Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 05:58
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 5.4MB
- Sample260816-gpddta1yex
- SHA256 d30c9d87c66d715810f77ca6db1e85b394b048a57cdd11d116a47c4536b3be18
- MD5 b98589017bd2e0ef83b4fe7dc963a784
- SHA1 d215290cd61bbe0feadb98a5c23168591f56512b
- SHA512 74fc0212854b0535e649df26b860d6ee1afca19af32f2c959be489a0a344a036cfd5429592b4c98b952a42357e10c2e359ba208bf9ed0e7a5cb4f72fa9d3e3f6
- SSDEEP 98304:Izs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:gfefPCFF3bBR1H9773
- TLSH T16A46E002B3D695B6D4BF063CD87A42A96674BC044712C7BF57D4BD692D32BC08E323A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/memory/1844-2-0x0000000005DF0000-0x00000000060E0000-memory.dmp revoked_cert_connectwise - Loads dropped DLL 11 IoCs
pid Process 5084 MsiExec.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 5836 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (1059849e32002f21)\ScreenConnect.WindowsClient.exe.config msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A1AFF559-B6D5-70F4-3CAB-C9CA87DAA82A} msiexec.exe File created C:\Windows\Installer\e59f7f5.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIFCC5.tmp msiexec.exe File created C:\Windows\Installer\{A1AFF559-B6D5-70F4-3CAB-C9CA87DAA82A}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF3CDEDA1A2764E09E.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e59f7f3.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCB273F4DFF18D7F1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIFCF5.tmp msiexec.exe File opened for modification C:\Windows\Installer\{A1AFF559-B6D5-70F4-3CAB-C9CA87DAA82A}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF42FA868CE13AAF7A.TMP msiexec.exe File created C:\Windows\Installer\e59f7f3.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0319B086942CE858.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\PackageCode = "955FFA1A5D6B4F07C3BA9CAC78AD8AA2" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\Version = "402915332" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F566CCF508BB3384019548E92300F212 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.4.4.9118\\1059849e32002f21\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1059849e32002f21\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1059849e32002f21)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\ProductName = "ScreenConnect Client (1059849e32002f21)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.4.4.9118\\1059849e32002f21\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-1059849e32002f21\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F566CCF508BB3384019548E92300F212\955FFA1A5D6B4F07C3BA9CAC78AD8AA2 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-1059849e32002f21 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\955FFA1A5D6B4F07C3BA9CAC78AD8AA2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\955FFA1A5D6B4F07C3BA9CAC78AD8AA2\ProductIcon = "C:\\Windows\\Installer\\{A1AFF559-B6D5-70F4-3CAB-C9CA87DAA82A}\\DefaultIcon" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4372 msiexec.exe 4372 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1844 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 1240 msiexec.exe Token: SeIncreaseQuotaPrivilege 1240 msiexec.exe Token: SeSecurityPrivilege 4372 msiexec.exe Token: SeCreateTokenPrivilege 1240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1240 msiexec.exe Token: SeLockMemoryPrivilege 1240 msiexec.exe Token: SeIncreaseQuotaPrivilege 1240 msiexec.exe Token: SeMachineAccountPrivilege 1240 msiexec.exe Token: SeTcbPrivilege 1240 msiexec.exe Token: SeSecurityPrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeLoadDriverPrivilege 1240 msiexec.exe Token: SeSystemProfilePrivilege 1240 msiexec.exe Token: SeSystemtimePrivilege 1240 msiexec.exe Token: SeProfSingleProcessPrivilege 1240 msiexec.exe Token: SeIncBasePriorityPrivilege 1240 msiexec.exe Token: SeCreatePagefilePrivilege 1240 msiexec.exe Token: SeCreatePermanentPrivilege 1240 msiexec.exe Token: SeBackupPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeShutdownPrivilege 1240 msiexec.exe Token: SeDebugPrivilege 1240 msiexec.exe Token: SeAuditPrivilege 1240 msiexec.exe Token: SeSystemEnvironmentPrivilege 1240 msiexec.exe Token: SeChangeNotifyPrivilege 1240 msiexec.exe Token: SeRemoteShutdownPrivilege 1240 msiexec.exe Token: SeUndockPrivilege 1240 msiexec.exe Token: SeSyncAgentPrivilege 1240 msiexec.exe Token: SeEnableDelegationPrivilege 1240 msiexec.exe Token: SeManageVolumePrivilege 1240 msiexec.exe Token: SeImpersonatePrivilege 1240 msiexec.exe Token: SeCreateGlobalPrivilege 1240 msiexec.exe Token: SeCreateTokenPrivilege 1240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1240 msiexec.exe Token: SeLockMemoryPrivilege 1240 msiexec.exe Token: SeIncreaseQuotaPrivilege 1240 msiexec.exe Token: SeMachineAccountPrivilege 1240 msiexec.exe Token: SeTcbPrivilege 1240 msiexec.exe Token: SeSecurityPrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeLoadDriverPrivilege 1240 msiexec.exe Token: SeSystemProfilePrivilege 1240 msiexec.exe Token: SeSystemtimePrivilege 1240 msiexec.exe Token: SeProfSingleProcessPrivilege 1240 msiexec.exe Token: SeIncBasePriorityPrivilege 1240 msiexec.exe Token: SeCreatePagefilePrivilege 1240 msiexec.exe Token: SeCreatePermanentPrivilege 1240 msiexec.exe Token: SeBackupPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeShutdownPrivilege 1240 msiexec.exe Token: SeDebugPrivilege 1240 msiexec.exe Token: SeAuditPrivilege 1240 msiexec.exe Token: SeSystemEnvironmentPrivilege 1240 msiexec.exe Token: SeChangeNotifyPrivilege 1240 msiexec.exe Token: SeRemoteShutdownPrivilege 1240 msiexec.exe Token: SeUndockPrivilege 1240 msiexec.exe Token: SeSyncAgentPrivilege 1240 msiexec.exe Token: SeEnableDelegationPrivilege 1240 msiexec.exe Token: SeManageVolumePrivilege 1240 msiexec.exe Token: SeImpersonatePrivilege 1240 msiexec.exe Token: SeCreateGlobalPrivilege 1240 msiexec.exe Token: SeCreateTokenPrivilege 1240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1240 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1240 msiexec.exe 1240 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1240 msiexec.exe 4372 msiexec.exe 5084 MsiExec.exe 5836 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1844 wrote to memory of 1240 1844 ScreenConnect.ClientSetup.exe 88 PID 4372 wrote to memory of 5084 4372 msiexec.exe 90 PID 5084 wrote to memory of 2688 5084 MsiExec.exe 91 PID 4372 wrote to memory of 3180 4372 msiexec.exe 96 PID 4372 wrote to memory of 5836 4372 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\1059849e32002f21\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5B4946D858FA87E2CE046246A279617D C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759796 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2688
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3180
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 92D0483109E4AC7D4C160F1CBEA643E62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5836
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f7f4.rbs
- Size 10KB
- SHA256 3465ef172d64c8c39602e0e68ec1c5b407db657dbf752b8b5fe5d48e91e408f9
- MD5 1d90ddc413051ef8f560dd20d838e792
- SHA1 186f2f758b48e8b018f406f429b25427093c2c95
- SHA512 ca512849b4380af453466cef0843cd63f937c58009f2ba5bfc1e2e9ba0e6d265dcae9da259624e62e52c0220a1958575a46b79a981c74cc6c66922fae84e8aa5
- SSDEEP 192:z8LnmFQyLwOeOzBQBC+I++YRIPz++YRSP6u00Yjjpj:z8LnmFQyLwOeOzye++Ycz++YKC06F
- TLSH T110221C22760095F1F9630F31C7571B043BB2EDE42610260F51CE9A3E4F62785ABBD6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp
- Size 1.0MB
- SHA256 db51e4b70f27d0bf28789ea3345bf693035916461d22661c26f149c5bc8891ed
- MD5 4abad4fd1a22bc922b457c28d1e40f1a
- SHA1 fc5a486b121175b547f78d9b8fc82fd893fcf6ed
- SHA512 21d52ccf5b5041319a007f72c5cd5830f2a99e7b0ab2b946a87a25adebb78d6fbe1ff95a01f26e530a0d30d838560d8acf716e0c43aeb5ad69334a897456a5a1
- SSDEEP 24576:QUUGG2P+Yn1UfV9rBcWE9gvlPvaZb9xn95RivMm54Nby:jG2mY1iHJoTn977zby
- TLSH T15A35233072E0C131F26667350879327012F93A7295B4978E7F850DAEAEF1B89DA74727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp-\ScreenConnect.Core.dll
- Size 537KB
- SHA256 8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
- MD5 665a8c1e8ba78f0953bc87f0521905cc
- SHA1 fe15e77e0aef283ced5afe77b8aecadc27fc86cf
- SHA512 0f9257a9c51eb92435ed4d45e2eaaa0e2f12983f6912f6542cc215709ae853364d881f184687610f88332eca0f47e85fa339ade6b2d7f0f65adb5e3236a7b774
- SSDEEP 6144:JL2DLhOnlTQatfpw7TkJ9/KeZBFR/Zw7VTcWt5jv8jyEzR39GBCquqwMSRq/sreR:JLMhOeM52aBFcTbkdpRL6Ei
- TLSH T10EC46D037398EB3BEDAF573EA43151C94670EC01295AE76F1ED4D8E61E823864F442E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 d09447d4816e248c16891361d87019156cc7664b213357a8e6c422484b8d6b4e
- MD5 7572b9ae2ecf5946645863a828678b5a
- SHA1 438a5be706775626768d24ba5f25c454920ad2f2
- SHA512 b1cee9458be3579a02b6f7e8d0b76f67a4b2d1f170db2e09af75d9901723e80e68650fe8fbbe43c8f062df7d50889e224b7cd9767027a0d7a5121a4534f2afa4
- SSDEEP 192:A8/Qp6lCJuV3jyXtyVNamVNG1YZfCrMmbfHJ7kjvLXbuLd9NEFb4/:d/cBJaGXt2NaheUrMmb/FkjvLXbuZr/
- TLSH T15332D60037DC533AE8BE1F78AAB762910A71FA64A011DF2E18C891569D367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB387.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 2659f660691d65628d2fcc3bfc334686cd053f162cdb73bf7a0da0ac6449db92
- MD5 7099c67fe850d902106c03d07bfb773b
- SHA1 f597d519a59a5fd809e8a1e097fdd6e0077f72de
- SHA512 17849cb444d3ac2cd4658d4eca9dc89652beae6c6a2bd765749d8ba53e37248fd92a00af2b45371c21182135fffa6dd96dc9570bfd41459f23e084c3e122d162
- SSDEEP 24576:aOgPFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:PgPJkGYYpT0+TFiH7efP
- TLSH T14985AD01E2D365F9D46B047888BF572AAA743C040325CAFB97D4BE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\1059849e32002f21\ScreenConnect.ClientSetup.msi
- Size 12.8MB
- SHA256 a818fa466efb152d0a19ffd1c0174f910e039d9272376c23aaf460bf14e3252a
- MD5 5b8e2ee9f318e657d042aba0fe116af8
- SHA1 2d97a77dde50ca3e599c870a79ed4e3382cf5588
- SHA512 6eba0271da142a0b6c908ec65d9126f0878994e589b37013ce982e1d28626b6728304bffeeea0a4b8113ffa05cd367c2e81491e9ef54161f3190de40894039ef
- SSDEEP 393216:eT3dRx9fnT3dqT3dFT3dBT3dJT3dOT3dq:u3dRrT3da3d53dl3dN3de3dq
- TLSH T169D6221222FC4126E5F72B3AEE7E85A05539BD709E12C06F97103A0D2A76F40C5B67B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIFCF5.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0a19bceaf20a8ef48709266a61a0ca574e7556f5501dc043ded92cda250f9097
- MD5 9ba943f5b80b75d6d8758dd273f81c99
- SHA1 fc13eae07c20ea86d260689596f2d98582f7ffc4
- SHA512 74a3942d2c5593af0c9a2269f501f8a391550d5539aed17e5de863f88397f5558f0d29ea05507200b59208d2000593f56f32e2a94a849ef714aedee01d2854e8
- SSDEEP 24576:DFo3DMPodoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:2Hk
- TLSH T17E57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8e56dfd5-8634-45cd-b9a6-31b65f183823}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a3248b6a8f11d83ff00cf446379af04205bc8726c18634a6e034d3f6b95c0271
- MD5 0f85c758448fa9d0df6464ee13f564c4
- SHA1 0c92d81cb7f438945b30e3d1de418022fa1baa03
- SHA512 aef61f73bad052f98e9464fccee61361fb7b525a9af404ba5fc72e569e4a147204076b6d17b7d92f7455e0acb615676d5dbeca827212dc4a374946cc4010e81a
- SSDEEP 96:FJI8Fbdvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:DImb++uVm
- TLSH T1B8D177084AF54311E2B3AB7128F18557A837B911EF33CB8E0198238E6671A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH