Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.Clientsetup.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.Clientsetup.msi
Resource
win11-20260130-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target ScreenConnect.Clientsetup.msi
- Size 9.7MB
- Sample260416-pps39sft9n
- SHA256 aa7222724e5a0c8e7e573f45ea13e722c701394c6d246aa75efa0677165caa9e
- MD5 1b8c796f32104c4733a7d156d65f9afe
- SHA1 3185c868de10b6bd53e5e15167ac8583e7ee2ed7
- SHA512 67a7f9137a800034e5dc167db4046de6533db20e51282343f24bf2bbfde8d001ed0603dc66605963318436506f7381f6575ec2c03b3eb1e106b85e8cb9dde292
- SSDEEP 196608:8nCtVYqI5MvbWEpKkqdIJqKgnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:4CXvI5MvHxFJWCXvI5MvHx6CXvI5MvHE
- TLSH T156A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3368 msiexec.exe 3 3368 msiexec.exe 4 3368 msiexec.exe 5 3368 msiexec.exe 6 3872 rundll32.exe - Loads dropped DLL 31 IoCs
pid Process 2680 MsiExec.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 1588 rundll32.exe 2680 MsiExec.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 2680 MsiExec.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 4976 rundll32.exe 2804 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (716287525c086fe0)\ScreenConnect.ClientService.exe msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e586b86.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{E835931D-5639-E4BC-E7C2-805887AF95D5} msiexec.exe File opened for modification C:\Windows\Installer\MSI6CAF.tmp msiexec.exe File opened for modification C:\Windows\Installer\{E835931D-5639-E4BC-E7C2-805887AF95D5}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF0CCB240FCDB27F41.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFDF0FDDB81CCEC0BE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF1DECED8F06F036E3.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6CDF.tmp msiexec.exe File created C:\Windows\Installer\e586b88.msi msiexec.exe File created C:\Windows\Installer\{E835931D-5639-E4BC-E7C2-805887AF95D5}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFEA74A9335D703AA9.TMP msiexec.exe File created C:\Windows\Installer\e586b86.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3368 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D139538E9365CB4E7E2C088578FA595D\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D139538E9365CB4E7E2C088578FA595D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\ProductIcon = "C:\\Windows\\Installer\\{E835931D-5639-E4BC-E7C2-805887AF95D5}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\PackageCode = "D139538E9365CB4E7E2C088578FA595D" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-716287525c086fe0\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\ProductName = "ScreenConnect Client (716287525c086fe0)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\SourceList\PackageName = "ScreenConnect.Clientsetup.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-716287525c086fe0\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (716287525c086fe0)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-716287525c086fe0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Version = "436273176" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BAD2909A0520CD2217267825C580F60E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BAD2909A0520CD2217267825C580F60E\D139538E9365CB4E7E2C088578FA595D msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139538E9365CB4E7E2C088578FA595D\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3144 msiexec.exe 3144 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3368 msiexec.exe Token: SeIncreaseQuotaPrivilege 3368 msiexec.exe Token: SeSecurityPrivilege 3144 msiexec.exe Token: SeCreateTokenPrivilege 3368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3368 msiexec.exe Token: SeLockMemoryPrivilege 3368 msiexec.exe Token: SeIncreaseQuotaPrivilege 3368 msiexec.exe Token: SeMachineAccountPrivilege 3368 msiexec.exe Token: SeTcbPrivilege 3368 msiexec.exe Token: SeSecurityPrivilege 3368 msiexec.exe Token: SeTakeOwnershipPrivilege 3368 msiexec.exe Token: SeLoadDriverPrivilege 3368 msiexec.exe Token: SeSystemProfilePrivilege 3368 msiexec.exe Token: SeSystemtimePrivilege 3368 msiexec.exe Token: SeProfSingleProcessPrivilege 3368 msiexec.exe Token: SeIncBasePriorityPrivilege 3368 msiexec.exe Token: SeCreatePagefilePrivilege 3368 msiexec.exe Token: SeCreatePermanentPrivilege 3368 msiexec.exe Token: SeBackupPrivilege 3368 msiexec.exe Token: SeRestorePrivilege 3368 msiexec.exe Token: SeShutdownPrivilege 3368 msiexec.exe Token: SeDebugPrivilege 3368 msiexec.exe Token: SeAuditPrivilege 3368 msiexec.exe Token: SeSystemEnvironmentPrivilege 3368 msiexec.exe Token: SeChangeNotifyPrivilege 3368 msiexec.exe Token: SeRemoteShutdownPrivilege 3368 msiexec.exe Token: SeUndockPrivilege 3368 msiexec.exe Token: SeSyncAgentPrivilege 3368 msiexec.exe Token: SeEnableDelegationPrivilege 3368 msiexec.exe Token: SeManageVolumePrivilege 3368 msiexec.exe Token: SeImpersonatePrivilege 3368 msiexec.exe Token: SeCreateGlobalPrivilege 3368 msiexec.exe Token: SeCreateTokenPrivilege 3368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3368 msiexec.exe Token: SeLockMemoryPrivilege 3368 msiexec.exe Token: SeIncreaseQuotaPrivilege 3368 msiexec.exe Token: SeMachineAccountPrivilege 3368 msiexec.exe Token: SeTcbPrivilege 3368 msiexec.exe Token: SeSecurityPrivilege 3368 msiexec.exe Token: SeTakeOwnershipPrivilege 3368 msiexec.exe Token: SeLoadDriverPrivilege 3368 msiexec.exe Token: SeSystemProfilePrivilege 3368 msiexec.exe Token: SeSystemtimePrivilege 3368 msiexec.exe Token: SeProfSingleProcessPrivilege 3368 msiexec.exe Token: SeIncBasePriorityPrivilege 3368 msiexec.exe Token: SeCreatePagefilePrivilege 3368 msiexec.exe Token: SeCreatePermanentPrivilege 3368 msiexec.exe Token: SeBackupPrivilege 3368 msiexec.exe Token: SeRestorePrivilege 3368 msiexec.exe Token: SeShutdownPrivilege 3368 msiexec.exe Token: SeDebugPrivilege 3368 msiexec.exe Token: SeAuditPrivilege 3368 msiexec.exe Token: SeSystemEnvironmentPrivilege 3368 msiexec.exe Token: SeChangeNotifyPrivilege 3368 msiexec.exe Token: SeRemoteShutdownPrivilege 3368 msiexec.exe Token: SeUndockPrivilege 3368 msiexec.exe Token: SeSyncAgentPrivilege 3368 msiexec.exe Token: SeEnableDelegationPrivilege 3368 msiexec.exe Token: SeManageVolumePrivilege 3368 msiexec.exe Token: SeImpersonatePrivilege 3368 msiexec.exe Token: SeCreateGlobalPrivilege 3368 msiexec.exe Token: SeCreateTokenPrivilege 3368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3368 msiexec.exe Token: SeLockMemoryPrivilege 3368 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3368 msiexec.exe 3368 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3144 wrote to memory of 2680 3144 msiexec.exe 81 PID 2680 wrote to memory of 1588 2680 MsiExec.exe 82 PID 2680 wrote to memory of 3872 2680 MsiExec.exe 83 PID 2680 wrote to memory of 4976 2680 MsiExec.exe 84 PID 3144 wrote to memory of 1480 3144 msiexec.exe 88 PID 3144 wrote to memory of 2804 3144 msiexec.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.Clientsetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3368
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8D72F234BBBB57800A5DD3C4556E2E1A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240658468 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1588
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2C9A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659625 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3872
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI320A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240661031 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4976
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1480
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD2146E47D2EC5BD62D975D27577B2522⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2804
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4416
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e586b87.rbs
- Size 10KB
- SHA256 146bf02ced47dc22cd11ba54ab202a58f50a5b457d76cd0d0f3c5aaa62f87303
- MD5 7a7534df39f0e12e115e3387525f7e38
- SHA1 ec2f00b114b02ffd12be6a8a1b90b6ec149b7a9c
- SHA512 6e10f67d07a2309b576e671ac392c0f6af90749224ba2822e959e0d43d390cef7fe769529c3b9466feb052f8ab0ac484ba984f7030e2c5dc78d87d71b8ad95a9
- SSDEEP 192:zSf/Ckgr1vNO1OyGOSETCTdCEnDIOYCEnDJOfjRdnXJjQ3kjpS:zSfqkgr1vNO1OyGOSEoCEn5YCEnMfHXy
- TLSH T14E224D013206D1E1EA564B31DB8707543BB2EBF5A300375F15CD99389E52BA94BBD2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 727B
- SHA256 f801368de12b0de0240763e831fa5146dcb0276271c6a52b941a842373097287
- MD5 f264c501035c9803816500e5b1777cbe
- SHA1 3427971c93b6724eac8be1a117432d8bf8fde2ca
- SHA512 3bd8823f764c6f832d7bef992dfc660c02cfd205f39ac22befee5d8824976831e96374c5a0598e13bbc7615a3e686c19375f720a451b12d08d352c2f6a378149
- TLSH T1F5016519347D5440A6034F287674066176930195AA7414B3302CAB90E18D3736D3E819
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
- Size 737B
- SHA256 ceded167756e333f15a8abc1358b63233849949a26b6d9c886924ca44480e40f
- MD5 da1696435955fd4bc018fe09d66271c9
- SHA1 0d2c83c61d7953b8593bf983498793e2b108815f
- SHA512 f0bd0552be83d5ef39ff245be8d3db134514e06cea70e9794fbbc5d33bd6f32d3e32421b319fe968e4657610aaac5660f1fa435b16c9911f00c3035898ed48ea
- TLSH T166016A03DD1809CCA9525451655CCE3D09F3B70B5640D0B44158DD6C7DBC7624AE596F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 404B
- SHA256 e307125d03d705a1386534515aac642bfdf109126d69032497045d2c2ed4b344
- MD5 6f6be3ce7ecb93fefd1f56546596764e
- SHA1 774a915de669db36a570363f04a0574f57646811
- SHA512 f39720f3a29559199f902c66478b9e293bd76430acba2dd6bd7f234741f5ccd4f9a51954fcf2fa8abb8830ce38abcd617333aeebf338c5da506d8c0cd007ed02
- TLSH T12EE0C63832F888DDF1E1D83883FEBC124988F2160081E3BA00401682AA02F808CA26B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
- Size 248B
- SHA256 d6066698be841a06d5c7c7f4c54d35adb1c7ede185a83acff009fc6dfa376288
- MD5 187445358670f75589e3ad9d55125416
- SHA1 3fe258388c373b9a094257d50693cc859d4b8d9e
- SHA512 a907e2a1491b2446139c62858d02bf5d74b6876fadc816ac243725214211ab8f0956c21e8bda7cb548b42afb31b8bbad5a6013d246a49278cfc63d2760661e70
- TLSH T1CDD0C9246BA9431AF2C566BB6D748905EA3079A2A562CF1906B2068E2834F101971A2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 746B
- SHA256 76ced2c52d647683572ceac0687933e96e198b5a6f998457fa334763cc1ef978
- MD5 26c503e0811477d4790fa3b9260e6bc3
- SHA1 cd89a648ea30052b34d2ce993433967adfdf5b74
- SHA512 125678cee78705f07e56d69ffbf08fd616dac3ea3f2ff34f4e703b0ec2329da575e5b30de4494639baa17d8e68343ceb9a4e99e9edcaf4cfad516a715a904874
- TLSH T1A4017B702231B5D948132F43085D66891BFF0755BAB8EE1CB599325EDC3A0176F222E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI272A.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2C9A.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2C9A.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6CDF.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e586b86.msi
- Size 9.7MB
- SHA256 aa7222724e5a0c8e7e573f45ea13e722c701394c6d246aa75efa0677165caa9e
- MD5 1b8c796f32104c4733a7d156d65f9afe
- SHA1 3185c868de10b6bd53e5e15167ac8583e7ee2ed7
- SHA512 67a7f9137a800034e5dc167db4046de6533db20e51282343f24bf2bbfde8d001ed0603dc66605963318436506f7381f6575ec2c03b3eb1e106b85e8cb9dde292
- SSDEEP 196608:8nCtVYqI5MvbWEpKkqdIJqKgnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:4CXvI5MvHxFJWCXvI5MvHx6CXvI5MvHE
- TLSH T156A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 3110e6ccab4175b67c096d32ee23c4d96c5ac5cf46dd0ff3a1083a513bb701d3
- MD5 d8fdc78ffd01c579856108d64c1b44fc
- SHA1 4e88ed48e04692ac47d66b60bc699fafa294011a
- SHA512 5c3d54a7006988708dbda07966fb96876aeb573639c5790177016c2c3d70b0415af714165d3747af300b31a94df81310e5c45d476beddc48d1339837cdb0e739
- SSDEEP 24576:p2gmSp1edoO/vvTLSm5eRUXKfK5SgotjWW6dXpkpQy6o0198Yy4+7Ej+x:O
- TLSH T1B147C52836F92110E7F7DE3CB8F06A23493A7D579C1A9E8D05811F4D0961BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{3172925f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2020f1c7-c248-4c16-9c3c-9ab50f6dd797}_OnDiskSnapshotProp
- Size 6KB
- SHA256 2467cbd01106bc70521cf88dedfec69454c6c8d1a54934d15c46849db3bfded9
- MD5 299c5a901d8fd4180934435a67b1332c
- SHA1 06c18bdef2699da6920424d2eedb08e553c614ec
- SHA512 393fc0ba74be392b834df89921bd752952af6b2c212d51c633cdc2bc9229a1df919c1ecfcef1457547f31c415e454ffcba6ae57bee08aca4d9566a68c92709e8
- SSDEEP 96:FSMsfMxvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:IMt7b++ZVm
- TLSH T16BD1770C5AE54711E2B3AB7228F14557A877B911EF33CB8E0198238E6670914F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH