aadc96fe85cb6f7089b51457c2bd30ff443262ccd53fbb3ca4529289c70a595f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 81KB
Sample260620-wtfr3ahx2t
SHA256 aadc96fe85cb6f7089b51457c2bd30ff443262ccd53fbb3ca4529289c70a595f
MD5 f69859707432442f70c49c2f0678f675
SHA1 a77cb0942631742512c5a015c580ad0c6a6e2afc
SHA512 726bdc81dac32d491a9228e93bb01aab146ea52b8e83b2e038fd295e35363e827682f0409c08137c19c1ae62fa76a6fd484a1af8493fa342faeb10e755b12657
SSDEEP 1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYx76J:genkyfPAwiMq0RqRfbaWZJYYxS
TLSH
T13C836C43B5D18476E9720E3118B1D9B4593FBE210E648EAF7398422E0F351D19E3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
1	1572	dfsvc.exe
1	1572	dfsvc.exe
1	1572	dfsvc.exe
1	1572	dfsvc.exe
1	1572	dfsvc.exe
1	1572	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c589-49.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c582-196.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c583-195.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c587-191.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4608	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5600	1896	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_8101b5f77eb90010\appid = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\SizeOfStronglyNamedComponent = 3b72080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Transform = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3583912"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestValue = 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\lock!110000007a40590e24060000f403000000000000000000003d97 = 30303030303632342c30316464303065303630626332616338	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\lock!0a0000006a40590e24060000f4030000000000000000000 = 30303030303632342c30316464303065303630626332616338	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "GKRROKOZGXLTBBT3422EVHOA"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_81 = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_5ea83547667e4222\LastRunVersion = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68007400740070003a002f002f00390031002e003200320034002e00390032002e00380030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\identity = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\lock!0a000000d241590e0012000010120000000000000000000 = 30303030313230302c30316464303065303638333035636438	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "8WANV8OPC5AX66OO29NM0TGM"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_16cd7265daf303c3\LastRunVersion = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\lock!080000006a40590e24060000f4030000000000000000000 = 30303030303632342c30316464303065303630626332616338	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_81 = 687474703a2f2f39312e3232342e39322e38302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\DigestValue = f271ebc2542397e59c3d57d30cc54bf1d9db4f69	dfsvc.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1572	1896	support.client.exe	87
PID 1572 wrote to memory of 4608	1572	dfsvc.exe	88

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 908
  2⤵
  - Program crash
  PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1896 -ip 1896
1⤵
PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 b1ce83edd7ee7712c47940c4de8837ddc9ed40413b145fb2e004b92c7ab4e04d
MD5 6789dd1394cac1515a13b1f3bc694482
SHA1 5d6c6f4e22b86b23554fb93de42473eb78f38eff
SHA512 262e6d517dea54f5cf9c0a55f69914d1be71519567177e7e1b9b68ef32cfb797e69781c36ea09a53ea5fab0c584eac180fd685695f3a94a4582fa9e51b1e462a
SSDEEP 384:VOrqIMSOGnph6cOX9jX9R/QPIBM7YEYCHhc:Vnunn6cOX9jX9R/QPI+0EYCHhc
TLSH
T1E5B28141BBD6E923D1465733DCA6C3E03235FD924FA2139B30813B2F99707D95A32685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 e19ae278cf2d2b3a9249aff0f74d4600d8fab0a958651227ee42b9fee5387605
MD5 b47d3f8a267bcdfb8b21ac18eb06e0df
SHA1 45e7df4d8eac4949ebe9bd5f666a9850c220550b
SHA512 da12bbf7ed7e4591021d923facb15b8de6847a0a0f38edc5ce567d7bf5d63bae58ca2937fedc789e690309cc08b0e35b3d10458c743888fe4b76a770d58ae7a1
TLSH
T10261DC527204EA27D9B902726CE1D2EE6BB43E83CE81910FB4C47F2F75322F556212A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 60a7b27bedba14aa89896ba868f213d4e953983682ca04739e407a957150495a
MD5 a56085d3bbcc62381ec7fdc328a2a95d
SHA1 7582f7c6cf37da7ef2164156fc87ecd54ed0885b
SHA512 d15df2965a0a413b9e4b0dbdab3c636db6941e541b8a8315188f32979c22c6417f5b610a8f92cb3ab994c70785d8d07d81a9253787ceae6bd197535250e47853
SSDEEP 96:8SP+RxlSheV+Ww7NkTdeR2yUrXeEbIoWungnsRK:MRxlzJxB3yseEy6Qv
TLSH
T1F2B15411B284DA5BD4AA06339CA6C2ED77327D83CF430B0770D4BB2F76367E652221A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 5f555cfce1968f212d3504bd7bbd599ac5592457b4053e2517811bedefe020cc
MD5 bb7ecbf6bd9611e94b5f4fe246fec0c7
SHA1 4f31ea333f54506a92183ce4b8a5521d78403283
SHA512 3688c885c006ee5316ec686727ed1de2423664a099d3c4ada355099e12ec5e7535c8cba9008a68996c9e12d80eafe49a79f132c41f686cf0d7cb0b4773837fc5
SSDEEP 96:F4GBPPbpvpeV+Wwwx8WptAojK7CL5mHzNucdJ+1n6qB/B:vPPcJxptAoPLAxucuh6k
TLSH
T1F3D14611B284EE5BD5A90A339C9AD2ED33257D86DF030B0770C0BB3F76363E61612195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 57b058d75fe01ae17bdbb7a534b62d4fb2894efd4776fad862d261873ca590f3
MD5 3a10db702f88a1d46dbf2ec2921968de
SHA1 15e87e205a2e6c988d119482c98c0e2296a13986
SHA512 2b2b8700ffff594548c6919f585600a65616c365c8f53bb19089dd2742c7fc561d5aa17374d2d016ab02b95e04afd073adc6997eb940cad38e092dac4fc82bd2
TLSH
T1335110017748D667DA2A0331ECA2C6CE7BB83D43CE91110BB0C0377F5A726E55A1A1A6
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 537824f175f3d75d501ab8fe6d1420168a898cc2a5f6b524c344dbc01e5f7348
MD5 222cd8409446ef11654838d164a16e4a
SHA1 c8fca16380da382e846b59d28b04958c940a5bcd
SHA512 5c15fc3edf9da95def07350f3b806e12c71dc4ec4691addb767e97e51290adaadae48e471810589758dd120460c145e687324dc047eb05abee2d484f129850cb
SSDEEP 192:gMCII9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWojOl:gMC59rf6QX9mxX9R/QPIBM7YjW
TLSH
T14A6205847B50EA13C1069633CCE3C7E53679FE934ED3879B74427B1F6978B845A22292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 77f38b2975147ce1d2991b1172a34b89b4b9f040f04282b5c02c54519d4c0f13
MD5 74abc4c7dad4fce3682ddfdafcabf9d4
SHA1 461c75c26a60179c98de7ee1ddd0bf595ef78a3b
SHA512 483420fa270d41ec201d07565a7902628da8a1da6dd617823c91cd86c7b8879d56319a84d7b7a9cc0713190d4f4b676c282bf2ba44d4800e56707a19112f66b0
SSDEEP 48:FCa3CDVxQdgoXe6S+9ow87gWW75uvs/vObV42cAvf1fTO5inw9GUjdLf:FCa3beV+Ww8x45ueO22cAvFTOIn6GyVf
TLSH
T16C9165117280ED66D5A90633ECD6C2DD3A767D82DE43070BB0C0BB2FB6712EA1722196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ijj0ehl.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\0ijj0ehl.newcfg
Size 559B
SHA256 cf3ae33a40c65f28756a69e33032c96104b566515fbf666f0b1aebd3a291e5ff
MD5 bcfd57f6955cb71e2cdc25f0213fddcd
SHA1 b159166d95ec03b17f018533c61e7ce2fd2f613d
SHA512 2e6c84dd2783914b3619ed5e591f986d61e1cdf6958ef8b5b21a82b9a04f1ff16db0b70fe93a16f6e8d817f8c35269c9c04a59c4f4cd3329e47281a0e38b0ab2
TLSH
T118F02BB531806E4A03731D23C6114740EE726B9B155650D8786F62779F351DA03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

1qyepk50.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\1qyepk50.newcfg
Size 559B
SHA256 c59e06f8e525714b55b89a86ec668d1a91f7cc2b5567b9933f4a8382f40001a9
MD5 5aee594ed2a206742a24d4d409cf1ed9
SHA1 044c3221f78644f4c89785a96a944577635504ac
SHA512 35cdc2e80a758b81fa1b03a8f96b0b85959ad8d1c22c5cb8a87cee9c6c6bd027ea30e10ddcc4756b635b103251fbed2141d2aa496b20586c9b5d68d0a876ab96
TLSH
T118F024F631806E4A03B32E23CA114740EE722B9B111620D838AF22779F301DA03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\app.config
Size 1KB
SHA256 d661e46e08a9c066cabecc6467e7f20894e715d83729d0c2d8ed93885ef9bfd2
MD5 06c1879c1744384d54a3b8c93b51f784
SHA1 c4d48bd2e838b0dc4009a50389be43f03e23d0eb
SHA512 0db9cddb1140e34c639790a13dd8fb7a70c47437e4300505c6cfde8fd54924da6fc27a455cc2e37c66c4aa3b81e26908a6cc91b371518869028503702d2deb65
TLSH
T1A5416D1CB5C0AE9915B25631E63142D1EC7049335266B0E478DE316B9F70EDA4BF33EA
MD5 SHA1 SHA512 TLSH

Submit Download

bu41jo2l.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\bu41jo2l.newcfg
Size 559B
SHA256 acf79d2c96eebb00b627bca9347d3de681651191c0c6bfd88670297b18583cd9
MD5 316db0cb0e96367d3666f99911022b2b
SHA1 c94e3a5addac1b01d4e67460e92f6622ac99712e
SHA512 31d72b7d89e7bcf3c4cc148ab2ea9d2e046d9b4e6ed71dc248e79af2a1fa00c12acecd546af0efc137f31289ba8bca3da2cbb987a78b7529683807336274c7c8
TLSH
T10EF024B630806E4A03B36E23C6114744EE722B9B115660D838AF627B9F301DB03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

e33kjpey.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\e33kjpey.newcfg
Size 559B
SHA256 9ee89aaab05deb1fc9fe18d2b3c3e72d659efc706b9bfa518c3894b5d102bacc
MD5 9d6531999b6ae9be0406f25a60040c5d
SHA1 933b08b47a39042efa2b771f9a73bf3dd3bfa83a
SHA512 2845edf4b52562d7c8e4ea7de1f15e06aea36b03dc45eb6120eff023733f6d3e8825a2e759f42abe298cd2ae7139d0beac9502abb02c6ee0d4ee0a942f1b5321
TLSH
T1CDF024B63080BE4A03732E23C6124740EE722B9B151620D838AF22779F311DA03B31EA
MD5 SHA1 SHA512 TLSH

Submit Download

mz4n4ek1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\mz4n4ek1.newcfg
Size 559B
SHA256 8e65139aab2c38c904a36f620ced61840a1fb9d1ebae10ef8a635b651acf0aa4
MD5 ef437e60d46f6aa3cb69e2b0a1f688c8
SHA1 4caabe0a88c218f2f3153699e595dadfbbd2c4cf
SHA512 2aca48c319b3544f428240f2717c1350c9058dc3bbe52f36277fe22fd1cfc6af2375ef52671d0f36952c51ca0ba865c855c6d4bec426f443270be1df7a1a0581
TLSH
T13FF024B631806E4A03732E23C6114740EE722B9B111A60D878AF627B9F341DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

q2cvp2gv.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\q2cvp2gv.newcfg
Size 559B
SHA256 9dfd184d2b639cec5bec46b7998e4c3ca584e5b8b7e2a9b08ce4da687758cce2
MD5 1f300ffeded6958f820242a2f289d8b8
SHA1 e0d5b4570bf78d98638908a554682db64eee512d
SHA512 d3507391eae7ba03846082c6d4586c7da562ab4dfc4a06a0b9bb9e7b50abe07206368a514ce65d5214302e748e6eaa4e6423affe2b17837fce30c8b7fc0855ea
TLSH
T1B5F02BB530806E4A07731D23C6114740EE72279B155650D8386F12779F311DA03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

tcpdjoxt.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\tcpdjoxt.newcfg
Size 559B
SHA256 e9403cd1f102edc1940559114a05f3a5f71f36a2d22400668a5e34e452ac7760
MD5 c1396018c1123f85476f5ee1a49fc251
SHA1 ba1970bf732afb294ca0736d615b9013f0f73ad6
SHA512 b1b45f0ed48567f2fb007a2379d9b7f3903058c199a15ed96707e9f6efe5de6310a5ba0f60408fa5727160cfceffdcfd161e232c259054c8b954ea303182c1cf
TLSH
T1E2F024B53080BE4A03732E23C6124740EE722B9B151A20D878AF22779F315DA03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\user.config
Size 559B
SHA256 455621a7f71e731a9b89388404653871e8c9568776320fbdeb5c71e57c82fcb8
MD5 d6faf3bf8d86defa523e621dfad233ad
SHA1 88219199bc60d924829d5904153cb5c45cb3de27
SHA512 03abe4def5a593e781f44a64d65092a0a8559910db4e7cf7d2eafd1dac66bc7f238453ff1193a501a343b54ae5b63ae9acd6d4f9aaa1f40b1f3976d9a20c6684
TLSH
T133F024B630806E4A07B32E23C6114740EE722B9B115660D838AF22779F341DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\user.config
Size 559B
SHA256 bee2618c3ec94b935c296c9154c4e01ed0dae3522496100bf644206bb0d2706a
MD5 8e8868bad9b31a095a9f503faf7e9a7d
SHA1 c1d71f16a31d10802cd166e2e34260634abf689d
SHA512 08759c4d4a0189141106eab052ffa939cb74c2f988b8bfdada5fbf5d1ef644d59693f0aae02e8c13212e232d48183dfc364476e081b84795c2da3b5943b28d62
TLSH
T1FFF024B53081AE4A03732E23C6124740EE722B9B151620D838AF22779F311DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

uyy4u2dq.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\uyy4u2dq.newcfg
Size 559B
SHA256 b7f46721c53f25a3b2cbaf6f95761eb174f18f87bcf7aacee0fb704354e75781
MD5 486b4ea7f1640a322be44f7fa733a5d3
SHA1 3c03f36f09247c3d708d63d511810cb2b4e7a555
SHA512 5aa675f313f574db05c1ace3b07645c0db243b66b9f21605cbcda81e315f82cc1177721c67fe7abd00ebc08b01828ec4d38a063cc06bc4231dcb236b5007f0ee
TLSH
T1E6F02BF531806E4A03731D23C6114740EE72279B151650D838AF52779F311DA03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

wmuk4akb.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\GKRROKOZ.GXL\TBBT3422.EVH\scre..tion_25b0fbb6ef7eb094_0018.0003_99591a60a91a5c28\wmuk4akb.newcfg
Size 559B
SHA256 de40cfd40c6e1dca91149de36915b903d60b231b5f7f0f714f547afc667b7eeb
MD5 bfd9d3e46a6fa229db67649e1643cb28
SHA1 5c99e311dc706fd5eb8eb98ca7521eaa670de691
SHA512 aa7e6d8bc021f7ab585d444b9b7bdc6a8ca2270894b7dc3819e6ceb95e5884bf0e92b9b91a3ccd81a1b335c859f6d4df567f2c240af6d46019bf11a9776d4df4
TLSH
T113F024B630807E4A03732E23C6114740EE722B9B111620D838AF22779F341DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
TLSH
T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
TLSH
T14A11590181C8FA361F3301D1BEE7E02157AE1B33058D194BB0A968AFCB2DAE643471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
TLSH
T1C831E90651C4FA351F3301C1BEE7E0619BAE1B33158E1947709969ABCF2DAA64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
TLSH
T1AE216A0181C8FA261F3302D2BEE7E421979E5B3314CD194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
TLSH
T17F41D01281C8FA250F3302C2BEEBE431979E5723158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
TLSH
T1DE537D4063F84A26C9FE5E3AB4F1D2250AF1AA426451E7AE0ECD51E94E137C16F603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
TLSH
T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
TLSH
T19951B40641C8FA210F3301C1BEEBE471979E5B32158E19477099A99FCF2DAA74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
TLSH
T1EB82C54A88C17C11433691D0FFF38920BE556B2341FE048ABC4E55AF8F6569993972F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\A140MR5C.YNK\M00ACWJM.KED\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
TLSH
T18883E68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7H7NLWPO.1WT.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Y267L5P4.TM1\7H7NLWPO.1WT.application
Size 114KB
SHA256 339c2f2ebb472306d26d0592bb2b642be8dee4cf2ff7e75032a2b657abd5cf89
MD5 64025a88d8647e15d37d269e92c74bc0
SHA1 0f4f793d2c374b450a2027cddd95947cbed5ea03
SHA512 69587dbba20bdc4ab7a935dee627b8f9d8b691629aa92c665a61bb10fe4f33d2e7cb2edc1c96b5e3a14ca2f672085e75ba7ae33a2f7ef918a31fea233ea8ac55
SSDEEP 1536:QN0NFNza9/8Z0olXdBGg02TGlUoSNOF5Zxd/MGIp3/HwptocYakrm2oyEHvryd5y:xe/Ypdp3Twxd/UIptocam2o9HuzhJOvP
TLSH
T1E4B3E82A8F30F4C0877DB021D1652D6735811B57DBB30FECDA0A186B0E69796EF5A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-31-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-14-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-59-0x00000238F35D0000-0x00000238F35E8000-memory.dmp

Download

memory/1572-53-0x00000238F3B20000-0x00000238F3B56000-memory.dmp

Download

memory/1572-47-0x00000238F3D00000-0x00000238F3D96000-memory.dmp

Download

memory/1572-41-0x00000238F3FC0000-0x00000238F416A000-memory.dmp

Download

memory/1572-0-0x00000238ECA60000-0x00000238ECA68000-memory.dmp

Download

memory/1572-22-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-1-0x00007FFF3661F000-0x00007FFF36620000-memory.dmp

Download

memory/1572-2-0x00000238EF1F0000-0x00000238EF378000-memory.dmp

Download

memory/1572-20-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-304-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-305-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-65-0x00000238F3CF0000-0x00000238F3D7C000-memory.dmp

Download

memory/1572-12-0x00000238F3580000-0x00000238F35D0000-memory.dmp

Download

memory/1572-322-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-9-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-8-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-7-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-6-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-5-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-4-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/1572-3-0x00007FFF36490000-0x00007FFF36E34000-memory.dmp

Download

memory/4608-296-0x0000000002EF0000-0x0000000002F08000-memory.dmp

Download

memory/4608-288-0x0000000000E20000-0x0000000000EB6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads