2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Size 305KB
Sample260627-lrmsgshy61
SHA256 2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7
MD5 2695e24e6d062fe97e0e3ae4238ecc11
SHA1 4a22a0aeef82e9e9094f100e714ad71919ae8a84
SHA512 030536dcd18d327b38d3c39d35daddc09c0532f8fefa54676557f4cb7f2c31fceda8500904053d341a9cc3888b32da10bd06aa0b9aae5f3a9c6c81a0940ab91a
SSDEEP 6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9v:J1iw7gryNkSV1hy1Z1u2JLu9v
TLSH
T190646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware revoked_codesign spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c5f3-41.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c5ed-195.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c5ee-194.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c5f2-190.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
6092	ScreenConnect.WindowsClient.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\SizeOfStronglyNamedComponent = 3b7a080000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!1a0000006ca0590ecc170000ec160000000000000000000030 = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "0PCA6QZJ1GNK1XE899HN805T"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_3aaf2a01e1790b73	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!01000000949c590e44090000d80f000000000000000000000f = 30303030303934342c30316464303631396337626634656136	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\SizeOfStronglyNamedComponent = 447e1a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\lock!080000006ca0590ecc170000ec16000000000000000000007b = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!040000005f9d590e44090000d80f0000000000000000000039 = 30303030303934342c30316464303631396337626634656136	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!100000005f9d590e44090000d80f0000000000000000000039 = 30303030303934342c30316464303631396337626634656136	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!0a0000006ca0590ecc170000ec16000000000000000000007b = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 68747470733a2f2f647265616d637265616d2e6c6976652f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!040000006ca0590ecc170000ec16000000000000000000007b = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\appid = 68747470733a2f2f647265616d637265616d2e6c6976652f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!140000006ca0590ecc170000ec160000000000000000000030 = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb094	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!1c0000006ca0590ecc170000ec160000000000000000000030 = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_0bf428c9332b53e4\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files\ScreenConnect.WindowsClient.exe_6492277df2db = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_0bf428c9332b53e4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_f2d4672055edcd14	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!120000006ca0590ecc170000ec160000000000000000000030 = 30303030313763632c30316464303631396430633235653638	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_0bf42 = 68747470733a2f2f647265616d637265616d2e6c6976652f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 680074007400700073003a002f002f0064007200650061006d0063007200650061006d002e006c006900760065002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0068003d00720065006c00610079002e0064007200650061006d0063007200650061006d002e006c00690076006500260070003d00380030003400310026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004400350025003200620041006d0052004c0025003200660066006700580048006e0031005a0061004b007a00720059007000760030004100670039007a0031004a005a004a0061007100610053007200660066004c0043006900660065006c00770041005a0053005600440073006e004300610051004a0030007500570033005800790039004e00430056004c004e0052006e006900720057004a006900770025003200660074007600660068004f0030003500520061006f00610025003200660079005100580063006a006d004d005300560065004d0054007900710068004c00700069007a004c00450047006a00470066004d00250032006200360076006d0061004e0074006800510045004f007a00390039006600770077004d006c00620032004e004d007800510079005600480055004b005a0069006b0044006700570064004500740055006200760071006e0043007800540079005200710058007900480025003200620072006800690047004a0025003200660076006b0035006e00730069004900540039007500760076004400550043004f007800480032004c0036006c00620035006e0058007300690035007100670077003700690059004d006700450074006700780048004c00390031004c006f0041004900520031007000610076007a0069007500740030004a003200480064002500320066004700480036006b00460036004e0066004b004300430035006a00510044004400430064006100750069004f00640045004c00710068006a005000650039006b005a0050005500730072007300770071002500320062004a006f00350043007a00680079004a00440033003000790051004a006500740049004f00330078004900570064005700700064006800790045002500320062004a006f0055002500320062003900610061004a00790078007a00720045005500790070006b00610045004400570046005100720077003300620041006a004700360037000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.ClientService.exe_e781b1ee36f7 = 01	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6064	explorer.exe
6064	explorer.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	dfsvc.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe
Token: SeShutdownPrivilege	6064	explorer.exe
Token: SeCreatePagefilePrivilege	6064	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5140	sihost.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe
6064	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1840	StartMenuExperienceHost.exe
684	SearchHost.exe
6064	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2372	4480	_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe	89
PID 2372 wrote to memory of 6092	2372	dfsvc.exe	90
PID 5140 wrote to memory of 6064	5140	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe
"C:\Users\Admin\AppData\Local\Temp\_2f33698f3e24d9f7633782c67097b67973630bbf16b51dbb493d59acaf36f5b7.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:6092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6064

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:684

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 8101ceb0c66f16add4fee339c5179a91620df9de3f3d9e02858e8fac0485031c
MD5 072fb8c98285b9bd91cd9f065ae2d9fe
SHA1 6723a1ccc2ba94a77e81dc8b43cbf181e0951c79
SHA512 faa0dbebf92d8ee8710c1500c6bd652cdd4686d9fc7626342edf1f67ba768239c725b709e9417231ce1449a946995c9aee1b85a789f2ea979540897515140ff7
SSDEEP 768:54jXf6DX95+yc5X9R/QPI+0VIko/DLtEPb:dNkycNzR+ko/DLtQb
TLSH
T146B22945BB48E573D2939B328CBAD7D267287EA24DE2548BB046333D48305D5CF35399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 737edf301e74e2091296bff738db4ff95edbd9fdf836aa3914e00cde0f6589e7
MD5 8785242a23db80977ea5974a5cd7a58b
SHA1 7fa1bff2186cb28176b474a075118941e9ad4d48
SHA512 d6a5a9cf4c528712fbeb76f7e4af2d768fa0d4f77b22ecb9cd66ae5375479eac79d27c3fe83f0e96a5ea4416d46fe9fe2950b714e3e2fe86e3614a767fd83077
TLSH
T1956110027744DA13DA790732ACF2C2DE7FA87E43CE82810BB4C43B5F75364E556212A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 aec5ce240a11cafdb7a04c127eb894d54a8276f6d8fd0f2355393d74cf5e6cfa
MD5 637aae7f2794f68f4bade23420c2314d
SHA1 6e52f24e505a701d3e7593fd8a53b10e61bf829d
SHA512 b3caf2d7035f11e7636cf918c0fe6f7710474d81154168a4e6e4b90d0a0136d3a050a9b23119810a8518b02213bc3279400c3889b5bc18df900c290121f049ca
SSDEEP 96:qE4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAzkxewnANb6F:/RzgiJgOMrvOA2JAMF
TLSH
T169B1FF117304D917D5B946339CA9C3EE2B287D92CE420A0B30D8BF6F76326FA8721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 6f4b6969b364fe295012e840c5c879cf2e2f8511064804b46b236f7130963b54
MD5 edaefa34b70b40afda5db10d5a979d10
SHA1 657b6f10000d23e2d65b0ee16a08b9c1928c1650
SHA512 7878eb8bb78f1f49c545844b8e0ea7f38eff88fc2bd20cd81fccf3ab11525fa71bd5fd7c494466d1695036e3472ad6769a90ccbe441868c1220b5a6c686fb635
SSDEEP 96:KmQPPypJEeV+Wwws8W5Ww+2W3ABwWVo6v++a3srvMkks6b/DrK:2PPaJo5HJmYELzK
TLSH
T1ACD186127290EE57D1BD06339C9AD3DE32357E96DE43834B70C4BB6F7A322E61622185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 68592a931c1434669fcea16e51da0b272b5b6b380fbee093dbea759b5df1cf58
MD5 9df5c8b378a355cce797081a07bdd48a
SHA1 07a2bf2abf54293adc6cf56cbfb884585975d466
SHA512 7b864c4bcf9353852a676296f22889bfa54cc7568b8a19c517ee0d67823bb5b400672f543808064ac2178cc2cdeab0cbfdf7592b367dc8d714f09220d332e52f
TLSH
T11651DD053B48EA67DA6A0232AC96C2DA72757D82DF460307B1C07F7F2E726E54B16092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 92f91c7fe0111dc77581033a989ba6571b566389d4146ffb938da35180b5cff6
MD5 c861d9ca4b9bbe73c06b338019824e82
SHA1 9de3fb8ddee832a8d754644bd1e36c688307ef5b
SHA512 3939548902a3bd0cff7db79c85da9b660526498abaa1c62fba0c14dfb6508864fd32e6fc5c1cf182af3023499fd68f05981cfd5ff273a876281c3d6ef642a5f9
SSDEEP 192:v9fJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:v9h9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T16A62E6803760EA23C1169733DDE2C7E13679FE934ED2479F74067B1F6974B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 d069311afa710d873a1060a602b3a04b0003f4ef89a0ecd839eead10343bbf9b
MD5 8ede90f32237bdeb90c0d209221c314e
SHA1 b7a54600a2dcfd290d56d437b6d4545ab2230cf1
SHA512 8d088ad0f6e7cfd0adc3cdb8742c32607da60de9aa27f9a872c4986d93220bc15a896a6b80de8d52a06ef3a5034010159b9a80d874f8c8a4d03270bd3633ac60
SSDEEP 48:r/CDvx+dgJe6S+9ow87gnW75uvs8dVxVFgiFHS66fZuu5VjTyA9UZCf:r/SeV+Ww8s45uddjgMy66RuufjTyOZf
TLSH
T1729199017284ED66D6AA4633DC92C2DD3B76BDC2DF42070B72C47B2F76712DA0B12192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bcjayju.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\0bcjayju.newcfg
Size 565B
SHA256 acae182d390f05fbeff21f6319a2b2679ae09061c27dd4590ad8835955152696
MD5 7d4d282ef399c067b725580092921168
SHA1 020d56cbcbb0e0512f2f7b4247c5c48952081cad
SHA512 59498f025d62777c517194a20425015e13ad461daad0b8e0acd446f3509f9f75372e4f7ecddbdb82540b7848377783d9e3e378e33d58821a996c20fd3064a9f6
TLSH
T1DFF024AA30C06E5603B31E23C5518744EE312B9B0469249874AFA23BAF311DF03B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

3vpxr4c3.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\3vpxr4c3.newcfg
Size 565B
SHA256 12c0e88e0700578972abbf2db298430cad233d8fdb07a493a16310b30800524d
MD5 12a6a2314f83da160b5e0dfff2852ce8
SHA1 6033be4364e9c69c2af6ee6e27ac881eb0a5dbe0
SHA512 153e8b56b1f03ff7b5a94d4dadcc822637d34c24a5e24506f62f3e601c822e649f830c4ae065bc9c55b818dd42302744493fbc6647a0fe6beeb67af47b166dfc
TLSH
T1D7F02BA530C07D5603731D23C5514744ED312B9B04651498746FA1375F315DF03B31EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\app.config
Size 1KB
SHA256 a203fcde97bbea157f0620429cfc017aa501e86f8f5b7aa6080579fe313404d1
MD5 7ee345297fefa790460ebff3ea859b28
SHA1 a8d8241d09df4586eb5ee160cb6b9ae42007f471
SHA512 29996606e361717642c2d6616e9b41b565a820b69c14eb56cbf309847332af42849e83023bb91cd88b8a6f1792f96bfa4d97cf1c0c771efc9034d39604e79fac
TLSH
T15A315E1DB5C0AE9915B25631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

b0gjlnkm.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\b0gjlnkm.newcfg
Size 565B
SHA256 5826d63cda17ff44dab948f06dbea10f31deca93f33aae78ed0557bc3b5862d0
MD5 45aa4414d718023ecb8f59c458252ffd
SHA1 a393144b4f3159f940892ac203d91671b6c7d666
SHA512 cbfb9a757f689289183a4e666c81fe29d3800385e1591eea7d2aaa2876d9a79d4930a549c1a78e95244b0295f10e15c627421b77be67100ce9577345375d1e79
TLSH
T1AAF024AA30C06E5603B31E23C5518744EE312B9B0465249874AFA27BAF311DF03B31DA
MD5 SHA1 SHA512 TLSH

Submit Download

cjihie5o.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\cjihie5o.newcfg
Size 565B
SHA256 9659809c03f61de9e1fb6e5919886fb077c0cda58bbc4a3dc08dab9248c2b3b9
MD5 8f22bc146bd2397b71c1306a5862f2c7
SHA1 7014e459088f9411a6ef755ce9eb6badcbff4d9f
SHA512 8322f52e7d4ac71cfd374dd2ad3611694f7205b9418ae902e8ff7713ccd66677a6a736d0cce738e0c50a276ad3aecebc4060318fdf32d1231f58c6f0703f6f79
TLSH
T1D1F024AA30C16E5603B31E23C5518745EE312B9B0469249874AFA23BAF315DF03B31DE
MD5 SHA1 SHA512 TLSH

Submit Download

ck3cve0t.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\ck3cve0t.newcfg
Size 565B
SHA256 4695e26ba628600261bad25f49c333c9f7f9dbcea182681052a25194174861d6
MD5 dfd8102bd83fbd3f5f65ba5660643687
SHA1 c88e608128f04b3ef1e34ae38a14c47924361d58
SHA512 b88705c5c31bd23e64dc033a3dd12caf5f7d713a8437a6dc9a961b4b00c33d766e6bf2bc617f9ca495c3c6e5b80badddf198cdacc7cd875694c199e9d33b3a67
TLSH
T1A8F024AA30C07E5603B31E23C5518784EE312B9B0469249874AFA23BAF315DF03B31DE
MD5 SHA1 SHA512 TLSH

Submit Download

fb4ltifp.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\fb4ltifp.newcfg
Size 565B
SHA256 605b5a8c8f3498f6c84739daa30494a2f567f3873874c9420fa14ba48b5f55c9
MD5 bcd88999018b8d6a26be9b47e2039416
SHA1 8de53de9695942c5761ba938a8051e8ee689fe41
SHA512 069fb3b57df3d7dcf34df1cc8078d0dfbd2bddaec55799cc7cc9dcf361299d29ba2eb7ff57f65c19b3ef2609fc10ff3cefc8e665e3b1efbdbbc0511381de4709
TLSH
T187F024AA30C06E5603B31E23C5518785EE712B9B0465249874AFA27BAF311DF03B31DA
MD5 SHA1 SHA512 TLSH

Submit Download

owpoq33a.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\owpoq33a.newcfg
Size 565B
SHA256 de724820cb6f8ff1bc9673d25c3efe7b4f030f08510063a49910d9e050137e33
MD5 0976dcee393fd8bed7d2bc47d428dcd7
SHA1 dbca9107716b80cf0e6ccbdfc4d7ccfcabe2bd4a
SHA512 b58604c2a36e25eb81cd013a110b359dcb6aa2be89482abd424244eea9bc1ddb14f6ec7eada5764a4f3b111602dbcdf4ad38e7d2f54a13858961e6f9ec161292
TLSH
T117F024AA30C17E5A03B31E23C5518744EE312B9B0465249874AFA23BAF311DF03B31DE
MD5 SHA1 SHA512 TLSH

Submit Download

t05derss.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\t05derss.newcfg
Size 565B
SHA256 50d4d9f000a7c2d8ef468cd83e0e34ec69f91263fa3ded4fbca49dfc25908c50
MD5 23a3004dbde4b3671de72afaf1c504f9
SHA1 4eb0ff6a8fbdce7099fada6e77dd2c0891147e77
SHA512 d2f3af2c2c13db6b182c8fdcd6627877699923d51e5889dd71f2437cb236889b99881a80fc1227d614fd48eadc661f856c0d42f17942066c22e44df54ef1f0ad
TLSH
T1ABF02BA530C17D5603731D23C5554744ED312B9B0465149874AFA1376F311DF03B31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\JLTOLWLG.T71\PWAQXWPJ.PW6\scre..tion_25b0fbb6ef7eb094_0019.0002_ae56ce610c7ac639\user.config
Size 565B
SHA256 a49b214a64880bdec9e154b7bcfc58794f6fab0e74519eb7c98a0d763471cf5c
MD5 600a9d77dfa8de51917e582986288d61
SHA1 8bafc31f05d829a46a8ebe55aa0a2d320b91842f
SHA512 d57deffb39ad4630ab9e927f4b8ff7007f59a2ec0a0a034a05a111240f7388b1455e12c2ef791bfe5527b872d3e2c8f347f92f21fe13c2c254ff4d39a054c8e0
TLSH
T1D4F024AA30C06E5603B31E23C5518744EE712B9B0569249874AFA27BAF311DF03B35DA
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

YNPJ0Q12.TJR.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\5J60TBN3.MX6\YNPJ0Q12.TJR.application
Size 173KB
SHA256 195e1d389aad70c802556f346944e89dabf2e991ee49a26c79477f97194a3855
MD5 6bc68b97a6a48449fd889081c4278353
SHA1 f84cbd7453da37dc0440aa54a3b64861ab4bde32
SHA512 249c629d55f024456d936540006525528e75a9a01cca4afaf329e0c46864ffaf4f040395924d45c2467447a452d4ca61301932df7914fe5c10ef5522761865ce
SSDEEP 3072:8NOXNOs7Jnv56IRTL92CC2kkElT/9igZLm2o9HuzhJOvP:NXTVRVp1ILmt8vOvP
TLSH
T1FC044B3A8E34F8C04B7E7820E1652D573CC11A97DB734BECDE0918660E6A391EF5A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\XPHE12DX.EMO\PD198NGL.506\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-545-0x000001B4999C0000-0x000001B499BA3000-memory.dmp

Download

memory/684-379-0x000001B481A20000-0x000001B481A40000-memory.dmp

Download

memory/684-380-0x000001B481E40000-0x000001B481F40000-memory.dmp

Download

memory/684-405-0x000001B481C80000-0x000001B481CA0000-memory.dmp

Download

memory/684-420-0x000001B494200000-0x000001B494220000-memory.dmp

Download

memory/684-358-0x000001B4801E0000-0x000001B4802E0000-memory.dmp

Download

memory/2372-29-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-8-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-122-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-28-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-1-0x000001C060040000-0x000001C060048000-memory.dmp

Download

memory/2372-288-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-2-0x000001C07A6B0000-0x000001C07A838000-memory.dmp

Download

memory/2372-300-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-17-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-307-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-308-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-309-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-310-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-12-0x000001C07ECB0000-0x000001C07ED00000-memory.dmp

Download

memory/2372-9-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-21-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-7-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-39-0x000001C07F2E0000-0x000001C07F378000-memory.dmp

Download

memory/2372-6-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-0-0x00007FFD4C9DF000-0x00007FFD4C9E0000-memory.dmp

Download

memory/2372-45-0x000001C07F2D0000-0x000001C07F35C000-memory.dmp

Download

memory/2372-51-0x000001C07F140000-0x000001C07F176000-memory.dmp

Download

memory/2372-57-0x000001C07EB60000-0x000001C07EB78000-memory.dmp

Download

memory/2372-5-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-63-0x000001C07F5A0000-0x000001C07F74C000-memory.dmp

Download

memory/2372-4-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/2372-3-0x00007FFD4C850000-0x00007FFD4D1F4000-memory.dmp

Download

memory/6092-297-0x0000000000BA0000-0x0000000000BB8000-memory.dmp

Download

memory/6092-287-0x0000000000260000-0x00000000002F8000-memory.dmp

Download