Analysis
- max time kernel
125s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.msi
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
29 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.msi
- Size 9.8MB
- Sample260708-pd4evsfs8v
- SHA256 631425d207e50b3cfc74d9ad0b0722493f6340a06c59f153f330b8d534b69fe8
- MD5 d8eaad22a016d8f8d99efd0eb4927de3
- SHA1 678f3eda7252773d09b1f4468ca4cf19511909a1
- SHA512 f35e14fc29d6d0f1cbc098d807475cc3864881736510b9657942906c490bc6479471c4f383d4d2f06b5a6a8fe416d5f0fdf193762f11c04e4efcf420aaf9a7e9
- SSDEEP 196608:WoHQjDSOgtPPXDoHQjDSOgtSDoHQjDSOgt0DoHQjDSOgt:WowXStTowXSUowXSmowXS
- TLSH T152A6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5912 msiexec.exe 3 3136 rundll32.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (edb47a9132b9e027)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (edb47a9132b9e027)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-accmjr-relay.screenconnect.com&p=443&s=4e34a56d-7cec-4d61-a962-675bdfc9bb89&k=BgIAAACkAABSU0ExAAgAAAEAAQAdTg6A%2fbNb0p%2fzH0oCf1%2brAmFZHGuhen%2flfEhoC9AbBPiCPRDbpvJg6Jo1Z80F9uhEffH59YnY%2frJNGMCSXeovHCWVra5fpZHBiPUEEYqjLJbUsOz9NU20lc3ZTK%2bSHGR%2bkjuN67amMBXBDnqa988IgvGntmfsQVqPYAY3Cx4%2bCdXDDTlXLoTag%2fF5uih3p8hrFflvg8fjXP60oYLKqb8jPJXM7GmEfnNKBeU2C7Cf8%2fzh6iP3AquvtMqOOTw6iHx38yai6kdogZOqhOIrIyNzKMCvpGmYmhQGDWXtq%2fJjGZBG%2bCQTkBUJQEaVrFX6xD4Yp9XDTMP02tL5BNMN9VXL&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAiLeKy8zQi0GXqiYinOKl5QAAAAACAAAAAAAQZgAAAAEAACAAAAC2NwaevLhIulQMbO4g5twfe67PkIk3lmQ2S4%2f7Oss4FgAAAAAOgAAAAAIAACAAAAAXLv3wptP52uLJeB1VpbbSll2ZPadNfGB%2fdnXP6XzmD6AEAAAqnAXA4VqiQ%2fS%2bG66lOJBeZKH7mWII0Ckq24RM2lMPdfM5amWCALbK3J%2bbo%2fUV%2fR9BY933KQVu75CwGSKsQXs77v1iS%2bQ7GxkpL4r8Jo8dZFCR17vgT295NzeF0JY72zQOfRcKYL0OoLogdcYrQqvyb2IlZSiL8d9gsmaMUZiibH2uEwGnFan67rfA08QDkKD7Ptwf3ia4HEF86izfOn24cqYtv4tq7Smf1am4BwJoLaUukXdaoNv%2fNYoz22U3X4KeuGLRKh6l6DgCJ3ITlXjxaSVD463NTSRswDhqGnYHjdX0Iu60MAgUKYzFRCpZrao%2ffQ9PRy8PI6p6Pzp7B5L9hyxqIrx1vAMs%2fZdq7TS2wDsAN%2fOpY9%2fnhorng5JWbjeYD5QRko%2fVqvTPyxsk6I%2fGbu5%2bUEGrt6aJ%2bp7xkRmBlcPS6YFNO2%2fQ8WhEgJA6S%2fwerkuQ4BCMutAe3lQM%2fPRXaFHXCYL1sqtHXhuwbhuRv6eMoR4jZsHyqIUn2TMTK1VcHjyygxphcpj2Ie3hqPOr2RJw04walpXe6X1RgrHcxYOabTI%2fplIPiQWFephG1UwATgVcz0O5usxd2l2Fd%2bOoyI8P3SPY%2f7ofKZf%2fpVkGGmGG7LJyEH8ZVYzoJ%2bwpdaCKjeTe9tNP2BaL0o5Bt3kXhb2IoVyXaYDhr%2fB3Ny99fZ3NNkle97H95dd507E%2bA0KpoQ9JTef58Vh7Tg8%2bwZoEP71MOv5mISpD1GsjjDtiVroUjmwhX%2fdhbARyCmatcbwMX8Q2tDt23HEJH%2b3U%2fHksz2e%2b1%2foCdQibfonymGYKj3Ojchv6UH61Pqq717HzKEiX1S3aNPj%2bha7W2fCrf%2bS6sMfuBvWBLdKh0MXPKIH5h34AuJ%2bdCa%2bCBHhG3t3vc6Jhb8FX2T43cmjaREBjbR0wMhNn40mLUba7BQ%2fb7KJwZHLcfhC4qdRneeX4xDgCZw7H4ZzdtJdCjUGB8m3WzSnruJ%2bP3XVtf81cmRC%2bUC0kYKn5xNPtnzq5m%2fnR5HBT946fxqrhCJEn3NXgmt%2bcoYDGyMPLth6wAjyGXipISrfLN32YSuupwSxQM%2fFteZ1qYQJSWlTXm3StF67xjJ7djiy7ZJZiFV2Te9Q4o4YNzCpFXEfpisHC7Qaq8B1bhRwn0NFPcKuBWyz1NtAiOM1BE6ZIAtvehXC4Ewxg6cKKbdYSpVDFcKu8tk5AjHPcJxmKhJZoAYdk3A1Nw1dYjGzvqlSMtqt0ilNLfr6Hx%2fbyPgFBJHFe9chAGPgUFO2G3dHPzxlvE7pkKAUfEbPu1cJH8y7GHsaLxcL8s9Cz4ebE11gAGRjX%2bS6Cj5%2f%2fUmEfkoslDxoqZ5FTkWmcbRB4kGsdQJkI8laZ2qE1ymgxJLIV9EHT%2fEF3KHiahjNGrxDph3ogBZMN1GHPcIj%2bJqGIZYCADohE61r%2fN6Dsf40utMgCztc%2f6%2fhWTcIg%2bD2SWALVwC6LxygGNVTXzIMPux6%2bDg4%2fxCmjwEYsMZdg4QpijPbzfZck3UkhN7Y4JZtRJBeSkcxcgAHG1CxfwmBN3tYC6%2bklat%2fu0mTZ6vWOERm%2fuoRLrov6HEAAAABUBseW1qGV9Eu32NDSUmQUgr%2bKF3jmHoc4YCoacgFBjeVrUmZ%2fCBmmAlHqvGiXatuF6YhQVWJOrN5NWSHuTAVG\"" ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
pid Process 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 568 ScreenConnect.WindowsClient.exe 4148 ScreenConnect.WindowsClient.exe - Loads dropped DLL 50 IoCs
pid Process 4740 MsiExec.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4740 MsiExec.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 4740 MsiExec.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 4180 rundll32.exe 3092 MsiExec.exe 3252 MsiExec.exe 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 604 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650064006200340037006100390031003300320062003900650030003200370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\cji30pvg.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\cji30pvg.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\user.config ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\cji30pvg.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\b3c24yiv.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\b3c24yiv.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\b3c24yiv.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\4pvddyrh.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\4pvddyrh.newcfg ScreenConnect.ClientService.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\{BAE19A45-AD53-550E-E5BA-3145D7F178A9}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e59231e.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2A06.tmp msiexec.exe File created C:\Windows\Installer\e592320.msi msiexec.exe File created C:\Windows\SystemTemp\~DF3179CA470F532529.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFDE59455F459ED6A5.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI27F1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE015A1B65708CC21.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5E65DEAF88F81DC6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2830.tmp msiexec.exe File opened for modification C:\Windows\Installer\{BAE19A45-AD53-550E-E5BA-3145D7F178A9}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\e59231e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{BAE19A45-AD53-550E-E5BA-3145D7F178A9} msiexec.exe File created C:\Windows\Installer\wix{BAE19A45-AD53-550E-E5BA-3145D7F178A9}.SchedServiceConfig.rmi MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5912 msiexec.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1396 604 WerFault.exe 103 - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000305821452cf3bdb60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801305821450000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410130582145000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e33058214500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e63058214500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-edb47a9132b9e027 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (edb47a9132b9e027)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{2EB513E8-E860-4FEC-A2C9-5C7FB1E37975} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4F83-2D560D177433}\ = "ScreenConnect Client (edb47a9132b9e027) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{61A79DB0-0F1E-4830-8F0F-996EAEA28DE4} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54A91EAB35DAE0555EAB13547D1F879A msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList\Media msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54A91EAB35DAE0555EAB13547D1F879A\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EC13CF48ABCC5CBFDE4BA719239B0E72\54A91EAB35DAE0555EAB13547D1F879A msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\ProductName = "ScreenConnect Client (edb47a9132b9e027)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4F83-2D560D177433} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\Version = "436404235" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\PackageCode = "54A91EAB35DAE0555EAB13547D1F879A" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4F83-2D560D177433}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\ProductIcon = "C:\\Windows\\Installer\\{BAE19A45-AD53-550E-E5BA-3145D7F178A9}\\DefaultIcon" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-edb47a9132b9e027\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54A91EAB35DAE0555EAB13547D1F879A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-edb47a9132b9e027\shell\open\command msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 2728 ScreenConnect.ClientService.exe 4440 explorer.exe 4440 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5912 msiexec.exe Token: SeIncreaseQuotaPrivilege 5912 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeCreateTokenPrivilege 5912 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5912 msiexec.exe Token: SeLockMemoryPrivilege 5912 msiexec.exe Token: SeIncreaseQuotaPrivilege 5912 msiexec.exe Token: SeMachineAccountPrivilege 5912 msiexec.exe Token: SeTcbPrivilege 5912 msiexec.exe Token: SeSecurityPrivilege 5912 msiexec.exe Token: SeTakeOwnershipPrivilege 5912 msiexec.exe Token: SeLoadDriverPrivilege 5912 msiexec.exe Token: SeSystemProfilePrivilege 5912 msiexec.exe Token: SeSystemtimePrivilege 5912 msiexec.exe Token: SeProfSingleProcessPrivilege 5912 msiexec.exe Token: SeIncBasePriorityPrivilege 5912 msiexec.exe Token: SeCreatePagefilePrivilege 5912 msiexec.exe Token: SeCreatePermanentPrivilege 5912 msiexec.exe Token: SeBackupPrivilege 5912 msiexec.exe Token: SeRestorePrivilege 5912 msiexec.exe Token: SeShutdownPrivilege 5912 msiexec.exe Token: SeDebugPrivilege 5912 msiexec.exe Token: SeAuditPrivilege 5912 msiexec.exe Token: SeSystemEnvironmentPrivilege 5912 msiexec.exe Token: SeChangeNotifyPrivilege 5912 msiexec.exe Token: SeRemoteShutdownPrivilege 5912 msiexec.exe Token: SeUndockPrivilege 5912 msiexec.exe Token: SeSyncAgentPrivilege 5912 msiexec.exe Token: SeEnableDelegationPrivilege 5912 msiexec.exe Token: SeManageVolumePrivilege 5912 msiexec.exe Token: SeImpersonatePrivilege 5912 msiexec.exe Token: SeCreateGlobalPrivilege 5912 msiexec.exe Token: SeCreateTokenPrivilege 5912 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5912 msiexec.exe Token: SeLockMemoryPrivilege 5912 msiexec.exe Token: SeIncreaseQuotaPrivilege 5912 msiexec.exe Token: SeMachineAccountPrivilege 5912 msiexec.exe Token: SeTcbPrivilege 5912 msiexec.exe Token: SeSecurityPrivilege 5912 msiexec.exe Token: SeTakeOwnershipPrivilege 5912 msiexec.exe Token: SeLoadDriverPrivilege 5912 msiexec.exe Token: SeSystemProfilePrivilege 5912 msiexec.exe Token: SeSystemtimePrivilege 5912 msiexec.exe Token: SeProfSingleProcessPrivilege 5912 msiexec.exe Token: SeIncBasePriorityPrivilege 5912 msiexec.exe Token: SeCreatePagefilePrivilege 5912 msiexec.exe Token: SeCreatePermanentPrivilege 5912 msiexec.exe Token: SeBackupPrivilege 5912 msiexec.exe Token: SeRestorePrivilege 5912 msiexec.exe Token: SeShutdownPrivilege 5912 msiexec.exe Token: SeDebugPrivilege 5912 msiexec.exe Token: SeAuditPrivilege 5912 msiexec.exe Token: SeSystemEnvironmentPrivilege 5912 msiexec.exe Token: SeChangeNotifyPrivilege 5912 msiexec.exe Token: SeRemoteShutdownPrivilege 5912 msiexec.exe Token: SeUndockPrivilege 5912 msiexec.exe Token: SeSyncAgentPrivilege 5912 msiexec.exe Token: SeEnableDelegationPrivilege 5912 msiexec.exe Token: SeManageVolumePrivilege 5912 msiexec.exe Token: SeImpersonatePrivilege 5912 msiexec.exe Token: SeCreateGlobalPrivilege 5912 msiexec.exe Token: SeCreateTokenPrivilege 5912 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5912 msiexec.exe Token: SeLockMemoryPrivilege 5912 msiexec.exe - Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 5912 msiexec.exe 5912 msiexec.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 4548 sihost.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 568 ScreenConnect.WindowsClient.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 568 ScreenConnect.WindowsClient.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 568 ScreenConnect.WindowsClient.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe 4440 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5912 msiexec.exe 2872 msiexec.exe 4740 MsiExec.exe 3092 MsiExec.exe 3252 MsiExec.exe 2636 StartMenuExperienceHost.exe 2816 SearchHost.exe 4440 explorer.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4740 2872 msiexec.exe 89 PID 4740 wrote to memory of 4460 4740 MsiExec.exe 90 PID 4740 wrote to memory of 3136 4740 MsiExec.exe 91 PID 4740 wrote to memory of 4180 4740 MsiExec.exe 92 PID 2872 wrote to memory of 1236 2872 msiexec.exe 97 PID 2872 wrote to memory of 3092 2872 msiexec.exe 99 PID 2872 wrote to memory of 3252 2872 msiexec.exe 100 PID 2728 wrote to memory of 568 2728 ScreenConnect.ClientService.exe 107 PID 2728 wrote to memory of 4148 2728 ScreenConnect.ClientService.exe 108 PID 4548 wrote to memory of 4440 4548 sihost.exe 114 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5912
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ACB7D2945278E7C5257B55E8AD3E71EB C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID145.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4460
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID7BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240703453 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3136
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDE28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705218 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4180
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1236
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B0FC0ACBE890DB8EB4D48A4F2B4103A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3092
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8AFC4330C512C523DFFA813DB7846261 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3252
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5416
-
C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-accmjr-relay.screenconnect.com&p=443&s=4e34a56d-7cec-4d61-a962-675bdfc9bb89&k=BgIAAACkAABSU0ExAAgAAAEAAQAdTg6A%2fbNb0p%2fzH0oCf1%2brAmFZHGuhen%2flfEhoC9AbBPiCPRDbpvJg6Jo1Z80F9uhEffH59YnY%2frJNGMCSXeovHCWVra5fpZHBiPUEEYqjLJbUsOz9NU20lc3ZTK%2bSHGR%2bkjuN67amMBXBDnqa988IgvGntmfsQVqPYAY3Cx4%2bCdXDDTlXLoTag%2fF5uih3p8hrFflvg8fjXP60oYLKqb8jPJXM7GmEfnNKBeU2C7Cf8%2fzh6iP3AquvtMqOOTw6iHx38yai6kdogZOqhOIrIyNzKMCvpGmYmhQGDWXtq%2fJjGZBG%2bCQTkBUJQEaVrFX6xD4Yp9XDTMP02tL5BNMN9VXL"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe" "RunRole" "14832e61-19e5-40f2-98d7-e13cfc65640d" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:568
-
-
C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsClient.exe" "RunRole" "5ce729a9-8030-428c-879f-45a19538cba4" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4148
-
-
C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-accmjr-relay.screenconnect.com&p=443&s=4e34a56d-7cec-4d61-a962-675bdfc9bb89&k=BgIAAACkAABSU0ExAAgAAAEAAQAdTg6AfbNb0pfzH0oCf1brAmFZHGuhenflfEhoC9AbBPiCPRDbpvJg6Jo1Z80F9uhEffH59YnYfrJNGMCSXeovHCWVra5fpZHBiPUEEYqjLJbUsOz9NU20lc3ZTKbSHGRbkjuN67amMBXBDnqa988IgvGntmfsQVqPYAY3Cx4bCdXDDTlXLoTagfF5uih3p8hrFflvg8fjXP60oYLKqb8jPJXM7GmEfnNKBeU2C7Cf8fzh6iP3AquvtMqOOTw6iHx38yai6kdogZOqhOIrIyNzKMCvpGmYmhQGDWXtqfJjGZBGbCQTkBUJQEaVrFX6xD4Yp9XDTMP02tL5BNMN9VXL"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 13082⤵
- Program crash
PID:1396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 604 -ip 6041⤵PID:5408
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4440
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2636
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2816
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59231f.rbs
- Size 214KB
- SHA256 20b8db57e76b27cb5ce7315ff58db9b9bf116c9482b1083ffbcd2c956ba4e6d0
- MD5 65f5f47694faf01bf255872bf9eae9c0
- SHA1 58d48884fa98888db559c11caab196690ae9fac2
- SHA512 dfeb76e678cd9defc11836f1c09622ddbdc5309cfbf3ea156f16beb87012f3806dae5272f407d159d56260058d973d75b5a3382eb620287261e2143bd0615fab
- SSDEEP 3072:8h9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG/:8huH2aCGw1ST1wQLdqv/
- TLSH T1B6248C227090907EE7FA1A32D93F9A717E7DF6241760C59E83888C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Client.dll
- Size 412KB
- SHA256 44d7c87abe55a23318a1627a845a999acc268cc4ece97e2e80849ad869809ee1
- MD5 a514dcde8344967c14577f4f3ecc4006
- SHA1 db06ff5461e7018e34052d18f6eeb493b43a9a0c
- SHA512 836e32e3e1db4e52c67434696a3dffaa3f75aaab268c1199150aeea662ee530a8277ee292ca400b5a820a451cd78931e4fc20c172d8a89df80b0e4c3846d3ce1
- SSDEEP 6144:tS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PT/y:Mpc22xDHTEavSW7OQniOa
- TLSH T16C94CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EE0D0475F41A7B7828B546E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.dll
- Size 91KB
- SHA256 b607976c1aa7e804d8d53993ddf81ebf4b85117a12d7b4e9ee228e907e1f4025
- MD5 11765eb5a94f28f112d16b75735af5de
- SHA1 9636aad3ee5d6993b9d9aaaa6385ba1a28965e49
- SHA512 a71b38e65c0976d4722114363cfa56ffd11fd455554bd1aefe02afba8140e89cb5fce600c42c96d5c78c44d0f176d73537e34d0b993467b7feee68e2aabc1d03
- SSDEEP 1536:fz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7CO:fz2pz9Eyt0QOVFDtUazxDa91gyIb
- TLSH T1A7936E0293BCAD6ACDEF1A34B461F1A006B1B903D8E6E7D86D9820DA2E553D11F543DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 4cfe96e8e6d4cc96bc0f9c7935ab32531deeb0f52a8c39f739da928d6f5d344b
- MD5 73ab5c9e7f406d622a8d7be84ac9854e
- SHA1 d8be84d7b0223ff0a3f43f3a1e3978d5f7b36c58
- SHA512 2dc3497dbfdc1f496d74491359d0368d3bf159eb9a0711b0a8fc8516efa48a7db8fe943f670d41ec7cb538c665e4861b4e48d744db507f08bba10127d8937441
- SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM97jCi:YhbNDxZGXfdHrX7rAc6myJkgkT0HwfCi
- TLSH T1BE935B13B5C28872E473093158E1DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Core.dll
- Size 577KB
- SHA256 5c98fa479fd677e900bd53f15c3969deeb99c109e026f169862a6458a55bddcb
- MD5 b376a8512a02582d7d7d9c5b44170655
- SHA1 ff49d178fa25d55bedad54df39d0dc1a558904ec
- SHA512 442087c15522cc464fb6922137685e0080d791d30adbda3b446b2134b3aaa03e3d68608c4490392c1d04b293bc37ba90bb0b742cb50cfb08728d54d8ffe6f094
- SSDEEP 6144:KJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4W:O2Qq/G4PSzm++ymBbV50QlrFrb2iEM7
- TLSH T109C46C597394C677C9DF1779E03092560670E80464ABE3BB3AD4D9EA2C63F8C9E442A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 c1a6e533825b7adb9c2312c1674a5506fd3db460a15443d82c58b5037c68a9f0
- MD5 21fed1d120cab002d83b2c655de8ced5
- SHA1 615d427280a40e4c2a9a7da20cd11a53a6aa3ece
- SHA512 58d7c150e19efa1148f630f9f52de548317fe1c6e3fed00fd5194a7ae596261d211360e3e2b2d83193d4be81dba941542c6b991b2d1ff16bafafdcd8e3e955ab
- SSDEEP 24576:w9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPA:sUNXJkGYYpT0+TFiH7efPd
- TLSH T1C585BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (edb47a9132b9e027)\system.config
- Size 968B
- SHA256 e00a42502c48fb816fb73e7a646b39c21c243ded76cb28f67fc544341e0e198b
- MD5 26e47ea8a733208adfdf04b1ab12b972
- SHA1 c5dd6728f0dbf51f024205a1f997538b3391c60d
- SHA512 c1050c2412c759dfc57462db594187557e8cd52eb907ddd47c4f8c3bd6947214f5b710fff6a8204a8a01a68db6aee62cb544cf2e7abefc47985d51fe7878598d
- TLSH T1FC11546131C0AD8283A31E23C6164708ADB2235B256420CDB55F663B6B308CB03D339E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID145.tmp
- Size 1.1MB
- SHA256 71155d6834aa9d39bdbe3c1b1791f7e59c263b3be61ee4e4d645a29fdee7dd27
- MD5 162a1cc392e0e3a63739ca3c6b7ebfb1
- SHA1 4df91773076441a849d4e7de79e9176f7bf03997
- SHA512 c7d22d815d3327dbcf05355236e1f3bcf4916dc501468e4335d24c5d20404187a6848f5c585dbb46e509047bdcb36c32841a7f968f109959c56f89ac8d6e913f
- SSDEEP 24576:EUUGGGOARAKi9el/eIQiAGxXjLHaSaShOaUAg:/GGOQqsJeIzA6PFPOaUt
- TLSH T1B735233137D49236D2F76F70AD3026A559F876A5A478418A7B0F0B8D5FA2B92D360333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID145.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID145.tmp-\ScreenConnect.Core.dll
- Size 567KB
- SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
- MD5 d3ce85c584b1f07cec3f2be9485ac2ce
- SHA1 9a6dd68075cb0715f7715831624a221608201c40
- SHA512 45cdb16291324ae087b52f83aca9c3fb8ab1f026924f764db2179bb56f17a6229d5150c5118f5fd83c4ca72516416ead723878a9627944191eea4eb64b829ed2
- SSDEEP 6144:aJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4c:e2Qq/G4PSzm++ymBbV50QlrFrb2iEM
- TLSH T12FC46C597394C677C9DF177EE03092560670E80464ABE3BB3AD4E9E62C63F8C9D442A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID145.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
- MD5 963f2da3e852515517a99aab941820d7
- SHA1 4f329a46af0dad88d5d6c5c040849a7eaaa6c489
- SHA512 d4da3164358fc7b1ffedc337ff262e6f9130c5b26709640cb635d3839176a510d3bedf7d3d5568f08e4bb8907126202d5b6e7505c1dbe05c92adb4488d578aa2
- SSDEEP 384:9WazzV1VTsaS8hQlLkmoAsV7NaNeirM0dbMsFkjvZBS20QQ10:4azC9sVMcLva+
- TLSH T1BCB2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A410153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID145.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
- MD5 39b91039234cea490f620a45f1bd6b2c
- SHA1 996ced968075648d7d50d6e44c9516e72670351c
- SHA512 e89cb9e3cd8a61f329803cf122f84fdade1cedf7357a65527ffc25aba90e4992c712dd1e090b154ad8b70a5707242212c5e17e6a5e316f6030f806161398f316
- SSDEEP 24576:59jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:ZUNXJkGYYpT0+TFiH7efP
- TLSH T13285AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID7BE.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID7BE.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 8e0d135002984f0dbae6575086d9a72d51aa8dd58e53a9e0eba58c0d5bc7678e
- MD5 3ac838ef841dcc3b0e900598567a94ab
- SHA1 c727821891f44a110dfd8c5d0ad1b8ec720e2c04
- SHA512 6c9030cddc8802ffb4292c4a3b59aaca93bda1fa21c14dcbe9bdbc16bbd1df1859ffb03b9f7c7463d9357185eb647b715cfc5f0c2392ccbe557db6258a9e7f0c
- SSDEEP 1536:E6PudmhTuM6szFfJ49H/8P43rO6A16dTKOkvDutUVfh5U3KiQtlJ1Wq8qo0y/:pPudRM6oT4bXbk1Vfj1DnW
- TLSH T158D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2830.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59231e.msi
- Size 9.8MB
- SHA256 631425d207e50b3cfc74d9ad0b0722493f6340a06c59f153f330b8d534b69fe8
- MD5 d8eaad22a016d8f8d99efd0eb4927de3
- SHA1 678f3eda7252773d09b1f4468ca4cf19511909a1
- SHA512 f35e14fc29d6d0f1cbc098d807475cc3864881736510b9657942906c490bc6479471c4f383d4d2f06b5a6a8fe416d5f0fdf193762f11c04e4efcf420aaf9a7e9
- SSDEEP 196608:WoHQjDSOgtPPXDoHQjDSOgtSDoHQjDSOgt0DoHQjDSOgt:WowXStTowXSUowXSmowXS
- TLSH T152A6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\b3c24yiv.newcfg
- Size 883B
- SHA256 c3e7c596f7b0d11cdae816f34746c6de0f050650fa7876cc90d85fecc01c3e02
- MD5 608dfe4ffb9c508d8cbcdb7d9b97e1ab
- SHA1 767aa9cebdf6cd6de83ef5867cd1f2fa03fca73e
- SHA512 53d97602df91f0d24bc73831921c9e4ab583bad2e42fe00871ae61ed2f85e1e7d6ab3569f7e04dd9c07e6ac33734e6cbbad255ab3b945bcf1c9916b0e48e9dec
- TLSH T104118958B2C0AE5A02B72932D2314385FE321657117560D834EEA13B9F305CB07E36EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\cji30pvg.newcfg
- Size 683B
- SHA256 323f87abafcedb371b8ca34246e9084f8cef66e810dd12f049b685aaef38794d
- MD5 df55c178ecd8860aa75f9e58e6394684
- SHA1 c0246f4ad46f1d883d5c448518bfa780514e7734
- SHA512 d25e6daaadff2143cb7fb6c06a4078e6c18523050848441a749c98eabe6e6a0d47aa31df46af84990e3c330203bc4cef5cb458224cc9487f93e0ac779a6fa471
- TLSH T1D70178A572C0AE8B02B32E33C6214345FE31169B067520D834AE613B9F315CB03E32CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (edb47a9132b9e027)\user.config
- Size 520B
- SHA256 ed974f8d24e6aaa411a2b21f51ab21ea2a463e7533c4481896379e88ea2cbc28
- MD5 66226dadeaabeba57290a70a2b6c8752
- SHA1 b960fe88acedadb5897dbd05c526c8d0ab977e4e
- SHA512 d90322842c18f68b347cf87c6460efdfbff5bacb8cc665396bdadf3da816a0ce8e9c55e66df5b25a56ce6ca93aa363ee49f119abcd51b828e4471918c2021276
- TLSH T1D5F0E9A131846D4B07636E23C5114741FE72579B1565209874AF213B9F315CE03E31CE
- MD5 SHA1 SHA512 TLSH