Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 12.2MB
- Sample260729-k6ymvsfd74
- SHA256 a38fc446f2f5a1e4ed752a5ea6c96f44f784e6b797f7dff8332fc4600eb86da8
- MD5 d66a8ac982cf0e532a368d7fa5a8af9c
- SHA1 424c23b22580e66d1d49ec87f7c00a8c6ae9fe1a
- SHA512 f9dff8b9dc4b5bb2599242f27b7bb41402a0fbc38beb3739a0336d5d8ef25f528788a0cc63e353db22d07d3e6b262ebd1ca12ee73ce91ca43ad35aa4cea7031b
- SSDEEP 393216:tq5VDBCDxfQEOq5VDBCDxOq5VDBCDxZq5VDBCDxf:tp6EOp4pnpB
- TLSH T1B4D61211B3D594B5D0BF0638D83A92656B35BC008B66C6AF6394B96D2D33BC08E32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2492 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1a544d57af924836)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF76299EA43A7C994C.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBD4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBD7B.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{E8DFF494-DEB8-4CA2-35E7-8EB23CAF7123} msiexec.exe File created C:\Windows\SystemTemp\~DFADB812E09E0697EB.TMP msiexec.exe File created C:\Windows\Installer\e59b696.msi msiexec.exe File created C:\Windows\Installer\{E8DFF494-DEB8-4CA2-35E7-8EB23CAF7123}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF3368FEB41E3DB8A0.TMP msiexec.exe File created C:\Windows\Installer\e59b694.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFD1A1B4A7A9AC5991.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59b694.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{E8DFF494-DEB8-4CA2-35E7-8EB23CAF7123}\DefaultIcon msiexec.exe - Loads dropped DLL 31 IoCs
pid Process 8 MsiExec.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 4468 rundll32.exe 8 MsiExec.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 2492 rundll32.exe 8 MsiExec.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 3480 rundll32.exe 5408 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD8159961610365A145D475FA298463\494FFD8E8BED2AC4537EE82BC3FA1732 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\494FFD8E8BED2AC4537EE82BC3FA1732\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\Version = "436469763" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD8159961610365A145D475FA298463 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\494FFD8E8BED2AC4537EE82BC3FA1732 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\PackageCode = "494FFD8E8BED2AC4537EE82BC3FA1732" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1a544d57af924836 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\ProductName = "ScreenConnect Client (1a544d57af924836)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1a544d57af924836\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.4.3.9662\\1a544d57af924836\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\ProductIcon = "C:\\Windows\\Installer\\{E8DFF494-DEB8-4CA2-35E7-8EB23CAF7123}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.4.3.9662\\1a544d57af924836\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1a544d57af924836\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1a544d57af924836)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\494FFD8E8BED2AC4537EE82BC3FA1732\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3708 msiexec.exe 3708 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1964 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 1004 msiexec.exe Token: SeIncreaseQuotaPrivilege 1004 msiexec.exe Token: SeSecurityPrivilege 3708 msiexec.exe Token: SeCreateTokenPrivilege 1004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1004 msiexec.exe Token: SeLockMemoryPrivilege 1004 msiexec.exe Token: SeIncreaseQuotaPrivilege 1004 msiexec.exe Token: SeMachineAccountPrivilege 1004 msiexec.exe Token: SeTcbPrivilege 1004 msiexec.exe Token: SeSecurityPrivilege 1004 msiexec.exe Token: SeTakeOwnershipPrivilege 1004 msiexec.exe Token: SeLoadDriverPrivilege 1004 msiexec.exe Token: SeSystemProfilePrivilege 1004 msiexec.exe Token: SeSystemtimePrivilege 1004 msiexec.exe Token: SeProfSingleProcessPrivilege 1004 msiexec.exe Token: SeIncBasePriorityPrivilege 1004 msiexec.exe Token: SeCreatePagefilePrivilege 1004 msiexec.exe Token: SeCreatePermanentPrivilege 1004 msiexec.exe Token: SeBackupPrivilege 1004 msiexec.exe Token: SeRestorePrivilege 1004 msiexec.exe Token: SeShutdownPrivilege 1004 msiexec.exe Token: SeDebugPrivilege 1004 msiexec.exe Token: SeAuditPrivilege 1004 msiexec.exe Token: SeSystemEnvironmentPrivilege 1004 msiexec.exe Token: SeChangeNotifyPrivilege 1004 msiexec.exe Token: SeRemoteShutdownPrivilege 1004 msiexec.exe Token: SeUndockPrivilege 1004 msiexec.exe Token: SeSyncAgentPrivilege 1004 msiexec.exe Token: SeEnableDelegationPrivilege 1004 msiexec.exe Token: SeManageVolumePrivilege 1004 msiexec.exe Token: SeImpersonatePrivilege 1004 msiexec.exe Token: SeCreateGlobalPrivilege 1004 msiexec.exe Token: SeCreateTokenPrivilege 1004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1004 msiexec.exe Token: SeLockMemoryPrivilege 1004 msiexec.exe Token: SeIncreaseQuotaPrivilege 1004 msiexec.exe Token: SeMachineAccountPrivilege 1004 msiexec.exe Token: SeTcbPrivilege 1004 msiexec.exe Token: SeSecurityPrivilege 1004 msiexec.exe Token: SeTakeOwnershipPrivilege 1004 msiexec.exe Token: SeLoadDriverPrivilege 1004 msiexec.exe Token: SeSystemProfilePrivilege 1004 msiexec.exe Token: SeSystemtimePrivilege 1004 msiexec.exe Token: SeProfSingleProcessPrivilege 1004 msiexec.exe Token: SeIncBasePriorityPrivilege 1004 msiexec.exe Token: SeCreatePagefilePrivilege 1004 msiexec.exe Token: SeCreatePermanentPrivilege 1004 msiexec.exe Token: SeBackupPrivilege 1004 msiexec.exe Token: SeRestorePrivilege 1004 msiexec.exe Token: SeShutdownPrivilege 1004 msiexec.exe Token: SeDebugPrivilege 1004 msiexec.exe Token: SeAuditPrivilege 1004 msiexec.exe Token: SeSystemEnvironmentPrivilege 1004 msiexec.exe Token: SeChangeNotifyPrivilege 1004 msiexec.exe Token: SeRemoteShutdownPrivilege 1004 msiexec.exe Token: SeUndockPrivilege 1004 msiexec.exe Token: SeSyncAgentPrivilege 1004 msiexec.exe Token: SeEnableDelegationPrivilege 1004 msiexec.exe Token: SeManageVolumePrivilege 1004 msiexec.exe Token: SeImpersonatePrivilege 1004 msiexec.exe Token: SeCreateGlobalPrivilege 1004 msiexec.exe Token: SeCreateTokenPrivilege 1004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1004 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1004 msiexec.exe 1004 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1004 msiexec.exe 3708 msiexec.exe 8 MsiExec.exe 5408 MsiExec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1004 1964 ScreenConnect.ClientSetup.exe 89 PID 3708 wrote to memory of 8 3708 msiexec.exe 91 PID 8 wrote to memory of 4468 8 MsiExec.exe 92 PID 8 wrote to memory of 2492 8 MsiExec.exe 93 PID 8 wrote to memory of 3480 8 MsiExec.exe 94 PID 3708 wrote to memory of 4444 3708 msiexec.exe 99 PID 3708 wrote to memory of 5408 3708 msiexec.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\1a544d57af924836\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1004
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C251C75ECBBAAEC57A51BC9C6BE174E3 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739234 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4468
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6624.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739906 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2492
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6BB2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741359 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3480
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4444
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 61A3E4ABC0589D9F150BB59C67E46F9F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5408
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59b695.rbs
- Size 10KB
- SHA256 9256a4e855a515a510d364a85f7f92b39205a8b4bd7f0cec2f5ba65276ba9ccd
- MD5 918b386493227a78c42559707851dba1
- SHA1 9f4439c257167fdc7f9961dc06249126ad1d712b
- SHA512 702ff57a0b68b095d310047d856a246dae357785b7203ec5102c6896ca6604f89b43bf4732222468b42f5f00e05494b185163cc187b4921f329a1817e6687790
- SSDEEP 192:BDvRiqyRPgiCm6x60RPSIBPSN26E6116UQ6Qn36K6d6z6s61KXp6S6o6Q6C626p+:BDpiqyRPgnUAPfPwB3KsSqlwGf1bt7j4
- TLSH T160222F017B0593D2F6520B39C7872A583BB1DED81348374F45C922396E63B869B7E6CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp
- Size 1.1MB
- SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
- MD5 de6e7dfe9dd634ac9d38773353ef7819
- SHA1 714c4d51644966f75384d5df46a26152677ebc26
- SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
- SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
- TLSH T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp-\ScreenConnect.Core.dll
- Size 567KB
- SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
- MD5 bbfa13f0a1213839b8538d7bf5b59729
- SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
- SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
- SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
- TLSH T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
- MD5 8ddf92d9e3add16db1614fd3cc92b65c
- SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
- SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
- SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
- TLSH T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI62F6.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
- MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
- SHA1 e0674df443bf5aaeb91557629c45d921576cda68
- SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
- SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
- TLSH T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6624.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6624.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
- MD5 9a608a8c0652b8ef1be1ca636e1d1238
- SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
- SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
- SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
- TLSH T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\1a544d57af924836\ScreenConnect.ClientSetup.msi
- Size 9.8MB
- SHA256 788a40f11a2d59d81b4961563afd0fa620bcd62072b3308f834691030e7c8689
- MD5 780f2d28e8fb38a3f1e1fe6c791dc0a8
- SHA1 60b04f41a94767d68a65a701624b64221a6d03f8
- SHA512 c5a08b9f845745f0b6500fd935f79b895f9e518849d0eb5d94e507ee310f85d904fe21d76051d861a8757bf8cb0690f2b93af9132e6766f33b069874fc6fec75
- SSDEEP 196608:Veq5KqDBCDkStfQE3eq5KqDBCDkSt3eq5KqDBCDkStUeq5KqDBCDkSt:0q5VDBCDxfQEOq5VDBCDxOq5VDBCDxZT
- TLSH T1A4A6233267E8D425F1B60B3AEC3A86B16A39BD10DF15C40F2364784D6971D81C6A37BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBD7B.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4457f473fd2227d46e5fbe133513f17826e436f998eab79299b67d48d478e20a
- MD5 12327d9140a677482eeebc4078d8ab11
- SHA1 8fa7edb3cf55ceecdc240fbb6263b8546ab4c455
- SHA512 c85d4e0c4b227ff87263cd3334cc7f137484bbd72584e9778aaf978351a0489e7968615cd8f6024ad171cd0b534a438125706a3e2350251350a299a119b6b53e
- SSDEEP 24576:jFo3DMPndoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+X:BHM
- TLSH T15357B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{36920c5e-b3ba-446e-b2a9-f01af7102d48}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0704c07881722177e5697477b537ca16b6f5010f741cf96d4faff539751f898e
- MD5 20e60f9187e830097f2ec488c0b2d85e
- SHA1 724835b25aceecca67d0921fe228da2d3a1789ed
- SHA512 851bf97392359a9809d8b27855bbd183285617ebe53d6fec9f54dd017dbe692d07d25dae26c7a0c538c23be9f70196962077ce228ebfb2d7e6b7cc6fc332aa00
- SSDEEP 96:FBI8wb4vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:TIGb++uVm
- TLSH T107D177184AF54711E2B3AB7128F14557A837B911EF33CB8E0198238E6631A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH