b9f1f768ac05c84377c2e36fa56be5294856571cf59a168dc768cb6b29037fc3

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 305KB
Sample260623-p4v66sc121
SHA256 b9f1f768ac05c84377c2e36fa56be5294856571cf59a168dc768cb6b29037fc3
MD5 048f9479bf9e79c486bd4b6a527f6025
SHA1 72c94bf53992e4ebe5311d77ca04a46af570f33c
SHA512 571b852ee94adb5b837ee132c79b6ffc781b0439055f5df9a8f7dd5b4726ae4d7a9ad3ea160bf08c32e1700aacdcae456d7a0c853b4794a0e8e6d8096f87214b
SSDEEP 6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9wg:h1iw7gryNkSV1hy1Z1u2JLu9wg
TLSH
T13C647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
1	5524	dfsvc.exe
1	5524	dfsvc.exe
1	5524	dfsvc.exe
1	5524	dfsvc.exe
1	5524	dfsvc.exe
1	5524	dfsvc.exe
1	5524	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c522-46.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c51b-199.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c521-194.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c51c-198.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4508	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files\ScreenConnect.WindowsClient.exe_6492277df2d = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "4VXOXX59K1CW72H5O8O9XGYK"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\lock!0800000056bc580e9c110000701600000000000000000000b = 30303030313139632c30316464303330663535373736396139	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!1200000065bc580e9c1100007016000000000000000000003 = 30303030313139632c30316464303330663535373736396139	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 68007400740070003a002f002f003100340034002e003100370032002e003100310030002e003200350033002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0068003d003100340034002e003100370032002e003100310030002e00320035003300260070003d00380030003400310026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510043004c006f004f0046006b0030006a007500430047004b00500038007100790030005700610066007a0059004f0075005800560030005500720042006b00650037006500610042006b005700780046006d0034007800360035007400370043004c0036006400710039003300540065006e0058005300660073006d006f00620033004300510025003200660043004200380056004c00380038004e00300055004e004c0043006300510045004b004a0057004c004d004d006c0033006d006900790052006e0075004e006d004c00630045006e0025003200660066003700520044005100740061005a0067004500530034007a00660064004c00250032006200710077005700740058005100550074006a0065006b004c0048006d00720053006a00790076003800530033003300410050006700480065004d0058007400350059006c0069004200250032006600780053005000790043006f003800760069006f00770053003500760047005100410067006600470068006c00760062006500330078004a002500320062006f00730064006b00380025003200660034005400690049006e00710052006a003500360076003100790072006b0076006100510035005900760061006900610036006b007000470055003500560034004e006300670031006200640072003200510025003200620062004c0031004700690054004b003500500025003200620053004e0036004c0041006e003200570061004b0066002500320066004900780075005500700062006500770064006e004a006b0053004300740069006f006e0044007900690076006900310073006c0070004600590032004300670033007400620041003600570041006a004f0046007a0039004b006c0072004b0055006a00590069007700420074007600620025003200620068006c00390025003200620071006300780061005900310056003300480034005200340031004e005000530076006d002500320066004d0025003200620068000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!0a00000056bc580e9c110000701600000000000000000000b = 30303030313139632c30316464303330663535373736396139	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb09 = 687474703a2f2f3134342e3137322e3131302e3235332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\identity = 687474703a2f2f3134342e3137322e3131302e3235332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!1a00000065bc580e9c1100007016000000000000000000003 = 30303030313139632c30316464303330663535373736396139	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!01000000c6b9580e94150000ec04000000000000000000001 = 30303030313539342c30316464303330663463303237333638	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!0400000056bc580e9c110000701600000000000000000000b = 30303030313139632c30316464303330663535373736396139	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\SizeOfStronglyNamedComponent = 3b7a080000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_2b4bcd0fb781c81d\appid = 687474703a2f2f3134342e3137322e3131302e3235332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\appid = 687474703a2f2f3134342e3137322e3131302e3235332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_2b4b = 687474703a2f2f3134342e3137322e3131302e3235332f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\lock!0a00000081ba580e94150000ec04000000000000000000006 = 30303030313539342c30316464303330663463303237333638	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_2b4bcd0fb781c81d\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!0800000081ba580e94150000ec04000000000000000000006 = 30303030313539342c30316464303330663463303237333638	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsFileManager.exe.config = 01	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 5524	3940	support.client.exe	88
PID 5524 wrote to memory of 4508	5524	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 2c6eed828e9f59433c6919494a01ef5849d1300c115a2b26a38688c016e46955
MD5 9957d81861ac2b59cb938da11ada6fa9
SHA1 a976b0ae50e05a2804844d76a1c84b69e778bf44
SHA512 dc8c77de2c50f006667db96c4debd6919c0d52240cce13e783dec9979fe996eb9da1a2d0dcf73ee23d91d23a76b7d6962fe379f37f676f8b9adc393b24a3922d
SSDEEP 384:RJqZhGTf6vNX95ZgMacc5X9R/QPIBM7YV+++amtzU:R46f61X95+yc5X9R/QPI+0V+++amtw
TLSH
T16BB26E01BBE2E923D1466733CCE6C3E57236FD924F96179B70023B2E9D703D95A22685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 7ac128db5e0bef9c72131d1e85c7fb5a1e7887c315158ce69ee9a6435ab1069f
MD5 cd2f22b685a0b5fe0ae8920784eec59f
SHA1 0a9f703716a6ce07d53d04b9d52d8b4ddd803e2c
SHA512 0098a184971ef908d36a1d70bf2f2dd4dc959f11ef02397679acac14b1684bdcc8a355fccee1b07a3c794b034239bcfe78c9209461e0186c10931cfb0fefad4c
TLSH
T16761FC027244DA1FC96906339CD5EAEE37243DC3CF41E21B74C07B2F7A352B95691291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 1cfd8c5e8549a1a3e7cd0ba1fe7a8be2f0be1d769331e6b7fc2a1b124ff29a86
MD5 906841a5c8a204771d567aff74928cff
SHA1 669120ec4d64fcc7aad1dc22e3542d1555dbab6f
SHA512 c72c8c0d90e9a0b771abfe6ccaec9c9f130972f1c1b79bec6a6ac4ee00d91590a816af4bd9f5a975ae533474576bb451b5c52a8674e8f7209c0d1b9198391cd3
SSDEEP 96:pE4+RzgTheV+Ww7uk/WGgyHkPzSNp9QHAz2AZwnANb6F:ARzgiJgOMhvOA16AMF
TLSH
T122B1FD117304DA17D5B906339CA9C3FE2B287D92CE82461B30D4BF6F76326FA4721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 ad2804ab14c6a3b2d81724045be3004a55dbfa7f137b326f55adda533c6fa874
MD5 679a137bea5de3b913421995db9d8b0b
SHA1 6f113060c42d98da7e7365cff0e83db30e4989ae
SHA512 827d51c1202d3dc8963637b00593f436970d9c0d4cc8389a8884fce66995298f30758796c618104d5f656368f688fa8fdf45b35878d909a5aa9d5cd4bbddb548
SSDEEP 96:0mQPPypJEeV+Wwws8WONSyuI03nGLsz+Mdks6b/DrK:UPPaJoONSo0yxMqLzK
TLSH
T1C4D16612B244EE1FD1690633AC9ADADD26287EC6DF42472B70C4BB3F76317E61621095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 bb8ea874837307c1140c215bd724863458f9dfa1150371198b961eb8c2e73709
MD5 fce4199752d9a58a16c3111a7994d3d5
SHA1 5c0095dfbb9f14e337e559e35bf10f6bc841e815
SHA512 86fd9708b5ddf98408865419337611c57ef9e13c7d05f9c0828a8be8bbc5bc9ad879ed8b6a3aa8887614c7cd8b67ab4ab5469f21e31f158b98c99e622c92134a
TLSH
T1ED5178053688EA6BD66A0633ECD1D6DA32357E82DF474317B1D07B7F2A713E54A120A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 0af039eebbbee6ef64446a33c57cc1ffc47bb82a08e969df10b2933e8ff20bb9
MD5 3ffc006ddad70a1e0d1983aa9cfb5634
SHA1 c8a77ece201ae7f46a1a947e8eee761211002ced
SHA512 78b73ea105f70193d560d657711ae3917143ad4e0382906e4e434f209794cc2555f209a74ddcbcda2d31e417e75de1f3e8975bed1874578ecb12e53c411506d4
SSDEEP 192:QD9eJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOZ:QD9y9rw6t1X9chRRX9R/QPIBM7YjO
TLSH
T1D862E6803760D923C1169733DDE2C7E13679BE934ED2479F74067B1F6974B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 33e113cc8f9a93b0a089e7d026c8ccf819af36c72366dffdb668cea2971ecc20
MD5 bc9c656ef8085a47554dcc3236df7b6f
SHA1 9381e813481729d7ec930959a84e14e20ef99185
SHA512 8454ab8bd6fb5964a28b43557ceb0a5b301e32273d0353a1cbe7ba330a1322ebe3b2bf4b6329e2952df16fbaaba8877ad8ef1448f1edc5ec72349a30c48225f8
SSDEEP 48:y/CDvx+dg/e6S+9ow87gnW75uv5HOyghHPiz1yjTyA9UZCf:y/QeV+Ww8s45uJOHHPm4TyOZf
TLSH
T1D8919C017688F92BD6A40A72EC46D2EE26687D83DF420B07B1C07F3F76342D70B25196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13rcjmgr.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\13rcjmgr.newcfg
Size 566B
SHA256 a0b8082d2b6ae3992805f9d40e30ee898d6b8e100680473facf09ce676007b40
MD5 e6e6c21f06acdc5175762ac044a8adbd
SHA1 b352e70f2ff0570478f6e34078ead66fff8f6dd7
SHA512 f1ed8fab06f7831f91a627eeaf77c4085f7152389ecca4a80542d66b8d5ca8c3b1f7d566ee58f9406acd21d5e22773db396e90635fe5f7133f4b7cbc5a474dcc
TLSH
T192F024A53080AE5A07B36E23C5114741EE721B9B1425119874AF723AAF301DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

