d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Size 305KB
Sample260420-lap7aaat51
SHA256 d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9
MD5 8d1fdc44f9532228a8d72a6f369ab1d2
SHA1 429dfd298420fa25a0635938c97ba31e868fb8d4
SHA512 f2056b0436098049e5af17a4417934b2bb5acede51d2ecb3f6691507bbc86e953aa6ebfaf405542116e35bd2e147522d8de717d75315c7a6299d6dbced86ee53
SSDEEP 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9
TLSH
T1AF646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
2	5040	dfsvc.exe
2	5040	dfsvc.exe
2	5040	dfsvc.exe
2	5040	dfsvc.exe
2	5040	dfsvc.exe
2	5040	dfsvc.exe
2	5040	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsClient.exe.config_f7f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\SizeOfStronglyNamedComponent = d972090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\DigestValue = 03f92b570ce070dae7146a390041804375c718c0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4a = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "Z2M02L5BZNVMXE7A3096BA2L"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\appid = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_6acd6157af9d4abe_6e521f6d9f90a6ed	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\implication!scre..tion_6acd6157af9d4abe_0019.0003_615 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsFileManager.exe_0e21f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\DigestValue = 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d00640077007300730061002e0074006f007000260070003d003800300034003100260073003d00620035003800650035003600390032002d0035003800320064002d0034003100340066002d0062003700660036002d0066003700340065003700310037006200640032006100650026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004200740041003100510077006e0078006d0044004a0067007400670035005000530051004b004d0032002500320066005800720049003500740053007600470058006d006f00620078004b006b0070004100700066004b00520078004e004600640073002500320062004100750067004b0077004900640078006a006f00680070006500320065003500670033004a0058002500320062004e0057003700550064003700510071007800450077004a0043006e006b0051003200500037003400520039007700570067006a0046005000390054006c00640069007800580071004d002500320062006a00440078005900490025003200660066005600530053004b0038005a00350056005000450033004b005a006900680072004c0071005800370058006e00550043006d00370068004b0045004e00750067005800560054007000520062004500590038006900660034004900740031006f00540048004800640044002500320066003600250032006600640025003200620033007500680054004e00670025003200660034003100380041004e0036004100360047004a0066003200320074002500320066006600740069003000710075004400500050005a0031006b0070006b0045006d006f006c0055004a00440045004800360070007000250032006600310055006800440072003700640074007a0056006a0041003400690046006100300044007000360073005500740068002500320062004b004b006b003000550049004f0025003200620042006f006700430045004100670063005600790076005000460054006f004100660025003200660030005800480034006700370067006500440075004c00410075006b00440053004e0037004e00310041006c0065005a005900390057006b005a0039006e00340071002500320066005700310072006c0036006c0076007900410044003100590050005200330079002500320066006600700061004b00490078007400470045006a00530034004b00430044005a007a004400260072003d00260069003d00640077007300730061002e0074006f0070002d004f00510075006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\implication!scre..tion_6acd6157af9d4abe_0019.0003_615 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "Q6689L4WPGCR46PJLTBBJ56D"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\implication!scre..tion_6acd6157af9d4abe_0019.0003_615fae6a = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsFileManager.exe.confi = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\lock!04000000cd33580eb0130000d01300000000000000000000 = 30303030313362302c30316463643061366564313437393265	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\implication!scre..tion_6acd6157af9d4abe_0019.0003_615 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\implication!scre..tion_6acd6157af9d4abe_0019.0003_615 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd241 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd241 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\SizeOfStronglyNamedComponent = ac25010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\implication!scre..tion_6acd6157af9d4abe_0019.0003_615 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\lock!0c000000cd33580eb0130000d01300000000000000000000 = 30303030313362302c30316463643061366564313437393265	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 32003000320036002f00300034002f00320030002000300039003a00320030003a00330039000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4a = 680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5040	4348	d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe	79

C:\Users\Admin\AppData\Local\Temp\d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe
"C:\Users\Admin\AppData\Local\Temp\d9b543ef3c741693111a555b26b41e50ab0d7ca5cc6bb2930ebe9c24d5a4ebd9.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms
Size 24KB
SHA256 2487860162a193bc186f109eaa727342ebec6135fa06bd860ec70b3ee31af34c
MD5 d5aaed658c0e1cf0182c63a747aacd9e
SHA1 655c381abbbca76cb346a07862ae8154d25a1666
SHA512 5548b6d3ce0314dfbb2a3cb73cf0c81307eda84df9223fe8b362be4773a0bb064280910712aecc1dcd2ae8e5ff3168216ba2417cf2f75912fce72bcaf4b11916
SSDEEP 384:qmqmvmGb65EB3G3T/QP/FM7YlV+2qDm0MET9Tb7yX3PAjbRn6YG:qTG6uBST/QP/i0K9Dqydg
TLSH
T1C3B21756B729EC3FE36386319CB2CB967219BC92DFB60097B040773D4638658DE70689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms
Size 3KB
SHA256 e326df846f6ee1d05adb2220c8c2d74baa6f5a5129a7f9364a68e23dbbabb458
MD5 4f732c47dc4af37269143b3b238e14c0
SHA1 58a880d114607c24e92d58a1d2bd1774a2f69cfe
SHA512 1df2e3396943a1fd9fb2e7b83a9efd6a6dfe1ecb7c0847aec9a2226e12e326be8debdedfcbb546ec9f9d9f94763a615ee21963881a0884489d2a0f0e84ac45d7
TLSH
T1D3616502B644EE17C9A90273ACD6C2ED36747E83DF42460B74C4BF2F7A312F65612191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms
Size 5KB
SHA256 51ef99c2332a92302bf6511035e0e9d124ca9a6e6bd4b5659aec2f4cede61919
MD5 9229da14ab2923424fe9a09fe2004095
SHA1 c142fdc2fec473de3ed314b037e5575030c5fc56
SHA512 c0935e90cc73bca431957d74aa1cc63fc9961b7fcf46cd26e508c0c5a73ddf3fe983e8f6956d4578dbc223eea01af77aff8d7ba13665f55c10f776dc99c23807
SSDEEP 96:PEm4+RzgvheV+Ww76kaJOlV5lZWvyuwnANbZF:vRzg2JAaSv/xALF
TLSH
T17EB167117284DD1BD56906339CA6C2ED2A357E92CE43070770D8BF2F7A326E65222195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms
Size 6KB
SHA256 62824f8e006b97c6bb7f6addb9bfd79a2375f4a4aaa6eb2c831fb48917300f6f
MD5 9d0ef98d538bbf3f5bb9d455db274e8f
SHA1 e0a1db45c6de1d382a925e2155fcd3f5a798bc9d
SHA512 e6d5d28ed1c5c21c65477f6f86bca99312c8c34974361c3ca5802ae49798b156672e1ee465b431ec35d2194f9f24d45353084efa553aff21d777822233fcfa47
SSDEEP 96:cwQPPypJIeV+Wwwg8WRBrlwoi+Q6j+rks6b/FK:2PPWJMRBRrMILRK
TLSH
T14ED157127286EE17E5690633AC9AD3DD32293E87EF4B471B30C5BB2F76312E61622055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms
Size 2KB
SHA256 65702dc3c70789346c443ec074c745603e679482ba5894853275e1311d98ad74
MD5 8638594a680d65b009e46eda60e4edd9
SHA1 8f5052ce49394803b75ee892998540379b8a5f48
SHA512 70286592ef8ae5d3efbafc2f4e0506d1523fdaef2d8654c665982d35bf4122988302715c787b213da594c607ca1d0595d7ab371f16612452014030a423ef0818
TLSH
T1ED511F013748D667DA2A0331ACA2C6CE7BB83E83CE91510BB0C0377F5E717E55A1A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms
Size 14KB
SHA256 35d9b2aa2949efa99f64ef87db0b41494f1e4fe5520ce55fe03f74c762364ab1
MD5 66419026a0611e0a1382cd88ec18d5c7
SHA1 b6b825cb920534c5bc8d0b6bc791fc5de39a5f98
SHA512 8c44b1ba03ca0091ff9a10a6e4bc9a379e33e6e16c5032b8bfae5bfdb39d8424695fa68ea48b63372aaeb00a7709cc4b55470abed6ad239ed6204abb7e8e61d4
SSDEEP 192:GWQJ9rsE6sZsP9gMe4g0ZKO14p3x4gT2x2QP7/rImEDh7BqWojOp:GWA9rsE6s+Pbe30ZL6pB3T/QP/FM7Yji
TLSH
T16A6208853791E917C2469A32ECE3C7E57239FD834ED2878B34407F1FAD30B855A22695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\manifests\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms
Size 4KB
SHA256 4ff473117b7e7036f2156e3ff0d6fed0408330ec101aae53de8a0d65b2315382
MD5 d20e89c639e6fb5639a8432d1f3f77fe
SHA1 446c38f5637d22422d4838b31cf27bec3505936d
SHA512 2f7de67a8c5f2b656a6d99d7cf86a28b4bd164dd8bc2d095973d8e0e36d716f46fabdf5b3e6e892312341aeac502697b13ab690685f05c246f5e15a282fae6de
SSDEEP 48:iuEAnCDvx+dgJe6S+9ow87gnW75uv0b+l9S6m84FGjtBYcTyA9UPCf:VleeV+Ww8g45ummlm8mGjX9TyObf
TLSH
T10D91CC117280EE2AD5A40633AC86C2DD3A797D82DF46070B70C47F3F76716E60725196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 a3e400824a622a094f5b75d3bd0ac6737f62537ce97a18a948b6876e8861a712
MD5 03547f425670dde601195bd601d1ba89
SHA1 64cdddbc8dc3132a9822cbc24295609727e15799
SHA512 66038dba18f47aea0bc717a55147d0fc8ba45625ba550d8dd6a2e37aa66efbaed57c4af72bf86e26d0d472eeef2afe6c5c3acde965f921d7a7e2966a7fa98297
SSDEEP 1536:5bHOH2MJv2vmDtyQXIE+TC4fIfXWbU017RjbvP:5buH2MJvyQEqa1N/
TLSH
T19A538C4163F80B16DDFE5E39B5E2A5240EB0EA039441E7AE1DCDA5D94E437806B603FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\6T9AZ1ZC.BWH\DLWVNN3W.Y4Z\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 84780076495c67516e5059181e8d9ed24a17534e8d47efb7755c4d5f9d815d75
MD5 04cb3bb182262f142069967803419b9b
SHA1 6654f8403a764f4880894b904819fd6d3e539c3c
SHA512 294e2a395caf7ebb33faa55517b52cf6d2384cde9abd545786024cfb4fb10c3436578be10a6a159eb07f5dfd99b9da149c1d773c52664f7a2176d0153090aee0
TLSH
T1B5115C1181C8F9361F3301D2BEE7E021576D1B73048D1947B069696F8F29AE64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 cb26a8c4059cd1eef78bb6c91d5d3674e5f5cd495cacc6590858f0020e6d82a0
MD5 5e21aadec3a782d745f4f7c647f041c9
SHA1 6469b76d12bf12a4048ba647aeed22ab9549ebfb
SHA512 01f94dcdc5aff7c8f6c47df69338d6642549e54c65c0bd110dc815909fc665b43e7847d505e55c0bfa0e1b847112984e253582f16982f6a65e194ee243e60433
TLSH
T1BB31091650C4FA351F3301C2BEE7E020575D1B73148E1947709D599B8F2DAA6434B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 4f64d5ec8f8684a9c6ceba3ddec8396b726607140023ed38c75b6c2aeee0972f
MD5 e9438a703eeb765f7f2b544a0b4a162f
SHA1 20212453c8a84289a6bac57e761f98838de56890
SHA512 4e888654024480ba3217ab6ea286f62323156bbbf384977764e076edd64574bca1d7e5d3ec371ad86bff6c1da652f9eb177f90b37f8b95de0cad7407e924954e
TLSH
T1CF21671181C8FA261F3302D2BEE7E421979E5B33188D194B74A9699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 2812598c3e94d284d506b81f5e55c18365a977979b19cec72fca129a706ed22e
MD5 41c9e5bd7b4649061816d367d6005711
SHA1 c17a6f4c5403e8f9d69de04e58a49280660d4a3f
SHA512 68417c9b7badec989ce198f4a16c17a336ce6f161bc1ebcb1769dc0539a23707507f14e3fdbb1f48bc2f66a1f82539ed432d7f4910a7666dbfa7239b1f33367f
TLSH
T14341D31281C8FA250F3301C27EEBE431979E5733158E194B7499AA9BCF29AE74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 4231e7a3546d04c60d9cfcc4b65b29b60baedf5839d0660c3b8dbd2850f9b6b3
MD5 15a5c08ff8c9af283bbf956dd00b8855
SHA1 c35e48a92aafbad77e958956ca9dd2e1c5309922
SHA512 40ae140c38f3722a66c069c16b29d2837471a9b441a6bac42b7ba1741bd8b9979bd60623ba860caa29b4eec6e14b8796b46eb20d0f080291fd8268f7a157a9a1
TLSH
T11251C31641C8FA250F3301C2BEEBE471979E5B32158E1947709D9A9BCF29AA7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 1a712c779287868716ac3fc1733e3cf86c05158a92ff1b7dca9ffcda1a4d9fb1
MD5 c05b5069724d567e3857f005c0aa9cbc
SHA1 efbb66ef9a6b38e0d35911c2dd5e8c7369b45d27
SHA512 ebd227b7d3de8794dd7a7bbe4e09af34ce02c1fd1a0de0d0d4a8e967635930d2afc19a27a2a17820c0a0b56dd4442adefde27edc48de299dce33874bd568d888
SSDEEP 384:5emh4h6Wt/EaXVf6nEi3D363T/QP/cM7Y7:5rs6E+zGT/QP/B07
TLSH
T19882D65A88C57C215332D4D0FEE38925BE097B2341FD04CA7C9D56AF9F2169987832EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZEHNDPM.3NO\DH14X00P.ALD\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 b814c00beb52143cd928a70703300254dd59421f969a94c7b61f673733e27c46
MD5 eabbe94e82ece42897fbe2f141675ab3
SHA1 13fc3d90537164796cd1c189decc5053c9d44936
SHA512 5e05c1372c0b7a380fb93ed741c8eb79a6113d3bdcafaa42a1157a5205fb68e4cd68a211117919b1e1848eadf8d8de82bc912397b26423313cf8697c80866e22
SSDEEP 1536:Ptytl44qzbYI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Qx97RJc:M/jukLd49NW
TLSH
T18983E68235762631DF85C5379492C9B59C366F22133DC5BD2DA2FE7A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6LG03NVP.B7P.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PGEPZOP4.OON\6LG03NVP.B7P.application
Size 119KB
SHA256 79f2e760f8d46b0207d9398a88c297cc3075cd6dff21d9440c52f2151569da90
MD5 58ccdfea764d4d7b50956ccc6b082b1a
SHA1 f7e3e0b5ef6f0a812627d8c419ad7bd8e11f9e80
SHA512 b64436bfac19029bfd47f1a55a12eb239d307ec7e2039257441e38b28fe85c297376820a4eccfd2dffa833590356a9de89f303a83035c00b72077971961366b2
SSDEEP 1536:grSsJG6uyWVfI3XiuWrXAxBpKobw58so5v6Ppo/18Q08UVh5aILTvooBT53/rm2W:IfpJ3S7rX66PpQy5HX9Nm2o9HuzhJOvP
TLSH
T124C3082A8F30F4C0477DB020D1A52D6739811B97DB730FECDA1A186B4E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-31-0x0000000002090000-0x000000000210C000-memory.dmp

Download

memory/4348-32-0x0000000001E30000-0x0000000001E7A000-memory.dmp

Download

memory/4348-357-0x0000000001E30000-0x0000000001E7A000-memory.dmp

Download

memory/4348-346-0x0000000002090000-0x000000000210C000-memory.dmp

Download

memory/5040-49-0x000002B137480000-0x000002B1374B6000-memory.dmp

Download

memory/5040-26-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

memory/5040-39-0x000002B137E60000-0x000002B137EF8000-memory.dmp

Download

memory/5040-44-0x000002B134270000-0x000002B134282000-memory.dmp

Download

memory/5040-67-0x000002B137E50000-0x000002B137EDE000-memory.dmp

Download

memory/5040-33-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

memory/5040-55-0x000002B137440000-0x000002B137458000-memory.dmp

Download

memory/5040-0-0x000002B119A70000-0x000002B119A78000-memory.dmp

Download

memory/5040-43-0x000002B134480000-0x000002B13459E000-memory.dmp

Download

memory/5040-61-0x000002B138120000-0x000002B1382CC000-memory.dmp

Download

memory/5040-6-0x000002B136D80000-0x000002B136DD0000-memory.dmp

Download

memory/5040-3-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

memory/5040-2-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

memory/5040-1-0x000002B133FD0000-0x000002B134158000-memory.dmp

Download

memory/5040-328-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

memory/5040-344-0x000002B134480000-0x000002B13459E000-memory.dmp

Download

memory/5040-42-0x000002B11B760000-0x000002B11B76C000-memory.dmp

Download

memory/5040-45-0x000002B133F80000-0x000002B133F90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads