e5c08150c64960ea249bff20f5785e382cc22cacff002e71ad87ec8cbdd03ab1

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.Client.exe
Size 2.5MB
Sample260721-pkc69ahd64
SHA256 e5c08150c64960ea249bff20f5785e382cc22cacff002e71ad87ec8cbdd03ab1
MD5 250634bfb0b018ffa112913233f3c668
SHA1 b9585a9f470383b04c5cb3c9eec1d6afa8a68e16
SHA512 a64d525cd7c18e5358370ee0951667bbeacc6a3ab2c0bc4f72a8053138b2fd52298f42ee8a63f5ef673d5961408f3e5616d6fd8bdc45086dfdc9be9b2d89db72
SSDEEP 24576:9zqSd0YA6egadV0MKCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0y:1j/usgGJkGYYpT0+TFiH7efPH0E
TLSH
T123C5BE01F3D666B6C47F0578847A96166775BC0503A6DBFB93D0A9BA2C333C04E327A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3400	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.Client.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\implication!scre..tion_0000000000000000_001a.0002_3a5 = 68747470733a2f2f737570706f72742e746869732e6e68732e756b2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\DigestValue = fee5d18d5343bcb447e324abd994311045699543	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\DigestValue = 727e70038cec4d2ea2a2058266b727222d37c9d8	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\lock!11000000d677590ed4160000fc02000000000000000000002d012 = 30303030313664342c30316464313930626339623261656233	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\lock!0e000000ca79590e480d0000100600000000000000000000 = 30303030306434382c30316464313930626433346233366265	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e\LastRunVersion = 68747470733a2f2f737570706f72742e746869732e6e68732e756b2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\Files\ScreenConnect.ClientService.dll_e781b1c636 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files\ScreenConnect.WindowsFileManager.exe_0e21f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\SizeOfStronglyNamedComponent = 730e090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0\DigestValue = 31a315f72d5bf498841cecde4f820ff0c88f605f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre...exe_0000000000000000_001a.0002_none_5d280ddfba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\lock!1c000000d979590e480d0000100600000000000000000000 = 30303030306434382c30316464313930626433346233366265	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_00000000000000 = 680074007400700073003a002f002f0073007500700070006f00720074002e0074006800690073002e006e00680073002e0075006b002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_3a53c7438289cb47\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_0000000000000000_57051d5779c6eb7e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d343230443032443338343942373939322c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\SizeOfStronglyNamedComponent = fc5c040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\SizeOfStronglyNamedComponent = 7ce41a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\DigestValue = f4a88604467db313d975fa1430445e22dbb88ec0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\lock!12000000ca79590e480d0000100600000000000000000000 = 30303030306434382c30316464313930626433346233366265	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1\lock!010000005f76590ed4160000fc0200000000000000000000 = 30303030313664342c30316464313930626339623261656233	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe\implication!scre..tion_0000000000000000_001a.0002_3a5 = 68747470733a2f2f737570706f72742e746869732e6e68732e756b2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717\lock!06000000ca79590e480d0000100600000000000000000000 = 30303030306434382c30316464313930626433346233366265	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\SizeOfStronglyNamedComponent = 64960a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc\lock!0c000000c677590ed4160000fc0200000000000000000000 = 30303030313664342c30316464313930626339623261656233	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\implication!scre..tion_0000000000000000_001a.0002_3a5 = 68747470733a2f2f737570706f72742e746869732e6e68732e756b2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_34afebf70fefc703\LastRunVersion = 68747470733a2f2f737570706f72742e746869732e6e68732e756b2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32362e322e342e393632332c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d303030303030303030303030303030302c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_00000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_0000000000000000_001a.0002_3a53c7438289cb47\scre...exe_0000000000000000_001a.0002_none_5d280ddfba	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	ScreenConnect.Client.exe
Token: SeDebugPrivilege	5844	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 5844	3340	ScreenConnect.Client.exe	89
PID 5844 wrote to memory of 3400	5844	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\ScreenConnect.Client.exe
"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.Client.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\scre..tion_0000000000000000_001a.0002_9e9f10488c1c2fc2\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre...exe_0000000000000000_001a.0002_none_5d280ddfbae1dcc1.cdf-ms
Size 14KB
SHA256 d8f6a0b231261e28afd484de6bd8482f666b3aa6e44ae9e76915f6616b644a52
MD5 a78b1ced2240095b3ce2bf1f0e7c595f
SHA1 89de483b0a38f9b8178d5129a16abf4e24212800
SHA512 9c11df7dc6f04e3d2cf07b0d6333e279f9c31932ca6e187cfc87306b5e78896f7aafcab01deb0a4bb2355e041b2ea9fe33254186a04529ff90cfe691ef527d9c
SSDEEP 192:K3EwHH/q3uovVZlwYo8K1fV7yYGxngf55EPXOFxGNLLJ/bQH8ak99Wbdrb5c4:KjnS3uWVB/ypGy3FxGl1/QyWlC4
TLSH
T12562A411B754E033E2A51733ACBBE28477117EA65EA5118B3091373E9C7219ACF363DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..core_420d02d3849b7992_001a.0002_none_3794b6aaf462d3ac.cdf-ms
Size 3KB
SHA256 526e63d246bd16080c9310d9ab38925b559be383e9e2bd3aa9d4ff2045bf3fbb
MD5 3e8980879362893077213fab411dbc42
SHA1 bd91ddb306648565c48f2094e3b02e6e011da33d
SHA512 e3681d0aba74cb13227db4bd1cd75e0ccd251cf19af16343fcc964677b20c14ea915e4d0def3d593928d31a1eb586b6e2b06032097dd8a9c415db7101650ee1e
TLSH
T129611C027744DA13EAB90332ACF2D2DE6FA87D83CE81810FB4C43B5F79764A955112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..dows_420d02d3849b7992_001a.0002_none_3c0c8e8c30b0e6dc.cdf-ms
Size 5KB
SHA256 d91658860e4712f1c176b08e2f36dad3016420a359673272ec1940637b93cef8
MD5 7ee05ff956a48a5d39cd7c6f64e62a0c
SHA1 1fbee4ab941c8336cbba10c8c90fa32709476b7f
SHA512 88755a3905811dd571857aef340b1605185cc56aa72597ddd59a65482010b4243bbc905c2c392eb940611331d79126f01615ffb318e165110a604ef8bb98b67b
SSDEEP 48:o0cq7ejqORobZiLgmhe6S+9ow77gXU7IvILeqR42X9XxBZqJFxbOgcyyySySySyB:oFqSl4oheV+Ww7OqIoej2X9Xniownv+U
TLSH
T15AB17415B294EA17D87A0233AC9AC3EC6B217E82DF43030731D4BB6FBB326D65212095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..ient_420d02d3849b7992_001a.0002_none_98db8fcedd46b6b9.cdf-ms
Size 6KB
SHA256 8eff3e6d4582af0a4b0d92b73410597c0abab9dca011a2306810b974dac03616
MD5 a9aae25d15ae912a8047d154f40a9095
SHA1 29f8796c54cbdb348c1bafbefb11919a67a2b5d1
SHA512 be53a2b7d43400d5e06a124c03d8e7957a370dbd56303c92a59c4953b70b4e42afaad8b067ef91798a05ae40ed2932cfce81dc1c5bcdd4c7d2f431e57d901709
SSDEEP 96:Thrs4launpreV+WwwOQ864+Dlc5naY85pA+37Jt3BpqlTPz:V4qaunuJTLDlAntudli
TLSH
T175E19712B344DE53D4BD06339C9AC3ED2B287E86DE42570B70C4BF2F7A326E61622195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..ient_420d02d3849b7992_001a.0002_none_cdaa147d03b229b0.cdf-ms
Size 2KB
SHA256 8c72e6a1d27feb7e6328eb53c41e7e63bb8be33a28e7e25b730291fec9a9db05
MD5 6be1d0035d07f99f38005966ba901076
SHA1 91054b5e61f315d105ee532d3c6c018a8c813047
SHA512 bbc5917c85e81d99c9af6b9ff98f710d828f831453fb04e2f805dc362b60bc20e504135d779b2df61a702050e1ec1d053b992d1f335fb609716054093d1fec82
TLSH
T12F5178057684EA67DA7A0233EC92D2D937357E83EF470317B190BB7F7A716C15612092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..tion_0000000000000000_001a.0002_none_0aadbbe7ba9cffbe.cdf-ms
Size 4KB
SHA256 de8d5387d7d68e839fc1bd825cd965c9e1d6fc267e9081b958e332d9e71a3a0f
MD5 868ff42364ecf2c6660467ee265415dc
SHA1 2f93e4f2012a5a0b0300ad4c39d5fbdb88532a49
SHA512 46fd35a67f9189e4b91d6e593fe57c884611340fd81b24ed099861e365c55444b9853bf49bf80c9c32aac9c360cdec6ff5f9fc435ce44b186b3ce8e7b0450d32
SSDEEP 48:BP/mrIQAqzIvJtagtRu9o0m5RD7NU7gFUTUEekTf4sQgbmZFms4Ch+UQRc1:FOUeGfEW0m5R/NUm9kvQPfmvVUQR0
TLSH
T1B0913D80B740F823D61457329CE3D2D032367DA64FD7971730987B2FAD367C596222A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\BKM2DO20.T0C\H6GG4TMB.26O\manifests\scre..vice_420d02d3849b7992_001a.0002_none_e8e84ef38a223717.cdf-ms
Size 4KB
SHA256 b8ee887dacbb761d8bfe1af5312228d7aaba498fd0481e7a4c428bb5397df404
MD5 a8e580c5e30029d6c6ff3d2029afb9fa
SHA1 c43ce3cb1f1de88f0e77b4141c711d0c722e8722
SHA512 eb040288b089ba8b305e74083b03390011e118c6180793d33ae0759f07997fd1f67d94a115e35567e7b0b776fd1744a8e6c1bfb1f0b76c9fc3b9d0175ce26a06
SSDEEP 96:TxQEDBUQeV+Ww8OQ4wUOJ2qAvpTE0v+7ZE+:zBMJFUHrat
TLSH
T183A166017280ED67E6A90633EC92C3DD3A767D82DE43530B71C4BF2F7A726D65226096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Client.dll
Size 412KB
SHA256 9ca0dd6d983eaa03fd43befb83fc297fa6a0f5ae46e6acfad422fdf7784cf575
MD5 6b59d8931510ba312fa6262708121f88
SHA1 31a315f72d5bf498841cecde4f820ff0c88f605f
SHA512 7b269932ae6e717fd260c6fdfede247e19440cef9803c7b3d8c762c7f95902c76ca09bd3afa4ba2433df12ffe41f5b8c61446c662b8e82a32cd3230c978383f4
SSDEEP 6144:JVTLfK1H+Zfog91vHtFsRJD8ETEavHy+vd7JPYIYyqQni65/PTO:3jpZfog5F4DHTEavSW7OQniOO
TLSH
T1C794DF8163E8993EEAAF0A73F09161344E76BC05A543F7AE0D1435F41A7B7838764AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 7fdfc06a2b2bbd5964934b184da06c1af56dcf76940e97263e85e3917983fc24
MD5 432337a461a0bb59f749d44abd55b24f
SHA1 4520cddfe07e1da3d14243fcc3d2daf4599d29ba
SHA512 fba7641413b839cc0fe355e3039f05e38745e50f4d52771c909d4d11abf2bc69db7ffccdb66229433dceade79a11484dec1b3f2cedab442aa034bec6d47dc99a
TLSH
T11611590191C4FA361F3342D1BEE7E420A76D6B27158E194BB0696C9FCB29AD643471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.ClientService.dll
Size 89KB
SHA256 36e211d86dd6883bd49e5554ea47f0ff4e0422e64d50d9acfead2ef3ea43ef3f
MD5 b4aad345f4dc216bb22939ddabed4816
SHA1 727e70038cec4d2ea2a2058266b727222d37c9d8
SHA512 d457b5dbfb50706d68993fe5958c0e13bb527aaf1fd8c362150566b2e82c25f9dba95c37fac61972d37f6f93193e1498b4aa42cf0a805b5072f485484966a549
SSDEEP 1536:jLO2ARdYMOby1g8VAfSOGI9ATpQbV3lHv0l/yT7L:jLKYpbVfbna9QbVBv2qT/
TLSH
T17A935B4293AC9926C9DF1E34B461F1610AB1BA13D8E6EBD4AC8C60EA1F523C15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 8bd45c4e681529c90907b4bfeb76065ef8eb724efba4fe6ba8d2ee740861fd28
MD5 54fb4f849943e88fdc158a18e1d9e7e2
SHA1 3a5dfb30bc9d9cd90dc8f67c0e4b65bbddacad64
SHA512 b5859e9033eb3b9e5ebc77732352648417974fcabb36e516a44a77b32becd6b9a0d828af46f5f6473cc9a0fdb6959a31dcb968effcc2b22303c3eaf630669a32
TLSH
T18231F61191C4FA351F3302C1BEE7E4609BAD5723158E290BB059699FCF29A97434B073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16d5596c5d53497ea722ae9713984de93478b53fdc8b34587b12656414967849
MD5 e80520bb4a0447cf61dbfe9d21e342d9
SHA1 f47f6fc913c34f353e82d0d7eb9e7e34314421e9
SHA512 6189d9b47b0ff6f26dc763b5252ec7df9a6e43fe492b6be1ab2651ef7d6abad5866315866e516cf41f73928edda35df3457846022911b1138bd3057120598bb9
SSDEEP 1536:xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgMU0HMb7t:ChbNDxZGXfdHrX7rAc6myJkgMU0HqR
TLSH
T1B9935B13B5C28872D473093158E0DAB09A7FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Core.dll
Size 575KB
SHA256 4d16bdfd1b74808161f59a15f70746f8279208899644b0662bebe320dc8fbaaf
MD5 a2214d8d885dd1586f7d4ec634ad5e73
SHA1 f4a88604467db313d975fa1430445e22dbb88ec0
SHA512 f75c372a4b7ef282a6c10da5f9c4281073d571ba4c1e73ae62795c91a658f767830aa137b305e79735327863d5316827a7d94ad9572587f0527153e241e6da50
SSDEEP 6144:LqF259uAINF9SAV60SnNZp0ArA6BWiAetP5ggjq/bZTS/+hjTax4kxdhnSewrj0D:Y2nZIjSd0Qx04A6gKBggO/bZT50M+
TLSH
T1EDC47D117398B777C97E06B9E07099150379E82672BBF7C7A6A4E4FA2C833844D412B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 0f83bbabc956b819bc3aa4649f91f6d4f085fc5d1b4d89eb178c95428fea625f
MD5 5b8eafaf5759cdc49f3f04d23c54d4b3
SHA1 d0120dc8c30ba09c1883632eac36fed46e1690f1
SHA512 ab5d7529771f9f9985beefd5aeeabc39103fca29fd5a074b2695c2f34fb6684e459fc31855bb27d1acdf306366d40d4c55a636342131c0e8ab5c8d657190cc62
TLSH
T1C521790181C8FA261F3302D2BEE7E42197AE5B33188D194B70A96C9FCB2DAD24747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 a0702217c7542d53a938003b89ade00e324814104c1a8fdf4f09338c5b624505
MD5 d5c52d3473ee10ffa3b0ceab80d5b651
SHA1 be51ffd29ba6888edd0144aa85a4f7687b246441
SHA512 770bf19dc679dc84641abf563b2909a797b72fca38a2dfdbbd15cc561e6ea4a913c3229be34508312b42b4ff1d91d0ce57ceb3172482cb0a43c409c92ff45f4c
SSDEEP 24576:9CsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:gsgGJkGYYpT0+TFiH7efPh
TLSH
T1E485BE41E2C365F5D46B047888BF572AB6743C080365CAFB93D4AE366D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 f542400bf3815f405643e11131a9a9d04ccabc5cdd1a93b76aa6f2cbcdbfce43
MD5 2b32cec5d15501411c62d448637c8c95
SHA1 03e78c80e557d5dd4f3a93ec556d5017afee0d21
SHA512 a9eb8ebd805960ce515084a553d1224cc6d0707fd9e2962d9843696f10f8d5ba3125286b301c7887f8d3c0735e8bac14181c9883f4fc6d7a16f64c4c1392eafb
TLSH
T13341D11181C8FA250F3302C2BEEBE431979E5723158E194B7499AD9BCF29AD74747077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsBackstageShell.exe
Size 71KB
SHA256 4aea3c1985c64acd63203bbbcc82df991e87e2f3fd9bfb27d66a8e1b1f4bb103
MD5 c2569c8c736a8451942fbc89fa63f94b
SHA1 ad73e13e40f19289538702b551501edbfe6e0866
SHA512 c2b95489f436333c4debb3501bedfbc7de29eb02ec23f7d745b025b89dd2be599e539cad46ce1f520cf4af0f9c613a08d8e45b4163d9e2e9f6c2f4d777d93f37
SSDEEP 768:dzlYsf/wCdOBti13kDeuRsUQHjSz2dvmDSmBsuMQX5E+TCMXESslxq7wCYiDLk5J:dRYKtd739PD1dvmDqfQX5E+TC7buwC7a
TLSH
T17B637D5063ECD535E9FE2E34B0E1F6200AB3B963C8E1D7D52DA821DA2E127C15F64396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe
Size 668KB
SHA256 9d0c96d6a286c64a97c60e83a85f6140db26a995d8a2fcd81d56c030bcf855ba
MD5 6ef28260eda97de6c44463100cb728c1
SHA1 8fb193ce4601ba427731c3390e1a3bd650330b09
SHA512 fbb227085b1f6b7f5305cc5d38a0337bc75d19afec186cb50b36c16f4f959c3703b2d82ebd2fea6e82f9955adb7b02d529929937cc151da4ccdbf7dbe042fea4
SSDEEP 12288:dQGxjhXiSOV/HRD/fiIDXWTOtBM4HhPee1KXWz/HgGBZ0TgB:dqJbiIDSpaeiZT0TgB
TLSH
T10EE47D2177BC9A7BC9AF0B3A7073195417B8E5117185EB4FF650A6EA0EC27808E053DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 d41ecc668fe228c67a42cfdcbf336d6fdb53cd6a1f6103c56ed11cd1b263784a
MD5 28dee0039f7c1211bc2e8350daf014f5
SHA1 3b920a2e6c539dc0af27ffb1bf7c2f6fb17904ca
SHA512 61a2fef48a17f5ce6060b204b61a63fbfeb9677d57093077557bd9052d221e3bc00087cd1a6533c0c898927d4eb047f6366c63a90fc15f9b0d69f72f880f0a1b
TLSH
T16651C21181C4FA250F3302C2BEEBE4719B9E5B23158E194B7099A99FCF29A97474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsClient.exe.manifest
Size 7KB
SHA256 422e3eab7aeffb1ea3a5e6996df1d75d907100d128eb040b0c6b65b2d5d790f3
MD5 60f005d498bb56b914f3603c6e8012e1
SHA1 fee5d18d5343bcb447e324abd994311045699543
SHA512 bb6974890409a00b7faf2eb557c6161352d60cb60e09849e2402a2c3882d521450e4f443b1a00e0b0c5da3d1fe30a7ca38c483c27aba4458b4b5043d1266af2c
SSDEEP 96:xWLwOhoyTbHe2wvy2kLKkTkXMkJkGqkHMyk34kOpQkOphykbAkOpD:oRjeMv4XZiwHM739UFUh7bVUD
TLSH
T105F1AC9684C0BD21573281C0FEE3D914BD157F63026E148EBD8D19AF9FB25899B872B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\36X6YOLB.CEG\4ANK94YE.7TH\ScreenConnect.WindowsFileManager.exe
Size 91KB
SHA256 66617969158867a0c983e7573c943ea61d20387b79b81674202a6669a314995f
MD5 96e3ca0cfe5765555f909144f9c36060
SHA1 5b68f21953a49a01459ae935f9e881763a37dc5f
SHA512 8094836cc7bcf5914ba399be92f59a3d503869338436522aaa9f938a5cd9764bfc6915d3ed5e49251d1a1485d20932233798ad8f39ab6768a28c32a1f4d6d0cf
SSDEEP 1536:EUMOISlP4GyjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdiRA7bu:XIsaukLC2A/u
TLSH
T14993E552356A6235DEC5C133A492E9B19C337F6207FDC5BD28A1BA3639E03903E99D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ML2DGD7J.X2C.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\V5QW2VJ0.30H\ML2DGD7J.X2C.application
Size 98KB
SHA256 96e9e3c8ae7a2bab5e005c5e8116a0d82c12c8f0a9f1df49102ee034dbc9fc9d
MD5 eb7e53a5f1319adfb3014faee5ce4fc3
SHA1 7a86217b7876490d25b1ef31589a80e101fd36dc
SHA512 ddf7a5c8403a484a11bc3189992360d341cceafc82e516f6421319b49564322884082e854f6f70c268a41bd1fe1981e48b2283fa088888e6568cbccac3e8a279
SSDEEP 1536:5Ycj21eUZZJXvIMxVNrVh57J29ymVKQ/IuKE:5uVNX5M9ymVX1
TLSH
T152A3513A8F30F4C0477DB021D1652D6B3D811B93DB731FACDA0A186A0E69796EF1A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-5-0x00000000057C0000-0x00000000057E8000-memory.dmp

Download

memory/3340-2-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Download

memory/3340-1-0x0000000002FD0000-0x0000000002FD8000-memory.dmp

Download

memory/3340-3-0x0000000005730000-0x00000000057C4000-memory.dmp

Download

memory/3340-4-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/3340-6-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/3340-0-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/3340-8-0x0000000005830000-0x00000000059E0000-memory.dmp

Download

memory/3340-9-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/3340-7-0x0000000005DB0000-0x000000000636A000-memory.dmp

Download

memory/3340-10-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/3340-21-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/3400-287-0x0000000000340000-0x00000000003EA000-memory.dmp

Download

memory/3400-297-0x0000000002620000-0x000000000263A000-memory.dmp

Download

memory/5844-45-0x0000026023D90000-0x0000026023F40000-memory.dmp

Download

memory/5844-14-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-69-0x0000026023AA0000-0x0000026023B0C000-memory.dmp

Download

memory/5844-13-0x000002601F360000-0x000002601F4E8000-memory.dmp

Download

memory/5844-11-0x0000026004C90000-0x0000026004C98000-memory.dmp

Download

memory/5844-57-0x0000026023B90000-0x0000026023C3A000-memory.dmp

Download

memory/5844-19-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-35-0x00000260237A0000-0x00000260237F0000-memory.dmp

Download

memory/5844-15-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-51-0x0000026023770000-0x000002602378A000-memory.dmp

Download

memory/5844-12-0x00007FFCAADAF000-0x00007FFCAADB0000-memory.dmp

Download

memory/5844-63-0x0000026023AD0000-0x0000026023B64000-memory.dmp

Download

memory/5844-23-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-31-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-24-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-18-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-17-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-27-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-16-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-20-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-22-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-298-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

memory/5844-299-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads