Overview

overview

8

Static

static

1

install/Sc...up.exe

windows10-2004-x64

8

install/Sc...up.exe

windows11-ltsc_2024-x64

8

install/index.html

windows10-2004-x64

3

install/index.html

windows11-ltsc_2024-x64

3

install/te...fig.js

windows10-2004-x64

3

install/te...fig.js

windows11-ltsc_2024-x64

3

install/te...ify.js

windows10-2004-x64

3

install/te...ify.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/07/2026, 23:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install/ScreenConnect.ClientSetup.exe
  • Size 12.2MB
  • Sample260726-24lc7asenh
  • SHA256 4851a6b3aaef9416dca65e7ee6705fb0cb661b28498c4fbbb48e91fa8f23b02a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwarerat

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 17 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\install\ScreenConnect.ClientSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\install\ScreenConnect.ClientSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\76cfcb5ff4f13592\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\install\ScreenConnect.ClientSetup.exe"
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:260
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C9B8C8EFADA767D9001CA935492A7A98 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4900
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI815C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746859 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
        3⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2012
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI86FB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748312 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3724
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5252
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding CE1AA8CE608CF8F74E92627094B4BBE4
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2972
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FC68CA434D1F0431E0F20C1FF240E0B1 E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2112
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2160
    • C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-owlqzg-relay.screenconnect.com&p=443&s=36993f61-6d5f-4c18-8d68-8a50ca0f285f&k=BgIAAACkAABSU0ExAAgAAAEAAQD5jydgDaUQLMZ2SSQJi0IdfZD8l1tLQwjs%2fw9C1QaaDwikNGsUvDk594qOPGgH89luKL06RVl0DaXQxdvojF86Q30QAxHqioxNTdHmijXfVnwCW6mdrvqH0px37n2irN7Rri9vaTJQJDm0MsGMOEQAsGFhByZJHu8G2bUYF08vTQebjnoabo2EUIkZ9naj7TTw30zPnAV8u3aGNqSAgNxhtECdP%2fdzD1A0bu93wDpIb83EwCI5iN4VT22rPdHkgHlHWFsD1xfYQeP0%2bfMtDqjiogutRFh7hDn0f08hoP7iE8Wgd0VMxstdizGfryM0JtYHILQxA3V%2bj3TUBB2qJza4&t=kimberly"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5376
      • C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsClient.exe" "RunRole" "22811d3b-38a4-491d-b10f-3046a6f2a4ff" "User"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5332

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59cfbb.rbs
          • Path C:\Config.Msi\e59cfbb.rbs
          • Size 214KB
          • SHA256 d69ae3ebb117eaf47e208d6c94cefb8e9188b18be7fe67985d575e0aa28cd878
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\Client.en-US.resources
          • Size 64KB
          • SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\Client.resources
          • Size 6KB
          • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.Client.dll
          • Size 411KB
          • SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.ClientService.dll
          • Size 90KB
          • SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.Core.dll
          • Size 572KB
          • SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsClient.exe
          • Size 665KB
          • SHA256 6e95d68102dc761942e67e2337ad8e49d32ee7c8943340489a01e2c56ea6e00b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 838KB
          • SHA256 3fa1fe4a588015cc94eceb06867f16a5e562293139fbf6b36bde21dba478968d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (76cfcb5ff4f13592)\system.config
          • Size 952B
          • SHA256 3984fea4c1156ea824392298d1668577bb190533a740124efbded4a3664e8426
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI7EAC.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp
          • Size 1.1MB
          • SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp-\ScreenConnect.Core.dll
          • Size 562KB
          • SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp-\ScreenConnect.InstallerActions.dll
          • Size 24KB
          • SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7EAC.tmp-\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Users\Admin\AppData\Local\Temp\MSI815C.tmp-\CustomAction.config
          • Size 234B
          • SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI815C.tmp-\ScreenConnect.WindowsInstaller.dll
          • Size 137KB
          • SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientSetup.msi
          • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\76cfcb5ff4f13592\ScreenConnect.ClientSetup.msi
          • Size 9.7MB
          • SHA256 82f62a5e7aaedcf6cd924653364b6df22bd72aa72f4b4fd6a1cec7a2ea5cc5e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSID604.tmp
          • Path C:\Windows\Installer\MSID604.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 6ee357dd5c27ea6c1e6aa9bc2dee9299aff34e37d2e980a84b371a057148843b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {d37b1c0d-9c1b-4c86-8c0f-7fe4f826331e}_OnDiskSnapshotProp
          • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d37b1c0d-9c1b-4c86-8c0f-7fe4f826331e}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 7527d985f0022a23c1982479963b7f5932b7a60cf9aecf14b6e3b8af0df5aa43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1836-2-0x0000000003280000-0x000000000328C000-memory.dmp
          Download

          memory/1836-0-0x00000000746B2000-0x00000000746B3000-memory.dmp
          Download

          memory/1836-5-0x0000000005920000-0x0000000005AD0000-memory.dmp
          Download

          memory/1836-13-0x00000000746A0000-0x0000000074E5C000-memory.dmp
          Download

          memory/1836-7-0x0000000006090000-0x000000000664A000-memory.dmp
          Download

          memory/1836-3-0x00000000057C0000-0x0000000005854000-memory.dmp
          Download

          memory/1836-6-0x00000000746A0000-0x0000000074E5C000-memory.dmp
          Download

          memory/1836-11-0x00000000746A0000-0x0000000074E5C000-memory.dmp
          Download

          memory/1836-4-0x00000000032D0000-0x00000000032F8000-memory.dmp
          Download

          memory/1836-10-0x00000000746A0000-0x0000000074E5C000-memory.dmp
          Download

          memory/1836-8-0x00000000746A0000-0x0000000074E5C000-memory.dmp
          Download

          memory/1836-1-0x0000000003250000-0x0000000003258000-memory.dmp
          Download

          memory/2012-77-0x0000000006120000-0x0000000006148000-memory.dmp
          Download

          memory/4900-43-0x0000000005870000-0x0000000005904000-memory.dmp
          Download

          memory/4900-47-0x0000000005AC0000-0x0000000005C70000-memory.dmp
          Download

          memory/4900-39-0x00000000057A0000-0x00000000057AC000-memory.dmp
          Download

          memory/4900-35-0x0000000005760000-0x000000000578E000-memory.dmp
          Download

          memory/5332-192-0x0000000000170000-0x000000000021A000-memory.dmp
          Download

          memory/5332-196-0x000000001C3C0000-0x000000001C548000-memory.dmp
          Download

          memory/5332-199-0x000000001B170000-0x000000001B1B1000-memory.dmp
          Download

          memory/5332-198-0x00000000025A0000-0x00000000025BA000-memory.dmp
          Download

          memory/5332-197-0x0000000002560000-0x000000000257A000-memory.dmp
          Download

          memory/5332-195-0x000000001B460000-0x000000001B610000-memory.dmp
          Download

          memory/5332-193-0x000000001ADC0000-0x000000001AE2A000-memory.dmp
          Download

          memory/5332-194-0x000000001B210000-0x000000001B2A4000-memory.dmp
          Download

          memory/5376-164-0x0000000004AC0000-0x0000000004C70000-memory.dmp
          Download

          memory/5376-177-0x0000000004A10000-0x0000000004A60000-memory.dmp
          Download

          memory/5376-186-0x0000000004FE0000-0x00000000050B5000-memory.dmp
          Download

          memory/5376-181-0x0000000004CE0000-0x0000000004D4A000-memory.dmp
          Download

          memory/5376-182-0x0000000004DF0000-0x0000000004E82000-memory.dmp
          Download

          memory/5376-184-0x00000000048C0000-0x0000000004901000-memory.dmp
          Download

          memory/5376-160-0x00000000047D0000-0x0000000004864000-memory.dmp
          Download

          memory/5376-154-0x0000000002180000-0x000000000219A000-memory.dmp
          Download