Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 11.1MB
- Sample260807-gv295aec82
- SHA256 b834f96b09a020e35a370168f0c8a399ef67501a1250c90beb7ecb7e1e0e0f22
- MD5 ba0af2752e80d9f6c2691633e20ed895
- SHA1 6b07346f5a2873efe79023e26d90317dc34deaa6
- SHA512 4d73d12357429e2e899dd218cc0451f72a5ebb5b2b66e9d5d3c3ed9cf5486c46bbce9591848b991d56c4edb71775acd337c7f6c4b29ee9833058742f1a2c3cf8
- SSDEEP 98304:HRDRs6efPwPpiTBNxNBWHcGS0h7276PpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHj:HRdfefPwPK5NqyaK5sK5GK5aK5I
- TLSH T1FBC61201B3DA4979D5BF0A78E87A81549B35BC049B12C7AF53947D6D2D32BC08A323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 3548 MsiExec.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 6056 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ffa4b9e62e757d4c)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{E2F47040-4C38-A940-9AC6-C77619FA6C9F} msiexec.exe File created C:\Windows\SystemTemp\~DFCC08368E21B7A5AE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBB29.tmp msiexec.exe File created C:\Windows\Installer\{E2F47040-4C38-A940-9AC6-C77619FA6C9F}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e59b5fa.msi msiexec.exe File created C:\Windows\SystemTemp\~DF8A8F012BCAD4A491.TMP msiexec.exe File created C:\Windows\Installer\e59b5f8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF26CB722643890103.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBAF9.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE133EA0E74D66639.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59b5f8.msi msiexec.exe File opened for modification C:\Windows\Installer\{E2F47040-4C38-A940-9AC6-C77619FA6C9F}\DefaultIcon msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fab76c52da068360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fab76c50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fab76c5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fab76c500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fab76c500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\Version = "419954688" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0C2B9EB57095D805FF4A9B6EE257D7C4\04074F2E83C4049AA96C7C6791AFC6F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\ffa4b9e62e757d4c\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\ffa4b9e62e757d4c\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-ffa4b9e62e757d4c\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ffa4b9e62e757d4c)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04074F2E83C4049AA96C7C6791AFC6F9\Full msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-ffa4b9e62e757d4c msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\ProductIcon = "C:\\Windows\\Installer\\{E2F47040-4C38-A940-9AC6-C77619FA6C9F}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04074F2E83C4049AA96C7C6791AFC6F9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0C2B9EB57095D805FF4A9B6EE257D7C4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ffa4b9e62e757d4c\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\ProductName = "ScreenConnect Client (ffa4b9e62e757d4c)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04074F2E83C4049AA96C7C6791AFC6F9\PackageCode = "04074F2E83C4049AA96C7C6791AFC6F9" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2920 msiexec.exe 2920 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4116 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeMachineAccountPrivilege 2924 msiexec.exe Token: SeTcbPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2924 msiexec.exe Token: SeTakeOwnershipPrivilege 2924 msiexec.exe Token: SeLoadDriverPrivilege 2924 msiexec.exe Token: SeSystemProfilePrivilege 2924 msiexec.exe Token: SeSystemtimePrivilege 2924 msiexec.exe Token: SeProfSingleProcessPrivilege 2924 msiexec.exe Token: SeIncBasePriorityPrivilege 2924 msiexec.exe Token: SeCreatePagefilePrivilege 2924 msiexec.exe Token: SeCreatePermanentPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2924 msiexec.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeDebugPrivilege 2924 msiexec.exe Token: SeAuditPrivilege 2924 msiexec.exe Token: SeSystemEnvironmentPrivilege 2924 msiexec.exe Token: SeChangeNotifyPrivilege 2924 msiexec.exe Token: SeRemoteShutdownPrivilege 2924 msiexec.exe Token: SeUndockPrivilege 2924 msiexec.exe Token: SeSyncAgentPrivilege 2924 msiexec.exe Token: SeEnableDelegationPrivilege 2924 msiexec.exe Token: SeManageVolumePrivilege 2924 msiexec.exe Token: SeImpersonatePrivilege 2924 msiexec.exe Token: SeCreateGlobalPrivilege 2924 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeMachineAccountPrivilege 2924 msiexec.exe Token: SeTcbPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2924 msiexec.exe Token: SeTakeOwnershipPrivilege 2924 msiexec.exe Token: SeLoadDriverPrivilege 2924 msiexec.exe Token: SeSystemProfilePrivilege 2924 msiexec.exe Token: SeSystemtimePrivilege 2924 msiexec.exe Token: SeProfSingleProcessPrivilege 2924 msiexec.exe Token: SeIncBasePriorityPrivilege 2924 msiexec.exe Token: SeCreatePagefilePrivilege 2924 msiexec.exe Token: SeCreatePermanentPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2924 msiexec.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeDebugPrivilege 2924 msiexec.exe Token: SeAuditPrivilege 2924 msiexec.exe Token: SeSystemEnvironmentPrivilege 2924 msiexec.exe Token: SeChangeNotifyPrivilege 2924 msiexec.exe Token: SeRemoteShutdownPrivilege 2924 msiexec.exe Token: SeUndockPrivilege 2924 msiexec.exe Token: SeSyncAgentPrivilege 2924 msiexec.exe Token: SeEnableDelegationPrivilege 2924 msiexec.exe Token: SeManageVolumePrivilege 2924 msiexec.exe Token: SeImpersonatePrivilege 2924 msiexec.exe Token: SeCreateGlobalPrivilege 2924 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2924 msiexec.exe 2924 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2924 msiexec.exe 2920 msiexec.exe 3548 MsiExec.exe 6056 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2924 4116 ScreenConnect.ClientSetup.exe 89 PID 2920 wrote to memory of 3548 2920 msiexec.exe 91 PID 3548 wrote to memory of 4928 3548 MsiExec.exe 92 PID 2920 wrote to memory of 3676 2920 msiexec.exe 97 PID 2920 wrote to memory of 6056 2920 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\ffa4b9e62e757d4c\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 882F97777A3E812407B7D084B8E5130E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739359 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4928
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3676
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E202120BA8D265D4DA1AABAA3B5CBB42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6056
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59b5f9.rbs
- Size 9KB
- SHA256 21263c63b60c23e63e23f85347c0364ff82908233db2c96703b97cd1e4db2fd4
- MD5 b0154432edfa86910600e7d122d31eb4
- SHA1 4420710bebafabb7caff7d75062ad2c489458325
- SHA512 388375c12c1c60ae5854fe3466f7b79c2b3e323a8ced28a038d09bf158dab74b34dbf37afdb6d82dab8fcf3ea2678d79854cb1b03e255966470efcfee82c3510
- SSDEEP 192:DG3zxgTmmmBwA8CMnDj8kI6dDj8kJS6AXTybYped:DGgAGE8E3U
- TLSH T19222CE02B704A1E2E6A25A73C7471E103B72DFA85301234B15DD46798F73BCA6B7E1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp
- Size 1.1MB
- SHA256 cb73cb9f2dab77790dd09267fd53cfc67824f4b626b0df739732f79e9a428016
- MD5 a0d8201bd0f20e010ff95bace2e90982
- SHA1 f87c6e37f061655ca44122fdcb73f38c3e4eccf7
- SHA512 4f4f4992824d0a987cea54316e0af11fde6158843e5f5ad9aab8e141d9ce45944136d51415f91f043a8166cd017adfbda921f378aa3fcdc4642e844c5398a841
- SSDEEP 12288:FUUa/hkHVyAXiel5dzt1sNmgyFe642O8fDytplOCKYnJmIVs+DQbjuyiToZwtMAZ:FUUGGHVRl3cNmBFDVm/5Mt7CZpvjkWUK
- TLSH T17F3523203A94C936F1E52532AE78B3B119BD75626F30D18F675D271D1EA03C0DABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 619de6b81b8055ee249b00df1150da82c2e97e6c54f3f4686f483ff8718a59f6
- MD5 490ef2cee6c1d8073c3d11bf89c4d2c7
- SHA1 d82d6e5d33d4f36b8ce73b503cdfc10b323fc319
- SHA512 5dc1d1a9072079cef74d1741d286163d990709e5ffb24cb3d499779decd256d4fe4550455b0c686c38c10be8c8d47a9239b2432a10d90fd6991ec4a7d108cb3c
- SSDEEP 12288:vx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznI:DhXBJF/sEEzn
- TLSH T187C45C1333E8873AC67F0BBAF120D9154671E911B30AE75B1A9AF4E52D823894D4C7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 2948a737ef6199d0fd348c767df0312a8f881d7ed13719af7c3aa5ae363299e3
- MD5 471396a9b173fb65689cc2b96abe711b
- SHA1 fae570b66d1a2f48115f908fc9c28454e513a512
- SHA512 4fc04a3c335eeb1acda057143aa5f84e9f88d2d32ddeec7b9a138c373242bf505fdfaab9750680cfb3d85a67acf4c096800baa752fdd74bf362bea34ef821ced
- SSDEEP 192:s8/Qp6lCJuV3jcXtyVNamVNG1YZfCrMmbfHJ7kjvLobuLd9NEFbAJE:h/cBJaQXt2NaheUrMmb/FkjvLobuZVE
- TLSH T1FB32C60077EC933AE8BE0F799AB762910671EB74A011DF2E18C851569C367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6383.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 001f46a4c1ef3f09e0842acd0dc8975424dc01b87736b1176e785ac9721e0c08
- MD5 14db78fec8c3192d1972ea193d55e744
- SHA1 29b1025d6cda61759d36b52c86765f22b888d252
- SHA512 5e92fab1ccd35d7b5ef6cee5aa938b8d2d9075212496d0e9523def24e9690de75dc609a395c8d3b2fc9cd526e9c683876a1ea6d23e54889e5fb55ad5ea3b8d8d
- SSDEEP 24576:+RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:kpiJkGYYpT0+TFiH7efP
- TLSH T1D585BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\ffa4b9e62e757d4c\ScreenConnect.ClientSetup.msi
- Size 8.7MB
- SHA256 e980023cc6e84fe0da4f7f1215165d0a82d4ab9345e4ca9e8929413fe3540f84
- MD5 ffd21483f868e63a1ff9fd7b86379946
- SHA1 9ce9abda74708728e5813c03fa8572df2f4d6c8b
- SHA512 a389c7fa4966a9ef42c1b35dee09fc834f51cdab5888d1c365840ccdd946c2aa4bdf850eb1a8e114512b7cf925beb34269446d7aef4965b4ec943125a225f4d8
- SSDEEP 98304:HpiTBNxNBWHcGS0h7276PpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHzpiTBNxNBWH:HK5NqyaK5sK5GK5aK5
- TLSH T17E96236167EE8929F1F71F71F97A44E05A3A7C65EE22C00F5325395E29B0E8081B2377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBB29.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 dc70333d5752a766a2c9c68c1ee4c2715f34e0d6c5dbb3ce4e361888780ca992
- MD5 99e0e1b3394894a9583731b81f5273f4
- SHA1 dfa95bca536e6d9bace485ea1c878878e865d285
- SHA512 3f4be323d94232840f123ca43d0b768c6f31083ebab372a9adcfe9dc1e83bed5b5bd1808e61663ee95009fdb031c1834cc5905495bbb868b4e32c15576a641be
- SSDEEP 24576:4Fo3DMPZdoO/vvTL/CgySSFAvbOo5L1hUv0AdfMakHca5FTS8YBmyLIz2O4:MHk
- TLSH T14E57F62836F92100E7F79E3CA8F56A634D397D57AC15DE8D05411B8D0822FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c576ab2f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b59e1a19-5d77-4f33-bf8f-3a9c1b134cb8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 75b8c8e032c2bb91d1689b6768d41f3bfc93d754cb063439a5cd870b26f405d7
- MD5 bc8ff242f4512c717372914cf0128445
- SHA1 1034b915f6d0d7f8ffd972110cafbc0d44712a01
- SHA512 838009fd19519dc70237a158dec305c2e4b65c8cba19a31cb5c3f898cf545039db1e0f6d923232c4c335a9cffa67f874c7429fa3ad1a0360bb3361da04e2f593
- SSDEEP 96:FXVXZFQvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:NVob++uVm
- TLSH T11FD1871C1AE54711E2B3AB3229F58557A877B911FF33CB8E0198238E6630910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH