Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.Clientsetup.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.Clientsetup.msi
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target ScreenConnect.Clientsetup.msi
- Size 9.7MB
- Sample260416-pps39sft9n
- SHA256 aa7222724e5a0c8e7e573f45ea13e722c701394c6d246aa75efa0677165caa9e
- MD5 1b8c796f32104c4733a7d156d65f9afe
- SHA1 3185c868de10b6bd53e5e15167ac8583e7ee2ed7
- SHA512 67a7f9137a800034e5dc167db4046de6533db20e51282343f24bf2bbfde8d001ed0603dc66605963318436506f7381f6575ec2c03b3eb1e106b85e8cb9dde292
- SSDEEP 196608:8nCtVYqI5MvbWEpKkqdIJqKgnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:4CXvI5MvHxFJWCXvI5MvHx6CXvI5MvHE
- TLSH T156A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4120 msiexec.exe 7 4120 msiexec.exe 11 4120 msiexec.exe 13 4120 msiexec.exe 15 4884 rundll32.exe - Loads dropped DLL 31 IoCs
pid Process 1836 MsiExec.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 3028 rundll32.exe 1836 MsiExec.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 4884 rundll32.exe 1836 MsiExec.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 3740 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsFileManager.exe msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{E835931D-5639-E4BC-E7C2-805887AF95D5} msiexec.exe File opened for modification C:\Windows\Installer\MSI9E00.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E40.tmp msiexec.exe File created C:\Windows\Installer\{E835931D-5639-E4BC-E7C2-805887AF95D5}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{E835931D-5639-E4BC-E7C2-805887AF95D5}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e589ca8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e589caa.msi msiexec.exe File opened for modification C:\Windows\Installer\e589ca8.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4120 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f6f843118761a0680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f6f843110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f6f84311000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af6f84311000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df6f84311000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\PackageName = "ScreenConnect.Clientsetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-716287525c086fe0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\UseOriginalUrlEncoding = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BAD2909A0520CD2217267825C580F60E\D139538E9365CB4E7E2C088578FA595D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (716287525c086fe0)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\PackageCode = "D139538E9365CB4E7E2C088578FA595D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\ProductIcon = "C:\\Windows\\Installer\\{E835931D-5639-E4BC-E7C2-805887AF95D5}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\ProductName = "ScreenConnect Client (716287525c086fe0)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-716287525c086fe0\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Version = "436273176" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D139538E9365CB4E7E2C088578FA595D\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D139538E9365CB4E7E2C088578FA595D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BAD2909A0520CD2217267825C580F60E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\AuthorizedLUAApp = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3852 msiexec.exe 3852 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4120 msiexec.exe Token: SeIncreaseQuotaPrivilege 4120 msiexec.exe Token: SeSecurityPrivilege 3852 msiexec.exe Token: SeCreateTokenPrivilege 4120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4120 msiexec.exe Token: SeLockMemoryPrivilege 4120 msiexec.exe Token: SeIncreaseQuotaPrivilege 4120 msiexec.exe Token: SeMachineAccountPrivilege 4120 msiexec.exe Token: SeTcbPrivilege 4120 msiexec.exe Token: SeSecurityPrivilege 4120 msiexec.exe Token: SeTakeOwnershipPrivilege 4120 msiexec.exe Token: SeLoadDriverPrivilege 4120 msiexec.exe Token: SeSystemProfilePrivilege 4120 msiexec.exe Token: SeSystemtimePrivilege 4120 msiexec.exe Token: SeProfSingleProcessPrivilege 4120 msiexec.exe Token: SeIncBasePriorityPrivilege 4120 msiexec.exe Token: SeCreatePagefilePrivilege 4120 msiexec.exe Token: SeCreatePermanentPrivilege 4120 msiexec.exe Token: SeBackupPrivilege 4120 msiexec.exe Token: SeRestorePrivilege 4120 msiexec.exe Token: SeShutdownPrivilege 4120 msiexec.exe Token: SeDebugPrivilege 4120 msiexec.exe Token: SeAuditPrivilege 4120 msiexec.exe Token: SeSystemEnvironmentPrivilege 4120 msiexec.exe Token: SeChangeNotifyPrivilege 4120 msiexec.exe Token: SeRemoteShutdownPrivilege 4120 msiexec.exe Token: SeUndockPrivilege 4120 msiexec.exe Token: SeSyncAgentPrivilege 4120 msiexec.exe Token: SeEnableDelegationPrivilege 4120 msiexec.exe Token: SeManageVolumePrivilege 4120 msiexec.exe Token: SeImpersonatePrivilege 4120 msiexec.exe Token: SeCreateGlobalPrivilege 4120 msiexec.exe Token: SeCreateTokenPrivilege 4120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4120 msiexec.exe Token: SeLockMemoryPrivilege 4120 msiexec.exe Token: SeIncreaseQuotaPrivilege 4120 msiexec.exe Token: SeMachineAccountPrivilege 4120 msiexec.exe Token: SeTcbPrivilege 4120 msiexec.exe Token: SeSecurityPrivilege 4120 msiexec.exe Token: SeTakeOwnershipPrivilege 4120 msiexec.exe Token: SeLoadDriverPrivilege 4120 msiexec.exe Token: SeSystemProfilePrivilege 4120 msiexec.exe Token: SeSystemtimePrivilege 4120 msiexec.exe Token: SeProfSingleProcessPrivilege 4120 msiexec.exe Token: SeIncBasePriorityPrivilege 4120 msiexec.exe Token: SeCreatePagefilePrivilege 4120 msiexec.exe Token: SeCreatePermanentPrivilege 4120 msiexec.exe Token: SeBackupPrivilege 4120 msiexec.exe Token: SeRestorePrivilege 4120 msiexec.exe Token: SeShutdownPrivilege 4120 msiexec.exe Token: SeDebugPrivilege 4120 msiexec.exe Token: SeAuditPrivilege 4120 msiexec.exe Token: SeSystemEnvironmentPrivilege 4120 msiexec.exe Token: SeChangeNotifyPrivilege 4120 msiexec.exe Token: SeRemoteShutdownPrivilege 4120 msiexec.exe Token: SeUndockPrivilege 4120 msiexec.exe Token: SeSyncAgentPrivilege 4120 msiexec.exe Token: SeEnableDelegationPrivilege 4120 msiexec.exe Token: SeManageVolumePrivilege 4120 msiexec.exe Token: SeImpersonatePrivilege 4120 msiexec.exe Token: SeCreateGlobalPrivilege 4120 msiexec.exe Token: SeCreateTokenPrivilege 4120 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4120 msiexec.exe Token: SeLockMemoryPrivilege 4120 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4120 msiexec.exe 4120 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3852 wrote to memory of 1836 3852 msiexec.exe 87 PID 1836 wrote to memory of 3028 1836 MsiExec.exe 88 PID 1836 wrote to memory of 4884 1836 MsiExec.exe 89 PID 1836 wrote to memory of 1812 1836 MsiExec.exe 90 PID 3852 wrote to memory of 544 3852 msiexec.exe 96 PID 3852 wrote to memory of 3740 3852 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.Clientsetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4120
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AED9D30309160ADF52ADDE3EE2C0D832 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667078 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3028
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4F83.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668562 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI563B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240670296 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1812
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:544
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C884CE8C2933D52ADE5883341FB9F9CB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3740
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589ca9.rbs
- Size 10KB
- SHA256 dd27a34a483f022e2a0a73650ac10e2655dd44c02038fd9161988a34fc5d4ed3
- MD5 b00a8deda34fd83df9290f0ce7da1029
- SHA1 973dd0618b98bcccca048d7c3d059e5804e419bf
- SHA512 47dd120264349578bdf794b3c641d4b26a89ca6f51028944268fc5a34358f79876915ef750c7dba714356e3f7f440006f146aa79f58df531671d52db860501f8
- SSDEEP 192:gSf2Ckgr1vNO1OyGO0M6eodCEnDIOYCEnDJOnjRdnXJjQ3kjpS:gSfnkgr1vNO1OyGO0McCEn5YCEnMnHXy
- TLSH T141224D013206D1E1EA465B31DB8707543BB2EBF5A300375F15CD99389E52BA94BBD2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 727B
- SHA256 f801368de12b0de0240763e831fa5146dcb0276271c6a52b941a842373097287
- MD5 f264c501035c9803816500e5b1777cbe
- SHA1 3427971c93b6724eac8be1a117432d8bf8fde2ca
- SHA512 3bd8823f764c6f832d7bef992dfc660c02cfd205f39ac22befee5d8824976831e96374c5a0598e13bbc7615a3e686c19375f720a451b12d08d352c2f6a378149
- TLSH T1F5016519347D5440A6034F287674066176930195AA7414B3302CAB90E18D3736D3E819
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
- Size 737B
- SHA256 ceded167756e333f15a8abc1358b63233849949a26b6d9c886924ca44480e40f
- MD5 da1696435955fd4bc018fe09d66271c9
- SHA1 0d2c83c61d7953b8593bf983498793e2b108815f
- SHA512 f0bd0552be83d5ef39ff245be8d3db134514e06cea70e9794fbbc5d33bd6f32d3e32421b319fe968e4657610aaac5660f1fa435b16c9911f00c3035898ed48ea
- TLSH T166016A03DD1809CCA9525451655CCE3D09F3B70B5640D0B44158DD6C7DBC7624AE596F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 404B
- SHA256 078510866f543d42ec1be41b5b64171c91ddd541637d4a3f75cad93693a23911
- MD5 c7517e3195dd478dad52d830c9936065
- SHA1 6081f742cf4b6607288116ff14b128e54473c0cb
- SHA512 bf28c7ad90eec242efb3739f52078e6c1164f6196fd4845bf98a93775b191b240e8c3f2612a8177e2c8831c9f5629860e200524b26a38dc30444c4f3ed718fae
- TLSH T1D3E0C63822F889DDF0A1D83483FEBC124A89F2160181E3FA00401782AA02F808CA2674
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
- Size 248B
- SHA256 66d283ecc4907e22fb5de4f2ba6546f2bfa7568501bf90a6b2a310f54afdf642
- MD5 8efe782b1a1359b9c12ca4f41cbbbebf
- SHA1 d36fb8e0a0cffa19bb28b4f96115a9c8573c6f95
- SHA512 0fafdf67f702d6001b823ee2027fa3dca03791cca8c83c7b0fe89fa110e392219fd368e3cbb184c354f2daf2ee74f98d2c0353246544350c85c117d7cd00b526
- TLSH T142D0C9296BA90756F2C966BB5D754905AA20B9A6A162CB1903B2068E2874F00193196E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 746B
- SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
- MD5 768929616b943159a05e24024951fa13
- SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
- SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
- TLSH T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI48DB.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4F83.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4F83.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9E40.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e589ca8.msi
- Size 9.7MB
- SHA256 aa7222724e5a0c8e7e573f45ea13e722c701394c6d246aa75efa0677165caa9e
- MD5 1b8c796f32104c4733a7d156d65f9afe
- SHA1 3185c868de10b6bd53e5e15167ac8583e7ee2ed7
- SHA512 67a7f9137a800034e5dc167db4046de6533db20e51282343f24bf2bbfde8d001ed0603dc66605963318436506f7381f6575ec2c03b3eb1e106b85e8cb9dde292
- SSDEEP 196608:8nCtVYqI5MvbWEpKkqdIJqKgnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:4CXvI5MvHxFJWCXvI5MvHx6CXvI5MvHE
- TLSH T156A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 5eadd3374219f97c7b23cfe0011a1bef76f2d57541a75d76f8d726a2dc475f7c
- MD5 d889692871eeed8fc2a0f51f6696382e
- SHA1 6ae0ce86e3680202bb8b93f3b78675ee62092f43
- SHA512 d5a9f2244878c80ca0985a303fcc6777ad654eb983666d75bbda86797ed6a76e01636a97656813c508f0750901063cb600d11b27199f0a59d0cd9d31a4e2f9a4
- SSDEEP 24576:Lu8m+1zgdoO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:A
- TLSH T1B147B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8df99c31-4f22-4600-946d-ccc0e57a3c3f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6d01effca0ffbcecd178ba1da4a3b356ef4053a09275f9f922e9b8f0ff76b724
- MD5 639d6bf93b47da7172d14f142ecee6fa
- SHA1 5621bc9abc2777d97a1c3610257c755ca6f1adab
- SHA512 d5f6d4846ff8c3ec3b4010f16c3872e7d244b4481bf6f21354c21e05b3a1f5c0864bb53dc81ff2e12731d849e00bdd6c1829fe538f29794dcea3efac6e87ebbe
- SSDEEP 96:FHgMsqO8Avc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:CM28ab++ZVm
- TLSH T147D178085AE54711E2B3AB712CF14557A877B811EF33CB8E0298238E2670A10F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH