918d17f1cb43957d9e488ddaea9b63dec1b037de24ac03fd959ee9f63b11f4
SSDEEP 24576:LUUGGSQ6Oz0r/FhixJnX0J2sJkzUipevIHFZlZPTBa9g8h:8GS3Oa7IYkMCNTBCRh
TLSH
T13A35231033F2C03AF2E725316D75B6B21AFE76A255B0818E1B94656C4FB1F82DB64363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 0e457a4dea573bd4d98353bc4a196faa4a7ea50dbd87e8910091baaecf002cd0
MD5 73997173f0b452278dc45cdd9cc3e899
SHA1 7b2330a1683ce4f3b2aa88f5c872653c374cf936
SHA512 98a808161b4ec135b420bce35b2b424e70c9bc5ae239c11507de81747ef0993149d350b64a0324846f3f9c57276d8d1d03fe6a4539251281cc9e00d2d174eadc
SSDEEP 12288:R+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEt1bySX/fp:v0QdxKAAr/f
TLSH
T16CC46C5233D88B36C5AF0B3AE860D6151B70E904B01AE75B29DEE4E91E837455E0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 9cd4424a6b2b61b21bc47aeeb1882f5eebdde5f8d7f204d023cc403e29534377
MD5 94a4f8ace2b9c48ddf3a809899c0cd3e
SHA1 e7abed652e5115322d1cfba0e0805fc5fb00f061
SHA512 15d887d3713f9ef2c50d183b94e85eabd28c49ad5f4dc2030380dbe0e1ddbe351f26220ee722362488eb50e4843bad3b534d4cfc5d2efa8c201a4e09c5186ad8
SSDEEP 192:88/Qp6lCJuV3jgXtyVNamVNG1YZfCrMmbfHJ7kjvL+buLd9NEFbnpT:x/cBJaMXt2NaheUrMmb/FkjvL+buZUpT
TLSH
T16132E70037DC933AE8BE0F79DAB362910771EB74A015DF2E18CCA1569D367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI49E5.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 81950e86208234f80609387f180480ac6d9caf568b595a14bacfdaa2d13eefde
MD5 dbbbc36903b1e8ceec33690d54491435
SHA1 fe763622343d02030f6c50e199fda0d98446d1dc
SHA512 d22396bcff6a8fbe19834d91bfa9a4128c25d9b04e79fdfd2f7f1604db9f232382f1d21de07dee195f598d3da53053ffd4b8bb2f5c76944c981d77ba5b336735
SSDEEP 24576:NJpIFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:jpIJkGYYpT0+TFiH7efP
TLSH
T11785BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.8.9518\d62e9df9c58bd4a2\ScreenConnect.ClientSetup.msi
Size 9.6MB
SHA256 9b4937956df3382e643e65690112aaa7a5a84eab4415b889b0976c9dc32faaf2
MD5 19bfe12416c482c96c647e31d8f2c5c6
SHA1 3d527277a3bf9c9786de50e916feac2461112112
SHA512 8cad8f7a604b7e076171ebc484ebc74927723ee1a554aaa831caed27203794cc4efcb5a3b3eba868b9d2c1142a150fa0526a7cf637e39fd3af213d2f36143909
SSDEEP 196608:8ZJbjFd29WxmgZJbjFd29jZJbjFd29ZZJbjFd29:83b29Wwg3b29j3b29Z3b29
TLSH
T123A6231172E58179F1FB0B39FD3A91B16A763C699E63805F1394391E1A72E50CAB2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI75C8.tmp

Path C:\Windows\Installer\MSI75C8.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 8b5e3616274fe3e203c0f8767e7321aa0a00f7808b8bb96e8b46110906d6e432
MD5 0eb8127a460ddd7cf061370f5aef5f60
SHA1 5fae37872550a7f43656ae9583e96884370d6c5a
SHA512 049450fc99393aefd14d99b2e7b7edfa1d9c120a42e500a86ecfb6e989eae7ad43663a5e379a81b50240fa10e28639aa4e2688517896da080d56024cf4b4bb22
SSDEEP 24576:t2gmSp1UdoO/vvTLn2MeREnqfqpnA44mWWPd3pksVX6IkQIJ4Xdb7BmrB:4
TLSH
T16A47052436F92110E7F79F3CA8F0AA23493A7D5B9C15DE8C46411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ba9ecd38-4c29-4860-b357-5c7544e01933}_OnDiskSnapshotProp

Path \??\Volume{d3d389e6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ba9ecd38-4c29-4860-b357-5c7544e01933}_OnDiskSnapshotProp
Size 6KB
SHA256 a89552d75780d4ae7a815ee9f1ac92fcaa9527df5f0ed5a59c162d20c1b5e066
MD5 1616296a3b09f70d9f3e2e93d61b2dce
SHA1 20020ede381cb165df8decdec46a5eb04a5bdd18
SHA512 7ca86cf111cedadad7a5853025e4d4166812c714747a402fc2c4b52166ab6d62ba38ae298fb460211e17198c3855306d96017cf5afe7ba7fbb619325cd7623cc
SSDEEP 96:FBRZsXrtwjtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:XRytcb++ZVm
TLSH
T1D3D19B085AF54711E2B3AB7128F14557A877B911EF33CB8E0298238E6670A10F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-36-0x0000000003120000-0x000000000314E000-memory.dmp

Download

memory/652-44-0x0000000005590000-0x000000000561E000-memory.dmp

Download

memory/652-48-0x00000000057D0000-0x000000000597E000-memory.dmp

Download

memory/652-40-0x0000000003110000-0x000000000311A000-memory.dmp

Download

memory/1848-122-0x0000000000E30000-0x0000000000ECC000-memory.dmp

Download

memory/1848-133-0x000000001BA40000-0x000000001BAA8000-memory.dmp

Download

memory/1848-139-0x000000001B9F0000-0x000000001BA08000-memory.dmp

Download

memory/1848-140-0x000000001BAB0000-0x000000001BAF1000-memory.dmp

Download

memory/1848-138-0x00000000030C0000-0x00000000030D8000-memory.dmp

Download

memory/1848-137-0x000000001D090000-0x000000001D218000-memory.dmp

Download

memory/1848-135-0x000000001C0D0000-0x000000001C27E000-memory.dmp

Download

memory/1848-134-0x000000001BE90000-0x000000001BF1E000-memory.dmp

Download

memory/2480-4-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Download

memory/2480-7-0x0000000005E90000-0x000000000603E000-memory.dmp

Download

memory/2480-2-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/2480-9-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/2480-3-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/2480-1-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download

memory/2480-5-0x0000000005E00000-0x0000000005E8E000-memory.dmp

Download

memory/2480-0-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Download

memory/2480-6-0x0000000002080000-0x00000000020A4000-memory.dmp

Download

memory/2480-8-0x00000000065F0000-0x0000000006B96000-memory.dmp

Download

memory/5792-98-0x0000000003C00000-0x0000000003C8E000-memory.dmp

Download

memory/5792-102-0x0000000003E40000-0x0000000003FEE000-memory.dmp

Download

memory/5792-92-0x0000000003B40000-0x0000000003B58000-memory.dmp

Download

memory/5792-111-0x0000000004040000-0x0000000004081000-memory.dmp

Download

memory/5792-109-0x00000000041C0000-0x0000000004252000-memory.dmp

Download

memory/5792-104-0x0000000003FF0000-0x0000000004040000-memory.dmp

Download

memory/5792-108-0x00000000040B0000-0x0000000004118000-memory.dmp

Download

memory/5792-113-0x00000000043B0000-0x0000000004485000-memory.dmp

Download