4yzv31wg.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\4yzv31wg.newcfg
Size 566B
SHA256 2eb405bcefce6740007a566b2642939c4fc34a000d01dacb6988890776d902fd
MD5 21cce3be2f3ab650e5ffd16fdee7aa92
SHA1 b58ec7ca299b46317d64a6286225622fb1b140ed
SHA512 62c0778daf5fd36fd4978e822e3025edc119f276cef0902df6086c42a57cf3d1b9d0fbd1816bdc8820adc8ed680aef65d01dca1e4a8f044d9090b219b3208b34
TLSH
T121F024A53080AE5A07B36E23C5124741EE725B9B0465119874AF3236AF311DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ag3zaobk.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\ag3zaobk.newcfg
Size 566B
SHA256 70b283a972087d494aee240ee3fff09f0abc95074e8774eb6b285b270489379d
MD5 ccf39dbee84ba3ccc4a1c450586d345b
SHA1 ec18a3ba89d62b800e7ce6c5a053c5578883068d
SHA512 7f6da077861000136e1794126179cef7f137d8c77c28b4eca94b1370833a45e8a000b7208808e357cea5cf17b0549090330f567e63f67f4940c5a874cede96a2
TLSH
T191F024A53080AE5A07B36E23C5124741EE721B9B0425119874AF723AAF301DF17B33EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\app.config
Size 508B
SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
MD5 7b5bfce1109ea50893d85f908066f4eb
SHA1 49dee30e332dab3251af37a9c4b2cf99c1493f72
SHA512 c3fda557c4deba5d4be1e279e711fcd09d8eb15f445d8ebd733ced7d493a9a6cad74e56c2847489275a3d8dbdec8bfd21bc097600a1288adff9b7f6921c5e3ba
TLSH
T115F0E91432047E5B1A871F33C53346102DB16E722221242D64AB303BF67A6E513B23C7
MD5 SHA1 SHA512 TLSH

Submit Download

ezldtstf.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\ezldtstf.newcfg
Size 566B
SHA256 a2579394f0a1613a44dac3050133dbe6143851216397226fd9abcc97cd30ca73
MD5 1fcdf2b0893a8eed93d46a82e8c9e2c2
SHA1 c73f60229fe94ee1b51a93b0c690bcb9ff1edad3
SHA512 7ae979347d622755202be80120f0a4419aa9544ef29119ddf8ce3061d6b6201acadd34399ae31485ca265577fdcf2eb211c941e73bcad3aeec4c33c6fde94242
TLSH
T165F024A53080AE5A07B36E23C5114741EE721B9B1425219874AF7236AF301DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ihtr2nw4.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\ihtr2nw4.newcfg
Size 566B
SHA256 746cf5f75ea365b130871f445fdd908fd5d6e17cf619374fa4d2452290bd8458
MD5 0f905eb25902d94d3921f8209aa9c213
SHA1 f1fb5254aa803e95a3d1ef7f6f45a2427b45dc23
SHA512 0e25a2c91c43515e1d2f1eec79852d99ecd1b2f749f4427406ebf2cb4e0bd5c0f0c523d5998c0d357bd61f31d3d84a9dfd21dcae755e403ffeb75bc95f79efbe
TLSH
T16FF024A53080AE5A07B3AE23C5114741EE721B9B0465119874AF727AAF301DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

iltid152.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\iltid152.newcfg
Size 566B
SHA256 8b626a6753565ffe2fc71466a11f757ff890c5d1154bbe95fc094a0f6ee3de8b
MD5 e77032dc31427af34615971120463bfe
SHA1 df0ad22ba1a9cf0f8aeaef86205dd20928ea3e1a
SHA512 0027a66332e2e36ead50e475f987555662976a2e6ca35941720239d3951946ed4657c0711986aa5dd734825a84adc1bd28de6e3e14a2c08533f6d0f24ef0b61c
TLSH
T119F024A53080AE5A07B36E23C5124741EE726B9B1465119874AF3236AF311DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

rokq3jdl.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\rokq3jdl.newcfg
Size 566B
SHA256 0fe71ae678ce2c7f5985f3083a012570a26a087ca65d1c37cb1d95070dafcc41
MD5 d4de8620b71c0a09da8fdf710b6719fb
SHA1 dd8422a870883db3512d83a891d9ea1181287f18
SHA512 11144f4c6fdad6bba62d05d8628f976648ad8db1cb53dbd91a5efdee988e4bd9188000f9418e131b39aac239192cf60f95ab519c091d11c48cc9557f6f44eaf4
TLSH
T1F2F024A53080AE5A07B36E23C5114741EE722B9B0465119874AF723AAF301DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\user.config
Size 566B
SHA256 70a075d0f65d1f50ffc2ac30ec71a1ee97c76db46f9d42191b5f0410dd807aa6
MD5 d19d8b52a572680e5d3781c6e420ade1
SHA1 d8114fe7118b174f764c4950a2586bff76214493
SHA512 429441a66bd7f78214b2c49ca137ab74a5021c015b9d1a0352ce6403b8ca6f75cedf9c9081cf7eec353417929febf9cbf8cddaec6609a2982cd34064042b1d74
TLSH
T1D6F024A53080AE5A07B36E23C5124741EE721B9B0425119874AF3236AF311DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

yckdhkh2.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VXOXX59.K1C\W72H5O8O.9XG\scre..tion_25b0fbb6ef7eb094_0019.0002_cdae72a790d13a72\yckdhkh2.newcfg
Size 566B
SHA256 9e90aa4d9b78946a5889e09930a8217e798ebc63af90949ce5ed3fd9d6408c9e
MD5 5ff76619211830835fcb7b0677661b45
SHA1 9e971d33b3b88a844634635992819d1bf2aa44e9
SHA512 72998121b083ce2bbcd57f59bba3b57004d0503987fc074c087fca5bd708969cca64c57f4347875f733ab48889a4d10af9916a3277b3752a7df4496f5782ae49
TLSH
T1F0F024A53080AE5A07B36E23C5114741EE721B9B1425159874AF723AAF301DF17B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\0Y7X05HC.4PN\V7WMPMGB.JJB\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DGT8N2E5.CWM.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9ZBRCOQW.GER\DGT8N2E5.CWM.application
Size 116KB
SHA256 c5d2e8861aaeaa84d449717bd526a351a0eb38ffc4bb882b5e84b8b866cb5b66
MD5 1a5c2536a3e619e845469cacbc6100e8
SHA1 09466ed072e2fa316716fa2a8c46246bfc2adcfc
SHA512 b13707a89884add19ae66558aecba2a6d08f1e75f5a0ddc02b3b4f618d91be927b2d5fa391af53dee5d5fb6602dc51d45979488490f8b7e13751a2132a0e501c
SSDEEP 3072:84uqSXNOs7Jnv56IRTL98m2o9HuzhJOvP:0TXTVRV8mt8vOvP
TLSH
T146C3F82A8F30F4C0477DB021D1A52D6735811B97DBB30FECDA0A186B0E69792EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4508-299-0x0000000002FF0000-0x0000000003008000-memory.dmp

Download

memory/4508-292-0x0000000000D00000-0x0000000000D98000-memory.dmp

Download

memory/5524-15-0x00000250C7880000-0x00000250C78D0000-memory.dmp

Download

memory/5524-62-0x00000250C37C0000-0x00000250C37D8000-memory.dmp

Download

memory/5524-36-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-32-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-22-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-282-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-44-0x00000250C7EB0000-0x00000250C7F48000-memory.dmp

Download

memory/5524-68-0x00000250C8170000-0x00000250C831C000-memory.dmp

Download

memory/5524-12-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-11-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-0-0x00000250A8BB0000-0x00000250A8BB8000-memory.dmp

Download

memory/5524-50-0x00000250C7EA0000-0x00000250C7F2C000-memory.dmp

Download

memory/5524-56-0x00000250C7D10000-0x00000250C7D46000-memory.dmp

Download

memory/5524-40-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-10-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-306-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-307-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-8-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-9-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-7-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-6-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-5-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-4-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-3-0x00007FFA884A0000-0x00007FFA88E44000-memory.dmp

Download

memory/5524-2-0x00000250C32F0000-0x00000250C3478000-memory.dmp

Download

memory/5524-1-0x00007FFA8862F000-0x00007FFA88630000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads