bffc8878a89748da3266dc28c4f4f9ca78345d505737a5dca0f46d0da5abe8bb | Triage™

Login
Reports

Overview

overview

8

Static

static

8

ScreenConn...up.zip

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
ScreenConnect-Setup.zip
Size 125.0MB
Sample260629-3trb5aa16k
SHA256 bffc8878a89748da3266dc28c4f4f9ca78345d505737a5dca0f46d0da5abe8bb
MD5 1893816f810c4327d34970a14e108e98
SHA1 f7a0b43b141eb820164dc1a4f3557b81238dcd58
SHA512 c8ca029edc66a0f91b3de2203196b0601c96ee0ed26d56d6f36724fb870325c6f6ded32b5c0a3f1818d8a03a0b7fab41aec55f7442efaa31e337052f9977c322
SSDEEP 3145728:SOPu3hHZRL8guQ2AwQUaQs7sX7kJkLPMKfduacw1v7tC1I:Sgu3h5RLQpAwy/YLkJkLPMKfDVjtt
TLSH
T16E5833DAAA69DED5C4A3F873AA36D703327500D43A63F879D21907787E626C3CC1582D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation revoked_codesign

Static task

static1

8 signatures

revoked_codesign

Behavioral task

behavioral1

Sample

ScreenConnect-Setup.zip

Resource

win10v2004-20260513-en

windows10-2004-x64

20 signatures

900 seconds

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Targets

- Target
  ScreenConnect-Setup.zip
- Size 125.0MB
- SHA256 bffc8878a89748da3266dc28c4f4f9ca78345d505737a5dca0f46d0da5abe8bb
- MD5 1893816f810c4327d34970a14e108e98
- SHA1 f7a0b43b141eb820164dc1a4f3557b81238dcd58
- SHA512 c8ca029edc66a0f91b3de2203196b0601c96ee0ed26d56d6f36724fb870325c6f6ded32b5c0a3f1818d8a03a0b7fab41aec55f7442efaa31e337052f9977c322
- SSDEEP 3145728:SOPu3hHZRL8guQ2AwQUaQs7sX7kJkLPMKfduacw1v7tC1I:Sgu3h5RLQpAwy/YLkJkLPMKfDVjtt
- TLSH
  T16E5833DAAA69DED5C4A3F873AA36D703327500D43A63F879D21907787E626C3CC1582D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

revoked_codesign

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

© 2018-2026

Terms | Privacy