Analysis
- max time kernel
121s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
29 signatures
150 seconds
General
- Target 2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 14.2MB
- Sample260708-wf7cvsdy9j
- SHA256 a72012d012a42d6e14c719e66cda5c66b602322a2632ff9c82324c33b3e8109a
- MD5 5c2896d6c6549243fe74a339236776ac
- SHA1 f5c2b6d9bfb29974fd25f023edb4ef13bf967e32
- SHA512 8bd674cae20186044bdfacd4c9c5efacea865ec1d82a65151c3ac24fe16e93a49a0ac3595dcb35f2678f1f7f8a99516fb87f3b5ebcc7db4af3196503eb600fd7
- SSDEEP 393216:KCXvI5MvHxmJwCXvI5MvHxgCXvI5MvHxaCXvI5MvHx2CXvI5MvHxe:KZ6HxvZ6HxgZ6HxaZ6Hx2Z6Hxe
- TLSH T161E62211B3E595B6D0BF1678E87D92658631FC144722C2AF53A4B96E2C32BC08E32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2468 msiexec.exe 3 2840 rundll32.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ab665c2ff22356ce)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (ab665c2ff22356ce)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-h46v3n-relay.screenconnect.com&p=443&s=78e005eb-5417-4f1b-b425-5838153a0d29&k=BgIAAACkAABSU0ExAAgAAAEAAQBFJLainKep%2fhv3NrfStyf9B8dQXuecagu5VXlxomeIa%2fcrWlx0GLkMo4lthoBVCvCCh0UeBGdlccjJKt83XpUY4oeHc3uh3kuCFTvpr5rynn9SNbVluOWBwj3PyY3rM0TxFMpcqBDsici5eysZctOlwnAZ%2fOf1d2TapO0t7aUeLVFYRCe7ikWvfcv6wvR5hJo0BABEdkchYtA%2f%2bYiw6z8GO8%2fWOdEtf6eQyTTkYb6lcCBEqbXbU09UwFY%2f3W54eYQXOr0Qfu9%2bfFQ1sTqpegkbrvC4Lasr857Rackps2sqkxzxpTYTCHuhFUFNJ2SJaDIYHqbRjKAbWy91pjA6m%2ffL&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAH1PylSPM%2bEuqCFsFMODbuwAAAAACAAAAAAAQZgAAAAEAACAAAABfMxfCgooVox9t1gCkwNjexMScXBO5XO4ftHxXuHoC9gAAAAAOgAAAAAIAACAAAAC%2fyMQamkLiRzDY%2bSbbKGe3DKuxuBDs7DoTrAzdSsJQ4aAEAADRyGFfcJsK1OgdYoS%2fOuD8SxHugQhDkd2INae3JGpmmjmXrh8rb%2bWhWxlXb4yiCkz6Xyg96p9Var20UGEXTHxJL%2fbqt716zklG%2f38GwSapDARRVzRo8zailTtwAr7gksZBhuCfwXFPvkAynBQW%2bEWbCmqNaDPMsPlIeliTMGKVXmKIpBNhkcpMiDelYztmaxXlpmi9JelXMtkqqy7fzdQDmMw8RuzIuMcwKuhcvS9WPm3lfk8wPoQS0K%2bd9iNHu7T4%2fwVcfPOfKkp7BywWuZdJLg6qj6ajkFfbITjyeqF0kf%2bkNgOXOuBf5r9NDCnHI7fP%2bHlj2ZGmdzS9fUqfvqbc2VzRqLSFkw3BrYjTf%2bujQ%2fREObRv%2bBxdlUrFmeHMr0QqHVft0aPEPWFnJjESlVcXE83ySwHWoo0ZvNx6H4UoFKt2XJyFlmGZUO6drW1PBoMAXRIAfo7rss0zUPujcXVWKETN6iRWzeIrgJgpohwGsZqM9xdsTJ%2bDknNjZ%2fGulqR%2fsHcVQ3IDAX2kyX3qR%2bS6QilzNvmgFfRJU3FRPydHIVCJVAA90fKifMQhG3yFiDP07cTdZr%2bRc3LI%2b3hx5N11b1RJkhHxZXYuf%2fqWdRZs4tvqF1A%2fv0S6QL4kYrntVwUl%2fXLkCQtSRi%2brDHGtPQm78Eqq110WO5wTyN%2b%2fTb7ICVAbaVat5UBMnCBaLsYaGtAIYkAaxAgoxkpiNPQERkI%2fLfPl1YEZKOUsFUrbVGFovudChg8069DLJqbNkI%2f47KRF%2fNyEDGysyXoJPQ9A3C%2bT4PL1akfiJ4RD6P4SBUgt2BVESrgQ6UErujvUFcEPkEZc6D0tUFCQ99Zae3pAMJy0h9yykWm%2fUw%2b%2fJrcltgwYEdrSvTZWf6NnBGIXX7ZIexL2hKH8wdFHTzeamyz8MqZ0kLqZ2w6rKFWcllNc3UTgZSq%2b89FKgqLAHxMeVEjCGm%2fHiWSZ9VsvtreRj6ZNC%2fwwcqV3v42Jb4v9oaYPLj8S7feZpeErbzNjyNO%2bsq0VkF%2fToHm%2fFWtQJktg9ypkyHYiozlv0K3TwhCRlvFRyTFKhoLCsVruN%2fyGQ0u54%2bW4u3zon%2f0ocOYWn9UFZufi8ixAJ%2bNr1uprgRV2lKghq4%2b%2bfbBC7z2hI4XMBUxRoLtBnVt%2fA8684FItk2g%2bc31F4bmdotgvxx03H%2bqW8ceb3dcm%2fxp02OFxO7DSk77NER3gkpXibwoZWD3SnBm7Ok0PBKIJOohcjJIGHPYrj1Is5Z%2bPbM9Fg77n%2bZBKHpM95I1OA2Tca1U%2b2vOvczlMXUlcMGFquhkMrJEx7Bhr3pawj%2fS9St8q%2f2AORywRpknwxKgz4uxTUotLuEkVWqfQ%2bFSMvhQDZ3tyFCvBy5yoY5iD22%2foNZkDY%2bFam6juHSnG7pkCf9ByOzQBpSriBHeAoGHVo9Yais3XcxOmqwm2yU1rqpJ148B8wfMlykBMl7MH4sVQ9UgvDui7WEOaapyeXZNnbQUGwXfaav1h5SFz9CKRsgzYvwCe7wYRPgi3Yqq9UL181IzOXpTUQku2Otx4TPWK12Kta3bp4mI%2b3uLUJoJLLNQqukAAAAD4djnVzIkYylqWkVXd9iBSE3wqbl9FLoYUAcNqBkTqWmVw1tX90Sz4E5OAve8KMpoVjRMVkatFnsvG8F255ueo&c=Ringcentral&c=&c=&c=&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610062003600360035006300320066006600320032003300350036006300650029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ab665c2ff22356ce)\c5xim1km.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ab665c2ff22356ce)\c5xim1km.tmp ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{87E6D9C9-3B4F-0281-3D37-1B05969A48C5} msiexec.exe File opened for modification C:\Windows\Installer\MSI8620.tmp msiexec.exe File created C:\Windows\Installer\e597cf6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF8ECC8B96EB9A129D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI82E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8321.tmp msiexec.exe File opened for modification C:\Windows\Installer\{87E6D9C9-3B4F-0281-3D37-1B05969A48C5}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF03597EEC9E905A88.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB30F4833F844305C.TMP msiexec.exe File created C:\Windows\Installer\wix{87E6D9C9-3B4F-0281-3D37-1B05969A48C5}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e597cf8.msi msiexec.exe File opened for modification C:\Windows\Installer\e597cf6.msi msiexec.exe File created C:\Windows\Installer\{87E6D9C9-3B4F-0281-3D37-1B05969A48C5}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF5DEBA5CC1502776C.TMP msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 3808 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 5912 ScreenConnect.WindowsClient.exe 5588 ScreenConnect.WindowsClient.exe - Loads dropped DLL 50 IoCs
pid Process 3464 MsiExec.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 1300 rundll32.exe 3464 MsiExec.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 2840 rundll32.exe 3464 MsiExec.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 2464 MsiExec.exe 5440 MsiExec.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3808 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5724 3808 WerFault.exe 104 - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000217f18aa3bccc6510000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801217f18aa0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101217f18aa000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3217f18aa00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6217f18aa00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\PackageCode = "9C9D6E78F4B31820D373B15069A9845C" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{D7BAEE0E-8F0F-4DEA-A04D-82864528B4CF} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-ab665c2ff22356ce msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C9D6E78F4B31820D373B15069A9845C\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FAF0-2F7CDBFBDD14} msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-ab665c2ff22356ce\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C9D6E78F4B31820D373B15069A9845C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\ProductName = "ScreenConnect Client (ab665c2ff22356ce)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\ab665c2ff22356ce\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\ab665c2ff22356ce\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FAF0-2F7CDBFBDD14}\ = "ScreenConnect Client (ab665c2ff22356ce) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9AD19CB0D61D867BBA66C5F22F3265EC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\Version = "436273176" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9AD19CB0D61D867BBA66C5F22F3265EC\9C9D6E78F4B31820D373B15069A9845C msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{BF4C4EE0-D85D-4338-AD18-1C17062C9887} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FAF0-2F7CDBFBDD14}\InprocServer32 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FAF0-2F7CDBFBDD14}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C9D6E78F4B31820D373B15069A9845C\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ab665c2ff22356ce\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ab665c2ff22356ce)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FAF0-2F7CDBFBDD14}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (ab665c2ff22356ce)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5308 msiexec.exe 5308 msiexec.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 3248 ScreenConnect.ClientService.exe 1104 explorer.exe 1104 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4880 2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 2468 msiexec.exe Token: SeIncreaseQuotaPrivilege 2468 msiexec.exe Token: SeSecurityPrivilege 5308 msiexec.exe Token: SeCreateTokenPrivilege 2468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2468 msiexec.exe Token: SeLockMemoryPrivilege 2468 msiexec.exe Token: SeIncreaseQuotaPrivilege 2468 msiexec.exe Token: SeMachineAccountPrivilege 2468 msiexec.exe Token: SeTcbPrivilege 2468 msiexec.exe Token: SeSecurityPrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeLoadDriverPrivilege 2468 msiexec.exe Token: SeSystemProfilePrivilege 2468 msiexec.exe Token: SeSystemtimePrivilege 2468 msiexec.exe Token: SeProfSingleProcessPrivilege 2468 msiexec.exe Token: SeIncBasePriorityPrivilege 2468 msiexec.exe Token: SeCreatePagefilePrivilege 2468 msiexec.exe Token: SeCreatePermanentPrivilege 2468 msiexec.exe Token: SeBackupPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeShutdownPrivilege 2468 msiexec.exe Token: SeDebugPrivilege 2468 msiexec.exe Token: SeAuditPrivilege 2468 msiexec.exe Token: SeSystemEnvironmentPrivilege 2468 msiexec.exe Token: SeChangeNotifyPrivilege 2468 msiexec.exe Token: SeRemoteShutdownPrivilege 2468 msiexec.exe Token: SeUndockPrivilege 2468 msiexec.exe Token: SeSyncAgentPrivilege 2468 msiexec.exe Token: SeEnableDelegationPrivilege 2468 msiexec.exe Token: SeManageVolumePrivilege 2468 msiexec.exe Token: SeImpersonatePrivilege 2468 msiexec.exe Token: SeCreateGlobalPrivilege 2468 msiexec.exe Token: SeCreateTokenPrivilege 2468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2468 msiexec.exe Token: SeLockMemoryPrivilege 2468 msiexec.exe Token: SeIncreaseQuotaPrivilege 2468 msiexec.exe Token: SeMachineAccountPrivilege 2468 msiexec.exe Token: SeTcbPrivilege 2468 msiexec.exe Token: SeSecurityPrivilege 2468 msiexec.exe Token: SeTakeOwnershipPrivilege 2468 msiexec.exe Token: SeLoadDriverPrivilege 2468 msiexec.exe Token: SeSystemProfilePrivilege 2468 msiexec.exe Token: SeSystemtimePrivilege 2468 msiexec.exe Token: SeProfSingleProcessPrivilege 2468 msiexec.exe Token: SeIncBasePriorityPrivilege 2468 msiexec.exe Token: SeCreatePagefilePrivilege 2468 msiexec.exe Token: SeCreatePermanentPrivilege 2468 msiexec.exe Token: SeBackupPrivilege 2468 msiexec.exe Token: SeRestorePrivilege 2468 msiexec.exe Token: SeShutdownPrivilege 2468 msiexec.exe Token: SeDebugPrivilege 2468 msiexec.exe Token: SeAuditPrivilege 2468 msiexec.exe Token: SeSystemEnvironmentPrivilege 2468 msiexec.exe Token: SeChangeNotifyPrivilege 2468 msiexec.exe Token: SeRemoteShutdownPrivilege 2468 msiexec.exe Token: SeUndockPrivilege 2468 msiexec.exe Token: SeSyncAgentPrivilege 2468 msiexec.exe Token: SeEnableDelegationPrivilege 2468 msiexec.exe Token: SeManageVolumePrivilege 2468 msiexec.exe Token: SeImpersonatePrivilege 2468 msiexec.exe Token: SeCreateGlobalPrivilege 2468 msiexec.exe Token: SeCreateTokenPrivilege 2468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2468 msiexec.exe - Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 2468 msiexec.exe 2468 msiexec.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5288 sihost.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 5912 ScreenConnect.WindowsClient.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe - Suspicious use of SendNotifyMessage 45 IoCs
pid Process 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 5912 ScreenConnect.WindowsClient.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 5912 ScreenConnect.WindowsClient.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2468 msiexec.exe 5308 msiexec.exe 3464 MsiExec.exe 2464 MsiExec.exe 5440 MsiExec.exe 2924 SearchHost.exe 4672 StartMenuExperienceHost.exe 1104 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4880 wrote to memory of 2468 4880 2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 88 PID 5308 wrote to memory of 3464 5308 msiexec.exe 90 PID 3464 wrote to memory of 1300 3464 MsiExec.exe 91 PID 3464 wrote to memory of 2840 3464 MsiExec.exe 92 PID 3464 wrote to memory of 1156 3464 MsiExec.exe 93 PID 5308 wrote to memory of 1472 5308 msiexec.exe 99 PID 5308 wrote to memory of 2464 5308 msiexec.exe 101 PID 5308 wrote to memory of 5440 5308 msiexec.exe 102 PID 3248 wrote to memory of 5912 3248 ScreenConnect.ClientService.exe 109 PID 3248 wrote to memory of 5588 3248 ScreenConnect.ClientService.exe 110 PID 5288 wrote to memory of 1104 5288 sihost.exe 115 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\ab665c2ff22356ce\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c2896d6c6549243fe74a339236776ac_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 285DA9033F6EBCCC1F0F06021D0D1D04 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240723781 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2A05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240724515 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI309D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726203 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1156
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1472
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E87338D3FB46B113DCD53E103A80EB3D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EC2A80DDEC449D4FB345D76663A3CE91 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5440
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4112
-
C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-h46v3n-relay.screenconnect.com&p=443&s=78e005eb-5417-4f1b-b425-5838153a0d29&k=BgIAAACkAABSU0ExAAgAAAEAAQBFJLainKepfhv3NrfStyf9B8dQXuecagu5VXlxomeIafcrWlx0GLkMo4lthoBVCvCCh0UeBGdlccjJKt83XpUY4oeHc3uh3kuCFTvpr5rynn9SNbVluOWBwj3PyY3rM0TxFMpcqBDsici5eysZctOlwnAZfOf1d2TapO0t7aUeLVFYRCe7ikWvfcv6wvR5hJo0BABEdkchYtAfbYiw6z8GO8fWOdEtf6eQyTTkYb6lcCBEqbXbU09UwFYf3W54eYQXOr0Qfu9bfFQ1sTqpegkbrvC4Lasr857Rackps2sqkxzxpTYTCHuhFUFNJ2SJaDIYHqbRjKAbWy91pjA6mffL&c=Ringcentral&c=&c=&c=&c=&c=&c=&c="1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 13362⤵
- Program crash
PID:5724
-
-
C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-h46v3n-relay.screenconnect.com&p=443&s=78e005eb-5417-4f1b-b425-5838153a0d29&k=BgIAAACkAABSU0ExAAgAAAEAAQBFJLainKep%2fhv3NrfStyf9B8dQXuecagu5VXlxomeIa%2fcrWlx0GLkMo4lthoBVCvCCh0UeBGdlccjJKt83XpUY4oeHc3uh3kuCFTvpr5rynn9SNbVluOWBwj3PyY3rM0TxFMpcqBDsici5eysZctOlwnAZ%2fOf1d2TapO0t7aUeLVFYRCe7ikWvfcv6wvR5hJo0BABEdkchYtA%2f%2bYiw6z8GO8%2fWOdEtf6eQyTTkYb6lcCBEqbXbU09UwFY%2f3W54eYQXOr0Qfu9%2bfFQ1sTqpegkbrvC4Lasr857Rackps2sqkxzxpTYTCHuhFUFNJ2SJaDIYHqbRjKAbWy91pjA6m%2ffL&c=Ringcentral&c=&c=&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe" "RunRole" "8193ddc3-aa09-4fcb-bb3d-f902210e559d" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5912
-
-
C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.WindowsClient.exe" "RunRole" "268f3401-d73a-4678-b9a2-f1dc97be835a" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3808 -ip 38081⤵PID:2720
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4672
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597cf7.rbs
- Size 214KB
- SHA256 7a74d7f5bd7be00907289eec5ba1dc18283dd60e98d58e663e2c58d538892314
- MD5 b029a6f83aa71ca549b658eff7bb94bb
- SHA1 2fc91e6524de3a335035d3ade31f2cc18d303ea3
- SHA512 29fabd094f35727aff79b0a4fbe1973144c5fdd71a87eb03f9f3b504cdf59db1d7224ef839570fc4c5bfb114bcd2ccb986d610d92a23de27f89797ffc5c3242d
- SSDEEP 3072:ts9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGr:tsuH2aCGw1ST1wQLdqvr
- TLSH T1E7248D217480807EE7FA1A32D93F9A71BE7DF6640760C59E83888C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Client.dll
- Size 411KB
- SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
- MD5 62d114c95b604d7ca684759c22c4c688
- SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
- SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
- SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
- TLSH T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.dll
- Size 90KB
- SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
- MD5 cee388546abc6dfb7a766a33a8066ff5
- SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
- SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
- SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
- TLSH T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
- MD5 751e8bcc20a49aeab090d99a6417919f
- SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
- SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
- SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
- TLSH T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Core.dll
- Size 572KB
- SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
- MD5 f5be8d175195df18890643f146ec4383
- SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
- SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
- SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
- TLSH T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
- MD5 63d6f975924dee293c5346992cf1b10d
- SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
- SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
- SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
- TLSH T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\app.config
- Size 1KB
- SHA256 fbc361dbb881ad8c4749a454ef014aefd595088caecbb03fab2a1ca53f8ae74b
- MD5 8cf879441dc546c4f11d5becfa7e1d9c
- SHA1 7e11b175bf12a370e938e4dc9ad7d71e6f334af0
- SHA512 4efa254fd4159d22a9096c305371b1d6a8a8a006ad9719ae1807e43f2eef725092125cd677209f064b32aa7eea223803d0bf40b7d16979c8b92e7bed58dd7026
- TLSH T16D21961D74C0AE5916776635E67141C1DD7049231265A0E478DE31379F70ACA4BF33EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ab665c2ff22356ce)\system.config
- Size 962B
- SHA256 23b9a1b95b5638e6648d180fd3a870378df11e31a9fdca0961e671eaf119b735
- MD5 25f63a5a7bedd48808598857e8edb2b6
- SHA1 c220824f5405f6710ea55c0cff17b41eae6db178
- SHA512 8f284528e9bc7c8d7143be548aac5dc5d08ad34fc6a2ee510a77731bd1c978ea571a36c4c9c0289e18b6da5edb79751e449dba9e0112d46efc8f03d9f9b7c594
- TLSH T1BD11102035406E5646B32E26C105D748EEB25E6B160414887AFF233F9F769CE039325D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2560.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2A05.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2A05.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\ab665c2ff22356ce\ScreenConnect.ClientSetup.msi
- Size 11.8MB
- SHA256 31ce327f23de40f9273a3ff03a86e866ef49fe3d11b364a7137715f365ef007b
- MD5 ed2d67770b5b1189ef3ad5120adf1ab8
- SHA1 634a83d5a2865a7961a6b153e0fb6fa9f22546cb
- SHA512 86ec4acb351429ba7050a00d6df8c9d1315eee07aa84a16aa7989c10a0f25adb5ee835f79f279abc6aa8b512d71f4f1499c2c76f083c301f98122692833785fb
- SSDEEP 196608:rnCtVYqI5MvbWEpKkqqIJqKynCtVYqI5MvbWEpKkq7nCtVYqI5MvbWEpKkqxnCtq:zCXvI5MvHxmJwCXvI5MvHxgCXvI5MvHF
- TLSH T15FC623216BF48174F1BB6A78E9BC80B14A36BC658B26C04F0774395E28B0F64D5B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8321.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH