afc81242f78b72681897c590da4c4ccea2c714a9d132e867b2a40c479562bb77

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 305KB
Sample260623-v99veaew8k
SHA256 afc81242f78b72681897c590da4c4ccea2c714a9d132e867b2a40c479562bb77
MD5 5e457f44b85ded5049f10308db21225c
SHA1 07d8ce45ea8cc2ae15686340a442251b1dd53859
SHA512 f6b8cdb5d5cd46e1283284891b8db1b284776ad6b3d0484547db2f9ead989c520158f016d9cc7cc742bb84d2f074b2b7f61403bb2df84502223ca4c30076d703
SSDEEP 6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9
TLSH
T141646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
1	5964	dfsvc.exe
1	5964	dfsvc.exe
1	5964	dfsvc.exe
1	5964	dfsvc.exe
1	5964	dfsvc.exe
1	5964	dfsvc.exe
1	5964	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000b00000001c781-40.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c77b-194.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c77c-193.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c780-189.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
2768	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 32003000320036002f00300036002f00320033002000310037003a00340032003a00340038000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestValue = 7aca9192a475179f4df8752ecd7eda05948dc6f4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\lock!08000000101b590ed00a000018080000000000000000000 = 30303030306164302c30316464303333376235366331353238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_60db2f3f3cba3b49	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!060000000318590e4c17000028180000000000000000000 = 30303030313734632c30316464303333376164653066313966	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!10000000101b590ed00a000018080000000000000000000 = 30303030306164302c30316464303333376235366331353238	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_a8b5f220c84579a8	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_79 = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_79 = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!1c000000101b590ed00a000018080000000000000000000 = 30303030306164302c30316464303333376235366331353238	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!1a000000101b590ed00a000018080000000000000000000 = 30303030306164302c30316464303333376235366331353238	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "V746CYED4KQVW5VT4WNW87YM"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3601528"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\appid = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_79faf0e = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_79 = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_79faf0e819f7c219\appid = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_79 = 687474703a2f2f34352e36312e3135372e3233372f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\DigestValue = 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\DigestValue = fde73710ce063bbf1e377c02a1a8615cf4da1c08	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\DigestMethod = 01	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5964	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5204 wrote to memory of 5964	5204	support.client.exe	89
PID 5964 wrote to memory of 2768	5964	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 92eab82cea6ac025f3a63e4f680a64051ff7e54ceb168531823cf6e5ca0ae675
MD5 e07181f0e657571bb632b3e3181b10e3
SHA1 8bf62aca8d51a96606f7b67d524aa084369b2cb9
SHA512 1165c3413cab88bfbbabd2f4f53d410cbfb3f291d0b8c6d528c89368718d2e7090b1c9cb472b9bd24b7ecfaa242119411da03c19d7a386000a09917995b6daa5
SSDEEP 384:0JqB9GTf6vNX95ZgMacc5X9R/QPIBM7YV+++amt6U:04Wf61X95+yc5X9R/QPI+0V+++amtX
TLSH
T139B26001BBE1E923D1466733CCE6C3E57236FD924F96139B70023B2EA9707D95A32685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 169496dc29a66f7d84bdbdaac569ecffa66416e7d43dd8fade77bcb38626c7f8
MD5 2566820b9a7cbd28c2b2cc45e9fa8f7f
SHA1 10cb5c974933699f89e8a9910cfbca1c29ca2a66
SHA512 6cd4879eda1615a2531ed4a8aeebe455aaef3008092d16479b9b8b62976de4a6c10268fc04b1e4c74d677347e83c1e5b9fe3e82f7cc0dd99dea5f2a617da776e
TLSH
T135611052B208D907D67A4B326CE2E6EE276C3E43DEC5810B78C43B6F35364B55A212A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 aafd3538abc4f2a2ae909e47f69d954aaa3b85f1ec14edb33c9eab5947ea0bdd
MD5 d51a47d71c46e98134913c821a35842b
SHA1 2b0885a47db798968be6b75d6bf1425c6aaba27f
SHA512 9dfa07e1fde4a81cd102dce3357735072dedc85aedc5c7b3084ef0f4d92bc0b3471b5a97d431fd92650d9a1826bcf50e0cd1c7bf690a19a6651429374af25478
SSDEEP 96:EE4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAz2vXcwnANb6F:1RzgiJgOMrvOAWXPAMF
TLSH
T1D6B11E117304D917D5B906339CAAC7EE2B287D53CE82460B70D8BF2F76322FA8721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 970496065a40018cb8a76882dbab8416aa853bf87e5831a1d5c9bdfc2991c44f
MD5 1e566e109e3f1a6f7edc28e1b8664a46
SHA1 88420d31f245b6e1f47f97f6ff7d4e0d3b901088
SHA512 123e371cbc7e630fe8e38fb05306f00b18c41fb7418483c965f8d4e3f943c2f2af0f0c8ce994d64519093b92f770237e350cd739350bcc242c16354836ec2d00
SSDEEP 96:5mQPPypJEeV+Wwws8WGFSQsH3kUnkWH+Xpks6b/DrK:fPPaJoGFSvvYXGLzK
TLSH
T1B4D17711B344EE07E169A6339C9ADADD72643E86CF43470B72C4BB2F7A317E61721086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 70b62341f7d069efd8251aa089d8df9306c5cefb659c2a5e18d7b0d33ade8a97
MD5 165c7fd2d1bf1b0e66a146b34d1582fa
SHA1 f7089d5733d7f1dfdf4f5004513ab97629b26601
SHA512 d36a5302aa9aac6bfc32f4b2ef80154dc047f427f27291b32d6fa9bd17c2a4a493975796d5f89edd99ce71018f054666b7eed25bc20b45ce45d9f14953b67523
TLSH
T14051EE15364CEA6BD52A0633AC91C2DA72353DC2EF860307B0C07B7F2A357D546220A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 44aadbd1250cbb56bae0d261fc190cf507840053d4bc640684411f8c3567c8db
MD5 adc375364104f2fbab80ed4f7730c7e6
SHA1 388bfbd656029b472657b09e7e4492e57fba209d
SHA512 9bc7afefcc2691f5920c254039e390c443fd97d294dea4f73b60cbccb76552bbdf6129b1b486678e31181523505fa3a86e448e4e2795b3d318dc7d886a3726cd
SSDEEP 192:X90J9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:X9k9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T15D62E6803760D923C1169B33DDE2C7E13679FE934ED2479F74067B1F6934B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 a0b93a1dc767b704d79d1f1c3fcd28539788b8daedc13ca017e6a83ff3ea6bd7
MD5 9db1af612e68d98465c00ceb0044daee
SHA1 67dde415a284a9f02ee6808b08a0c74c6d859af0
SHA512 fa37d4fcae55bfc46961eeb8cb3e980d0914afc7edb91c1e949338a6203e2019f3b9a95f7f1b1f6b9290b314bbffd6de0956bee5d4d4af6ce252ed28186079e2
SSDEEP 48://CDvx+dgJe6S+9ow87gnW75uvsbO2KJyLQHYBcmc0ccTyA9UZCf://SeV+Ww8s45u6OJyuY8cTyOZf
TLSH
T19A919601B380E967E6A80633EC96C6DD2B65BC82DF430A0772C07B3F76312DA2721186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0mjwk14b.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\0mjwk14b.newcfg
Size 561B
SHA256 6df176e426daf2bf8c5d22132099d6022524a6be46ea95ded4b2443a270cbf95
MD5 afa01c114f527576cd640b0e957b7e78
SHA1 63d74a0b632c715ac36f4467f51a5f2d46352f4a
SHA512 065909938784d4e25a077f871002bc443bd6ee56f09bc0c3b71ba124d6063d2007d21429574b02e4bb040aaf930cb7c195ff7536d3890ebde1216e00b28cdab7
TLSH
T1E3F059B931806E5B07B32E23C5124784FE316BAB15151498B8AFA17B9F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

0wruht4m.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\0wruht4m.newcfg
Size 561B
SHA256 267ded6f4b0e9df936b1ea9f990601c5ae06f244b8681af2a5b829c3c9a0f4df
MD5 d40dd435256ff77af9fff088553d7e5c
SHA1 3c256a596c969523844daae1b1ab218e79efc664
SHA512 0648928ed8e75ae6811401ce134f5878e901d9bee3b9235a7389bfe167554130a42a1e453c9fa3f0f05b29b3d85d2e5798dce85dbc42e99367b6ea654b696253
TLSH
T1CCF059B631806E5B07B32E23C5124784FE316BAB01151098B8AF61779F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\app.config
Size 1KB
SHA256 3e75007d2d5e24d1154773d86d18f0bb2f43abbf7c0a032edde856865250c10f
MD5 9811bccc082b01b7a1f8db19f36bd0ef
SHA1 1a0992c48b190f4278e697d6190f196e4f1d34a1
SHA512 59b7837c7b90e23111513692ab0066a87a188a909e831ae772e4782a594846a12e811bf55912fec39d2a8eeffd5cae7286ec9d9382ff7dea1e4a5430cc2279fb
TLSH
T1ED21531DB5C0AE9912B25632EA3152C1FD70452312A6B0E078DE31779F70ADA0BF37E9
MD5 SHA1 SHA512 TLSH

Submit Download

um5hkx4n.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\um5hkx4n.newcfg
Size 561B
SHA256 62b438aee3c77dddb3c2d000916fe0781598e42a40106134bf0f91de2a887fe5
MD5 ca034577b1834ebf4467941db320f36f
SHA1 ce42d71172ea50ee985d43722bdc6e8133149761
SHA512 da3142e47f4b416f89a7d6978a26ff9d0757bacbeebd1a64d1ec4c83294312f54c9b816813ee485c76a96476e3d6a2f892cc45936ceded45d46ae9c4028f8ba0
TLSH
T176F024A53180AD5A07B32E23C5124784EE326BAB01151099B8AF61779F311DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\user.config
Size 561B
SHA256 3427eab4850f8f8b989d55b2814a0c90e7b849158d3c38351250b5e599515e83
MD5 23586c448c0c142236a6af6ee2d608e7
SHA1 aa6b03b97a5d10727a697716caf74070819f20d3
SHA512 c51ce65f6ebe2952499b6dfe73eb160965896b61702ad68d48556ead69b76ebb5fa486e576292eb99f84e79b1a66b0539b8c8a3d286a2753e8a55b2cf2efcc4d
TLSH
T1CCF059B631806E5B07B32E23C5124784FE316BAB01151098B8AF61779F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

v4oypjwi.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\v4oypjwi.newcfg
Size 561B
SHA256 5f1792023524c894a32148a059e5a3f2c888c4986fa33923ea2be8ec30ad4daf
MD5 ba9550c77963cd222fe3403b8aa64c4b
SHA1 46610949edbffa0fa6e5b5d56d6034c2a330b15e
SHA512 7c79957ec357a84b2591f915773876b915e7753818a66ce06b351800b4f8e3c815644ee80be311df31c4181bd575f2ea3e34bd0cd924cd1a50c2a1fbe9724883
TLSH
T12CF024A63180AD5A07A32E23C5134784EE316BAB01151098B8AF61779F311DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

vs4nfoew.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\vs4nfoew.newcfg
Size 561B
SHA256 babdce546cef45b1b020059bda48c90e363809d49a7d0ebf0384d3e4a950dacb
MD5 f9d6c8fd7b11578778a0bf7b60726c18
SHA1 6d6213dc5a3ae29b7e5e3be5a7af12aa32e2148e
SHA512 ad058e55b77dd6ff9a2b22ac19b43f94c425cb969f445d1fba9d1f2f7b63f3d5f29b306704aef2a2576ebbb27cb45c1d63c50aa0b8ac2391c2d5df99f7f8ef7d
TLSH
T1A3F050B531806D5717B32E23C5134744FE315BA71115105878AF517B5F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

vxa0l3qh.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\vxa0l3qh.newcfg
Size 561B
SHA256 2b0fdc669a3f761f2bfb3c998b4063e7d7fb50fbf9ff3033519f786ffb6134d1
MD5 4a37533bbc48da2fbce7ceba8be679a0
SHA1 846ed66773b1cf836dc56e59cc8e0b88083d8796
SHA512 9012b5bc1421e833124a8eeca675cff21750304baaa707ccdfa2acdbbb78360523a699ac5feefefd32e29e1072a995cfa062b651363c57ac2b4ff9d391036b1c
TLSH
T1E9F059B631806E5B17B32E23C5134784FE316BAB01151098B8AF61779F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

xqc4qeit.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\xqc4qeit.newcfg
Size 561B
SHA256 d884a03666e50582ec44d14ec0be15a776a4c07a1f92f23ae9c207a39cf4f305
MD5 8ab22089359a788f51ecf2f8200bdc7c
SHA1 f5455817e6dc1e6274d3daa7f52bbb991ca32c4a
SHA512 82b83a8f3b4101586ef2723723d394e2247d0e2b3fd25cf547d752509d6f560210dee1c5d4c61006b81997363020daa335282a4fc0967d59e8640f39f8043853
TLSH
T1A0F024A53180AD5A07A32E23C5124784EE316BAB01151098B8AF61779F315DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

zo1ox4yx.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\V746CYED.4KQ\VW5VT4WN.W87\scre..tion_25b0fbb6ef7eb094_0019.0002_1c5d967ff347346e\zo1ox4yx.newcfg
Size 561B
SHA256 2d9b4aa7fcac4d70b63d786fffc82269bf99773068c5c8f8bd59090709b6ca1c
MD5 feb84934018536a1fef3d6d091ba29dc
SHA1 9f35a83f2ef9caa670d533d3ec0e22b27039782d
SHA512 72940c0929c830e667128898b94e1963421d3568536a44bbbca6d34b13d733de11c5ed93d4a196bb8541843a1b122f0c4604cd9afd2d80a4d4c39f09e58a5fb5
TLSH
T195F024AA3180AD5A07A32E23C5124784EE316BAB01551098B8AF61779F311DE03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

DHT58KN0.503.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HHC7GWQ9.P70\DHT58KN0.503.application
Size 117KB
SHA256 6f532ff389cd9bf493190b47a5b565c6df5adcb2684786900dffaecb49cad022
MD5 c8baa867654ddfa81a2f62def3ebfbe1
SHA1 82a5bdc44f8423fc18f9e072ee69bfa517bce02a
SHA512 046d5ddad9da8e85cd213c621bad1bd3927041bf8e00fe28e58867f407029b66cb09533b6856282d541600d7c8fb975b6c396339b13a5f95a06a2c5d53b10f3f
SSDEEP 1536:gN0XwNFNzayZol5XAxBUO3qmnUuaFP7JnGZ4Q08UVh5arVIRTLvooBK/rm2oyEH5:8NSXNOs7Jnv56IRTL98m2o9HuzhJOvP
TLSH
T1CCC3F82A8F30F4C0477DB021D1A52D6735811B97DBB30FECDA0A186B0E69792EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\MOBZ3XAC.4WJ\ZWWLHHKC.5PT\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2768-288-0x00000000008D0000-0x0000000000968000-memory.dmp

Download

memory/2768-295-0x0000000002A60000-0x0000000002A78000-memory.dmp

Download

memory/5964-12-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-1-0x000002246F590000-0x000002246F598000-memory.dmp

Download

memory/5964-57-0x0000022476620000-0x0000022476638000-memory.dmp

Download

memory/5964-51-0x0000022476760000-0x0000022476796000-memory.dmp

Download

memory/5964-45-0x00000224767F0000-0x000002247687C000-memory.dmp

Download

memory/5964-257-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-38-0x0000022476800000-0x0000022476898000-memory.dmp

Download

memory/5964-28-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-15-0x00000224761D0000-0x0000022476220000-memory.dmp

Download

memory/5964-197-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-11-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-63-0x0000022476AC0000-0x0000022476C6C000-memory.dmp

Download

memory/5964-41-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-10-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-9-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-8-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-317-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-7-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-6-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-5-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-4-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-3-0x00007FFEA8080000-0x00007FFEA8A24000-memory.dmp

Download

memory/5964-2-0x0000022471CD0000-0x0000022471E58000-memory.dmp

Download

memory/5964-0-0x00007FFEA820F000-0x00007FFEA8210000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads