4957dc632215a7500070fa697a4c9439bce4d35d27ab4f62c67f72b8178ca92e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 305KB
Sample260813-gzbb7sstd1
SHA256 4957dc632215a7500070fa697a4c9439bce4d35d27ab4f62c67f72b8178ca92e
MD5 b89d071659f8f1a5160a08148b34c959
SHA1 cd94511537ddca34a232b7638e30e0c439e71231
SHA512 48d5537348ac30b7548a956f913283c09d97d66e899e6faba35df5a3d738d72711fb11ff4a6b5ec2317b762b5559e1886033e1a206919eb29c25b5680f30dab9
SSDEEP 6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji94:A1iw7gryNkSV1hy1Z1u2JLu94
TLSH
T1DE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
3	2504	dfsvc.exe
3	2504	dfsvc.exe
3	2504	dfsvc.exe
3	2504	dfsvc.exe
3	2504	dfsvc.exe
3	2504	dfsvc.exe
3	2504	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c57a-50.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c569-211.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c56a-210.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c579-206.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
2112	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\SizeOfStronglyNamedComponent = ac21010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!10000000fe0a5a0e40080000d8160000000000000000000 = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_f9 = 68747470733a2f2f736572762e6c696768746c616d707363656e742e65732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!02000000fe0a5a0e40080000d8160000000000000000000 = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\lock!1d0000001d0b5a0e40080000d816000000000000000000006a1d = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\SizeOfStronglyNamedComponent = d96a090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!0e000000fe0a5a0e40080000d8160000000000000000000 = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!14000000fe0a5a0e40080000d8160000000000000000000 = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_f9 = 68747470733a2f2f736572762e6c696768746c616d707363656e742e65732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\SizeOfStronglyNamedComponent = 4514020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\DigestValue = 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3603184"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_f9 = 68747470733a2f2f736572762e6c696768746c616d707363656e742e65732f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!0e0000007d085a0ec8090000cc000000000000000000000 = 30303030303963382c30316464326165616636303030393130	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_f9ee6af64ba5817a\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_f9ee6af64ba5817a\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!04000000fe0a5a0e40080000d8160000000000000000000 = 30303030303834302c30316464326165623033323430313161	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "NN0D602GKRT3ZDPER6QM686Z"	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2504	5012	support.client.exe	89
PID 2504 wrote to memory of 2112	2504	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 6c64b9b8555425726df19d4cefc37e8739b700f66c13f576c163a2874a10c5d3
MD5 f7bb8944f6c59e6b5205283d2fd53b67
SHA1 b60b9c1d08eddf8d6ea2f1ac6ee47659e45e9a4b
SHA512 23007808c2add5e9e81999cec0284352d1f377ddc86359ad149e74acadc7fea14c2840ad2369de97adc1b66de976349b35d1ec5d851ba4190b6891b34ec6d5d2
SSDEEP 384:6JqRtGTf6vNX95ZgMacc5X9R/QPIBM7YV+++amtUU:64mf61X95+yc5X9R/QPI+0V+++amtR
TLSH
T1BCB26F01BBE2E923D1466733CCA6C3E57236FD924F96139B70023B2E9D703D95A32685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 50b9bf98cd40d8481297c3c5852b99afde5b68529f53c565a9149aceae8830e4
MD5 44be29e620022d97127857f40f792e47
SHA1 6d21f4a3905d8539e8319ca959a7b0a092aac4b1
SHA512 128a60cd25ad7c175febc910274764ee69675f4b16ea61c7fa6db41de4125426c1e57cb7d987855778a28a38c6b4fac4b770dfd791ad0c5a567d2c48c68266ca
TLSH
T1546178027284EE17DA690633ACD6C2EE37757E83CF42470B74C4BB2FBA312E65612195
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 838ae891fe9df120f9e809448c6dc0a0b6f1a2b787d298cbf70a885999c28421
MD5 b211ae5d0158c5b92a5bc1ed900ef9db
SHA1 75232607ae5ecca14768f8a2d9a2c95178bc03ca
SHA512 7d0d57248fce4e69ce80d4af30f49d3b241f8c7a7125178d2236ab1a7a8eaa97e9b6363b132664d6a4987b0e94e3b0941482df5db24fd9e8cb2e8f9d983b93ab
SSDEEP 96:BE4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAzRbfwnANb6F:4RzgiJgOMrvOApoAMF
TLSH
T132B10E117304D917D5B906336CA9C3FE2B687D92CE82061B30D4BF6F7A326FA4721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 d938506993613ccf9c9f11afcc9530edcac564a7fc35583dec05e5f638f1c89c
MD5 f560e152c5c49664fec06e5999a36b47
SHA1 d35bab5b9915a588228653d9a6ac1187095d5dfd
SHA512 36d6dbea612995cfa8ddf1cc206ba0bba1a015379f27000a0ecc0a1ef7f2e3fc3bea6884468b5b932c22667e8d73cd0dd1689cf0a3fe49a3e68b352821a82cb4
SSDEEP 96:tmQPPypJEeV+Wwws8WCUevU5Rek1zxaSU1Sks6b/DrK:LPPaJoCUdHmfLzK
TLSH
T19CD14316B244FE07D6A906339CDAD3ED62243D86DF43075B30C8BB2FBA727E61621055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 ad27084124a52972fe124f8f47229c759eba23df0a255ed5165ecacdd72481b0
MD5 1c6ed879628904b1d9db540fd657fe0f
SHA1 d8f5cc3f698e37cae5ba741e970423c31cd3aff4
SHA512 2582f89d9376a0e130b59e2712becd205cbe3fb537d86b37443d284633aebb3d0d13b87a22cc15fbcba0f97936e8e5fd2617ccba6cddd870165ae6d3a788e739
TLSH
T1335199057688EA67C62A0633ECD1D2EA32357E82DF470317B1D07B7F7A713E546120A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 056330fb71ebe7577046a0b22ef98ba4213476852262b1e1b6b70155e782cea8
MD5 6d85593594b354679c86d2098bf5a341
SHA1 197a616c1904f5032574063a49b5cf2e2e191f23
SHA512 92d7cc29fc2bdf41b0180c79485f31593d432a00e59656706fe02c1823a6673ee6c258fb959f9827d5522213fc759ca9d0359f9fa21601b2dc5a25dc8190d09b
SSDEEP 192:M9NJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:M9b9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T1CA62F6803760DA23C1169733DDE2C7E13679FE934ED2479F74027B1F6874B849622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 30c53cac117d96b8c5da336ef6e3890d47307217ac0ea9a4df99d4db1772e0e5
MD5 131e82ecdc7c8d9d1960737878ca2c64
SHA1 db1d410a03bd01b3b29ae6f8c934bbdfd0f12387
SHA512 efa161b741abebc71ae136e47da6a5aa608853d3954f95e3d51fab03f3cf36bfc03a98739feb4de5fc55a454370bbc68cfb0ab4205cb40bb58765259ea8ab7f5
SSDEEP 48:vG/CDvx+dgJe6S+9ow87gnW75uv5HOrNghHXo8TZnTyA9UZCf:vG/SeV+Ww8s45uJOEHX5NTyOZf
TLSH
T12791CD05B688F966D5A40A72EC86C3ED26687D83DF420B07B1C07F3FB6752D70725196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5adhugmm.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\5adhugmm.newcfg
Size 571B
SHA256 cb6b5800b4f31d3c66f220b3b7eb2678e564870787b0a1a4ca19a4e9749fa3b3
MD5 e53b74f4acf63b48dd82e50169f470b7
SHA1 63cad55f1900a97689f82fa87028d87e98f43e0b
SHA512 5a0229af8c053d780ff22697e2756dec059c0983863dd207add0564efebb38ec3483c4ca0682f5b7d4ff0e3454544f401e37d58a2288ae26a9233cc53c3276de
TLSH
T13DF08BA530C07E4613B31D23C8114344FE325B9B0059109834AF22379F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\app.config
Size 2KB
SHA256 fb2999370d02bba61bb4daacef78bf032533633d2f1434f003d397721f79d747
MD5 712dd8c2580da0f0e698fac4eecaa957
SHA1 1dbcfbd51fa5acaed9a9cd8a094ad29987e1de80
SHA512 916251eda682f118e364e0128237b44a43e14b1608bb45cd3368ed2df9d5c830e24cfd648a2ceba9db49833a89eb3ad588972a7cd730d6704a83269a75ab010f
TLSH
T1F651701DB5C0AF9915B2A635E73152C1EC60493312A6F0E478DE31679F70FCA4AF32A6
MD5 SHA1 SHA512 TLSH

Submit Download

b0reoh3a.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\b0reoh3a.newcfg
Size 571B
SHA256 ff8f8ef270c3aff895ecc72c9d74e7aaa4adc6880c8868123a7a726dc6fd7a6d
MD5 72aedfcee2fc4766e7a03218ed335a48
SHA1 01cacde2c1f79a4d741b84b7e61fa83a60b87762
SHA512 f75d8ae6dd5b5a841110eedd6657808d663c1a6a3bb2ac22a7981b9925e30faea8680070b118c200c520d1acaa5032d31544c858d564d38d120b641b2f5119fc
TLSH
T1BBF08BA430807E4617B31D23C4114344FE326B9B0099509834AF227B9F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

c3xtznak.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\c3xtznak.newcfg
Size 571B
SHA256 143e0a98a949c2b2136e82bdab2e62140708293ce2bec4cf940fc03acf064170
MD5 fa2715fe88ea0cf578cee787495205f9
SHA1 1d9fe57083be6b52b9dd1771aaf5e74e3a3d50eb
SHA512 c1fd07c9aea08ac2f973741f504159fd8771d686d1d743fe53ffec6e2085e21ae7c5b6c9e5bb17060e955d5956b780589218aa78a753c72170071717e316b181
TLSH
T1F9F08BA430807E4613B31D23C4114344FE325B9B0459109834AF227B9F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

g1t5xuso.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\g1t5xuso.newcfg
Size 571B
SHA256 67e2b8e2e09656e672228f093d332eb6c1c188cf553708544e8ba1062577355a
MD5 3fe4ae637490712940117c84a2aaffc3
SHA1 5aa1ef9013d9e5c7922ef52c4c4d09f831fd5bc8
SHA512 8dc223142bc58f0db35a91f30f2a22c213e29ac0c00f812b741177a25ad0debaef502bbbd95c5496c4d8bbd5d05b36a5a48bdf4aecf167552eddf1850cbc130f
TLSH
T19EF08BA430807E4613B31D23C4114344FE325B9B0059109834AF22379F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

jdinohnc.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\jdinohnc.newcfg
Size 571B
SHA256 c94ed6347388ef93db70e5db616c9f0c9bcb5b960b6ffb670af51d76913098b3
MD5 b9945ff748a86aecc72bdcd7e385f7bf
SHA1 6026fa2d972004e60b4b206ef9029e15598c8d47
SHA512 13541d91bca7722191d2a48b9608dc2652f7a5d39f08f122ee58b2ce9a32e771dcfcf8df847f259330e69f5eb8f470e05495723d2f9faaa4d29fb693a66b6773
TLSH
T1F8F08BA430847E4613B31D23C4114344FE325B9B0059209834AF22379F305DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

n3xdvmlp.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\n3xdvmlp.newcfg
Size 571B
SHA256 b464650ae1922a602c67cf93509dcfd650122cbf6ba2ea1df69cc952f0acd6cc
MD5 5a2bc195de1cbf9d5980bea7b80f41c9
SHA1 e9a2412d6db23fa4cf7a7b03ed0690e73c34b30d
SHA512 7be8ed4b5f6f404bb2298d5935719f3f44a4972baf7d181a043498f008b399b4365f580e5688ddc58b57ca76d8b4e67f6b19fb45652334002849e64571d352cb
TLSH
T12DF08BA430807E4613B32D23C4114344FE325B9B0059109834AF22379F301DF07A31EE
MD5 SHA1 SHA512 TLSH

Submit Download

nsgd45mh.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\nsgd45mh.newcfg
Size 571B
SHA256 b8b81ccae3c7ac17cf65070fb08496c4859c47ccd1acbcc04e689613a61fbc1d
MD5 55f77240e3c37edd7eb3c2875a504b68
SHA1 937f9ca131e8de342398cbd251cbf9f613f06067
SHA512 8d00e0ce4f9fadb95530e5a729b667033db86c2871f26987ac6bff3fbd3ab39c84fdf21941bef61cfb6126c4e7e72a0fbb5cbb17a50ca3c0b287211a22a6b022
TLSH
T149F08BA430807E4613B31D23C4114384FE725B9B0059109834AF227B9F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

rwnew0ef.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\rwnew0ef.newcfg
Size 571B
SHA256 3c89ed577290991ffde49dcca666c8649d2853fc710951d9bb7d5acd255f6bfc
MD5 60d67e17c4d2c8d211f5333b20514356
SHA1 d630a2025a6984222e9a07829b932df16cacfb41
SHA512 2aad0fb568e08588b57cad156c2629f3600c3d07227e21d712beffaa6c55be18374f18416874ac8989f698957e949e95306c0f01e0a7e4e890165501ee5cd03d
TLSH
T1B0F08BA430847E4613B31D23C4114344FE325B9B0059209834AF2237AF305DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\user.config
Size 571B
SHA256 b02940bb3f7209de2740f316e89eb9cde2f17e08abe50d9ded85883213b85b00
MD5 675e9cb88c041eec3d6473aa7a9f8a21
SHA1 f8c694cdee8db91b3c9aabcb5a02d73533382145
SHA512 dc955c3693d80924f9a042db7800f7182ab0669ebf987acbe57845bb9c555c3dfb774287cc86254b7ec3a24af44402e6f442378e76fc94ac1ca73a87f13ac2e5
TLSH
T17EF08BA430807E4613B31D23C4114344FE325B9B0059109834AF227B9F305DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\user.config
Size 571B
SHA256 a652fb08abb3770a100a31abcd93fc71585ea81b026c40ed6f168aecc2623337
MD5 9817ec0de5f9269bc529d863d3540157
SHA1 bce0b0492c45af4c4548ba54da20e5eb5c9c4ab8
SHA512 c529e382e549061ec8460531a451cc2d32ed23cde322ac0ab01e5f4d3a42ce937fc8a445fdc193a343bc73a9284e24fd3a19ffa4690727143e04e163887c543b
TLSH
T1CBF08BA430807E4613B31D23C4114384FE325B9B0059109834AF227B9F305DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DP0Z4EAK.KL2\011YXKA7.H65\scre..tion_25b0fbb6ef7eb094_0019.0002_9c51108e24f4f3cf\user.config
Size 571B
SHA256 c2f254092f9c4b6ab6797b47d160c1221cef1b780ef132e2faca2decb5e22f74
MD5 0827dbf969edea6b4974d3d093cdc6a7
SHA1 453397a9b2dc027d5449fec038b8fa493ac62375
SHA512 03ae6d9c44d83a133835c347d6b19bc1ec4d5446b1f2b3914fc7a5c0b8c9bbfcfa1a01bbae4b5272f006f6c6a9cf2f9a01791f3c7646325403027afa06533000
TLSH
T1C1F08BA430807E4617B31D23C4114344FE326B9B0499509834AF227B9F301DF03A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8N2WKOPW.GJE\EGCKTOL3.1V9\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M7HC88KR.1MY.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O8097KPJ.8ZR\M7HC88KR.1MY.application
Size 118KB
SHA256 3794784a5982c98565c51648c51de16a7f1236b35b01553882c0dd2ef627a9d7
MD5 dcbb1d30548aa57f67291a924aeaa15d
SHA1 6b086026a477fa803fb43cb657c668602ad5d1a7
SHA512 c6180202a49724d0dd93bacab92b844d79ae4f6cfda7e9710b58ae64e62859e42a4122158ff459684a7cbb6f16bf3bbad56f8708905f1ef164b4487da8e701ad
SSDEEP 1536:gN0XwNFNzayXol5XAxBUO3qmnUuaFP7JnGZ4Q08UVh5arVIRTLvooBK/rm2oyEH5:8NoXNOs7Jnv56IRTL98m2o9HuzhJOvP
TLSH
T11CC3F82A8F30F4C0477DB02191A52D6735811B97DBB30FECDE0A186B4E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-304-0x0000000000770000-0x0000000000808000-memory.dmp

Download

memory/2112-311-0x0000000002880000-0x0000000002898000-memory.dmp

Download

memory/2504-34-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-192-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-55-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-59-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-13-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-56-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-54-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-53-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-52-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-51-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-48-0x0000021CF99B0000-0x0000021CF9A48000-memory.dmp

Download

memory/2504-42-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-43-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-41-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-39-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-67-0x0000021CF97D0000-0x0000021CF9806000-memory.dmp

Download

memory/2504-33-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-61-0x0000021CF99A0000-0x0000021CF9A2C000-memory.dmp

Download

memory/2504-17-0x0000021CF7030000-0x0000021CF7080000-memory.dmp

Download

memory/2504-79-0x0000021CF9C70000-0x0000021CF9E1C000-memory.dmp

Download

memory/2504-294-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-1-0x0000021CDA6B0000-0x0000021CDA6B8000-memory.dmp

Download

memory/2504-73-0x0000021CF5180000-0x0000021CF5198000-memory.dmp

Download

memory/2504-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-318-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-4-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-3-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2504-2-0x0000021CF4D10000-0x0000021CF4E98000-memory.dmp

Download

memory/2504-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads